Fusion Workflow Hub

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:31 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent code-analysis workflow hub, but it relies on third-party Python installs and creates local graph artifacts, so users should scope it carefully.

Before installing, use an isolated environment such as a virtualenv, pipx, or uv, review or pin dependency versions where possible, run graph building only on intended directories, and avoid including secrets or private documents unless you are comfortable with local graph artifacts being created in the project.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:119

Finding

Unpinned Third-Party Dependencies in Primary Skill Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 119-120
Vulnerability Type: Unpinned and unverified third-party package installation
Risk Level: Medium

Vulnerable Code:

markdown

- Graphify: `pip install graphifyy`
- Document support: `pip install python-docx openpyxl pillow`

Technical Analysis

The skill instructs users or agents to install packages directly from the default Python package index without version constraints, cryptographic hashes, a lock file, or package provenance verification. Consequently, the exact code installed can change after the skill has been audited.

There is also an unexplained naming difference between the referenced upstream project, “Graphify,” and the package name graphifyy. The available files do not establish that this distribution is an authenticated artifact of the referenced project. This creates potential exposure to package-name confusion, typosquatting, account compromise, or a malicious future release.

Python packages may execute package-controlled logic during source builds or when their installed modules and command entry points are subsequently invoked. Graphify is explicitly intended to run against a target repository, so a compromised package would receive the invoking user's access to that repository and environment.

Attack Path

1. An attacker publishes or compromises a release of one of the unpinned packages, or controls a confusingly named distribution.
2. A user or agent follows the skill instructions and runs the documented pip install command.
3. Pip resolves the current mutable package release without validating it against a reviewed version and hash.
4. Attacker-controlled logic executes during a source-package build or when the installed analyzer is subsequently invoked.
5. The malicious dependency reads, modifies, or removes files accessible to the invoking account and may access environment variables, repository secrets, ...[truncated 492 chars]

Remediation

View remediation

Remediation Suggestions

• Replace unconstrained package installation commands with exact, security-reviewed versions.
• Supply a requirements or lock file containing cryptographic hashes and require installation with pip install --require-hashes.
• Verify and document the authoritative mapping between the Graphify upstream repository and the graphifyy package distribution.
• Install dependencies inside a dedicated virtual environment or disposable container under a non-privileged account.
• Review package source, maintainers, release history, signatures, and transitive dependencies before approving upgrades.
• Separate optional document-processing dependencies and install them only when the requested analysis requires those formats.
• Use an approved internal package mirror or artifact repository after packages have passed supply-chain review.

T08 · Insecure Dependencies

Warning

• Location: references/graphify-commands.md:6

Finding

Unpinned Third-Party Dependencies in Graphify Command Reference

Content

View full analysis

Vulnerability Details

File Location: references/graphify-commands.md, lines 6-11
Vulnerability Type: Unpinned and unverified third-party package installation
Risk Level: Medium

Vulnerable Code:

bash

pip install graphifyy

Optional dependencies:

bash

pip install python-docx openpyxl pillow

Technical Analysis

The command reference repeats direct installation of mutable third-party packages from pip. No versions, hashes, lock file, trusted index, or integrity-validation procedure are provided. A later package release can therefore introduce code that was not present during this audit.

The reference cites a project named “Graphify,” while installation uses the distribution name graphifyy, without documenting or verifying the relationship. This ambiguity increases supply-chain risk because users cannot confirm from these instructions alone that they are installing the intended package.

Installing a malicious source distribution can expose the system during package build processing. Even where installation itself uses a wheel without executing arbitrary package logic, subsequent execution of python -m graphify necessarily loads code supplied by the installed distribution.

Attack Path

1. An attacker gains control of a named dependency, publishes a malicious release, or exploits confusion around the graphifyy package name.
2. A user follows the reference and installs the latest package resolved by pip.
3. Pip accepts the package because the instructions specify neither an approved version nor a required hash.
4. Malicious code runs during applicable build processing or when the documented Graphify command is executed.
5. Because the tool is run against source directories, the malicious code can operate on repository contents and other resources accessible to the invoking user.

Impact Assessment

Exploitation may result in arbitrary code execution as the invoking us ...[truncated 307 chars]

Remediation

View remediation

Remediation Suggestions

• Document exact approved package versions and cryptographic hashes.
• Provide a reviewed lock file and require hash-verified installation.
• Confirm that graphifyy is the official distribution for the cited Graphify repository; otherwise replace it with the verified package name.
• Perform installation and analysis in an isolated virtual environment or sandbox with minimal filesystem and network permissions.
• Avoid installing the optional packages unless the selected input formats require them.
• Establish a dependency-update process that includes provenance checks, vulnerability scanning, and manual review before changing pinned versions.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

md

- `SKILL.md` - 本说明文件

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The skill's descriptive and usage text is written primarily in Chinese, including the activation guidance, without stating that users may interact in another language. This can be a natural-language policy issue if the skill effectively imposes a language choice without opt-in or documented justification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill’s activation criteria are very broad, covering common coding tasks such as understanding a codebase, planning, review, and complex programming work. This can cause the skill to be invoked in many situations where its file-writing workflows and external tool assumptions are unnecessary, increasing the chance of unintended repository modifications or over-privileged analysis behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The entire skill reference is written in Chinese, including headings, descriptions, and usage guidance, with no indication that language selection is optional or that the document is intended only for a Chinese-speaking or region-specific audience. Under the policy, imposing a specific language without opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The workflow instructs the agent to run commands that create and update repository files such as graphify-out/ and perform incremental updates, but the skill does not clearly warn the user beforehand. This is dangerous because users may expect read-only analysis while the skill writes artifacts into the working tree, potentially polluting repos, affecting diffs, or interacting badly with CI and automation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

This markdown file documents commands that build a graph and explicitly supports writing outputs to a default or specified output directory. It also lists generated files and a cache directory, but does not include any warning that running the command will create or modify files on disk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 66% confidence

Finding

The markdown shows commands to generate an HTML report and open an interactive graph, which affects local filesystem state and launches a local file. There is no accompanying warning or disclosure about these side effects for the user.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.