deeppurpose

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 3:57 AM UTC
• Version: 1.0.1

Overview

This skill is a coherent DeepPurpose helper with disclosed install and download guidance, but users should treat its unpinned Git dependency example cautiously.

Install in an isolated conda or virtual environment, avoid running install commands with elevated privileges, and consider pinning the Git dependency to a reviewed commit before use. Be aware that dataset helpers and pretrained model helpers may download remote files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/install-and-dependencies.md:34

Finding

Unpinned Installation of Executable Code from a Mutable Git Repository

Content

View full analysis

Vulnerability Details

File Location: references/install-and-dependencies.md, line 34
Vulnerability Type: Supply-chain exposure through an unpinned Git dependency
Risk Level: Medium

Vulnerable Code:

bash

pip install git+https://github.com/bp-kelley/descriptastorus

Technical Analysis

The installation guidance directs pip to retrieve a Python package from a Git repository without specifying an immutable commit hash or otherwise verifying the downloaded content. The effective package version therefore depends on the repository's mutable default branch at installation time.

Python package installation can execute build-system and installation logic. If the upstream repository, a maintainer account, or its delivery path is compromised, later users following this instruction could execute content that was not present during this audit. The audited project contains no evidence that the referenced repository is currently malicious; the vulnerability is the absence of source pinning and integrity controls.

This network access is relevant to installing an upstream DeepPurpose dependency, but allowing an external mutable source to supply executable code exceeds the minimum privilege needed for reproducible installation.

Attack Path

1. An attacker compromises the upstream Git repository or an authorized maintainer account.
2. The attacker modifies the repository's default branch to include malicious package build or installation logic.
3. A user follows the Skill's documented installation command.
4. pip clones the current mutable repository content and invokes its package build or installation process.
5. The malicious logic executes with the privileges of the user running pip.

Exploitation requires both an upstream compromise or malicious upstream change and a user executing the documented command.

Impact Assessment

Successful exploitation could grant arbitrary code execution un ...[truncated 553 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the mutable Git reference with a reviewed, immutable full commit hash, for example:

  bash

  pip install "git+https://github.com/bp-kelley/descriptastorus.git@FULL_REVIEWED_COMMIT_HASH"
  

• Prefer a trusted package-index release with an exact version pin when an appropriate maintained release is available.
• Maintain dependencies in a lock file and verify artifact hashes, such as by using pip install --require-hashes -r requirements.txt.
• Review the pinned source and its transitive dependencies before updating the pin.
• Perform installation inside an isolated virtual environment or container under a non-administrative account.
• Avoid exposing unrelated credentials or sensitive host directories to the installation environment.
• Document an explicit dependency-update review process so immutable pins are changed only after source and integrity validation.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

YARA rule 'agent_skill_remote_bootstrap_execution': Remote script or code download followed by execution/bootstrap installation [agent_skills]

High

• Category: YARA Match
• Confidence: 85% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/install-and-dependencies.md (reported line 37)May include surrounding context.

irements.txtstill needs heavy packages: rdkit-pypi, torch, dgllife, ax-platform, subword-nmt`, and others.

• DeepPurpose/utils.py also raises an explicit import error until descriptastorus and pandas-flavor are present.

Practical Install Paths

README pip path:

bash

conda create -n DeepPurpose python=3.6
conda activate DeepPurpose
conda install -c conda-forge notebook
pip install git+https://github.com/bp-kelley/descriptastorus
pip install DeepPurpose

Source checkout path:

bash

conda env create -f environment.yml
conda activate DeepPurpose
jupyter notebook

Validation Levels

Static checks that do not require project dependencies:

bash

python3 setup.py --name
python3 -m compileall DeepPurpose

Runtime checks after the environment is ready:

bash

python -c "from DeepPurpose import DTI, CompoundPred, DDI, PPI, ProteinPred, oneliner"

Dependency Hotspots

• RDKit features drive multiple drug encodings.
• Descriptastorus is req

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · license.txt (reported line 25)May include surrounding context.

text

IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

Static analysis

No suspicious patterns detected.