ClawHub
Back to skill

Security audit

Antibody Humanizer

Security checks for vulnerabilities and agentic risk

Overview

The skill appears intended for antibody humanization, but it contains under-disclosed patent-database workflow guidance and overstated scientific capabilities that users should review before installing.

Review this skill before installing if you work with confidential antibody sequences. Treat outputs as rough computational suggestions only, avoid sending proprietary sequences to patent or other external databases unless your organization has approved that workflow, and remove or pin the unnecessary dependencies before automated installation.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
requirements.txt:1
Finding

Unnecessary and Unpinned Third-Party Dependencies

Content
View full analysis

Vulnerability Details

File Location: requirements.txt:1-2
Vulnerability Type: Supply-chain exposure through unnecessary, unpinned dependencies
Risk Level: Medium

Complete Code Snippet:

text
dataclasses
enum

The declarations also conflict with SKILL.md:512-517, which states:

text
## Prerequisites

```bash
# Python 3.7+
# No external packages required (uses standard library)
text

### Technical Analysis

The project targets Python 3.7 or newer, where both `dataclasses` and `enum` are available through the Python standard library. The implementation imports them directly:

```python
from dataclasses import dataclass, asdict
from enum import Enum

Consequently, the two package-index dependencies are unnecessary for the documented runtime. Because neither dependency is version-pinned or hash-verified, installation depends on mutable package-index resolution and executes third-party package installation logic without a functional need.

This unnecessarily expands the project's software supply-chain attack surface. A compromised package release, unsafe package-index configuration, or package-name confusion could cause hostile installation logic to execute in the environment running pip. The finding does not establish that the currently resolved packages are malicious; the vulnerability is the avoidable and non-reproducible trust relationship created by the manifest.

Attack Path

  1. A user or automated deployment process runs pip install -r requirements.txt.
  2. The configured package index resolves the unpinned dataclasses and enum names.
  3. An attacker who has compromised a resolved distribution or can influence package-index resolution supplies a hostile release.
  4. The installer downloads and processes the attacker-controlled distribution.
  5. Malicious installation or package code executes with the privileges of the installation process.
  6. The attac ...[truncated 789 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove both entries from requirements.txt and leave the dependency manifest empty for the documented Python 3.7+ runtime.
  2. Enforce the supported Python version in project metadata and CI so that the standard-library implementations are always available.
  3. If support for an older Python version is genuinely required, use only the official backport with an explicit environment marker, an exact version pin, and verified hashes. Do not add a third-party enum package where the standard-library module is available.
  4. Install dependencies with hash enforcement, such as pip install --require-hashes, when third-party packages are added in the future.
  5. Generate and review a locked dependency set, use an approved package index, and scan resolved distributions in CI.
  6. Update requirements.txt and SKILL.md together so the declared dependency model matches actual runtime requirements.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill broadens from antibody humanization into patent-landscape and novelty analysis, which is a materially different function with different legal, privacy, and security implications. Scope expansion can cause agents or users to handle proprietary biological sequences in unintended workflows and may bypass governance that only approved the skill for scientific design assistance.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

Patent database novelty checking is context-inappropriate for a humanization skill because it encourages use of proprietary therapeutic sequences in an external legal/competitive analysis workflow that is not declared elsewhere in the skill. In this biological R&D context, sequence confidentiality is highly sensitive, so undocumented expansion into novelty searches increases the risk of data exposure and unauthorized use.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documentation is internally inconsistent: it claims no external API calls and no patent checking, yet it also instructs users to run a patent novelty workflow against USPTO/EPO/WIPO. This can mislead operators and downstream security controls about the skill's actual scope and network behavior, increasing the chance that external access or sensitive sequence disclosure occurs without proper review.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The header documentation presents the skill as an AI-powered antibody humanization system that predicts optimal human frameworks, but the code performs only a small-database heuristic grafting workflow. In a bioinformatics skill used for therapeutic sequence design, overstating capability is dangerous because it can mislead downstream users into treating approximate outputs as scientifically validated recommendations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The tool advertises framework optimization, germline prediction, and multiple output formats, but the implementation uses simplistic heuristic scoring and always serializes JSON regardless of the requested format. In a therapeutic antibody design context, this mismatch can cause users to trust biologically unsupported outputs and make research or development decisions on inaccurate results, creating a supply-chain-style integrity risk rather than a memory-safety issue.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
60% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
dataclasses
enum

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
60% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text
dataclasses
enum