Bio-Ontology Mapper

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:40 AM UTC
• Version: 1.0.0

Overview

The skill appears intended for biomedical ontology mapping, but it needs review because its documented scope and install dependencies are not cleanly aligned with what it actually ships.

Review before installing. Prefer running the script without installing requirements, remove the unnecessary requirements.txt entries, and use local-only mode for sensitive clinical text. If API mode is needed, de-identify inputs first and use an environment variable for the UMLS key rather than a command-line argument.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unnecessary unpinned packages create a dependency-confusion and supply-chain risk

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1-2
Vulnerability Type: Unnecessary and unpinned third-party dependencies
Risk Level: Medium

Vulnerable code:

text

dataclasses
difflib

Technical Analysis

The project declares Python 3.10 or later, under which dataclasses and difflib are provided by the Python standard library. Installing packages with these names from a package index is therefore unnecessary.

Neither dependency has a pinned version or integrity hash. Package installation can execute package-controlled build or installation logic. Consequently, the effective code installed is determined by the configured package index and its current contents rather than by this reviewed repository.

Exploitation would require an attacker to control or compromise a resolved package, the configured package index, a higher-priority private/public index entry, or the dependency-resolution path. No evidence was found that the repository itself controls those external packages.

Attack Path

1. A user or automated build runs pip install -r requirements.txt.
2. The package manager searches its configured indexes for packages named dataclasses and difflib.
3. An attacker-controlled or compromised distribution is selected through package-index compromise, dependency confusion, or unsafe index configuration.
4. Package build or installation code executes with the privileges of the user or CI worker running pip.
5. The malicious dependency may access files, environment variables, network resources, and credentials available to that process.

Impact Assessment

Successful exploitation could provide arbitrary code execution within the dependency installation environment. The resulting access would be limited to the operating-system privileges, filesystem access, environment secrets, and network permissions of the user or CI worker performing installation. In a privileged build ...[truncated 138 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove both entries because the project targets Python 3.10+:

   text

   # No external runtime dependencies are currently required.
   

2. Do not install packages that duplicate standard-library module names.
3. If genuine external dependencies are added later, pin exact reviewed versions.
4. Use integrity hashes, such as pip install --require-hashes, for reproducible installations.
5. Restrict package resolution to trusted indexes and explicitly control private/public index priority.
6. Perform dependency installation in an isolated, non-privileged environment without production credentials.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/main.py:64

Finding

UMLS API credential is included in the request URL query string

Content

View full analysis

Vulnerability Details

File Location: scripts/main.py:64-66, 96-105
Vulnerability Type: Sensitive credential exposure through URL query parameters
Risk Level: Low

Vulnerable code:

python

query_string = urllib.parse.urlencode(params)
url = f"{self.BASE_URL}{endpoint}?{query_string}"

python

params = {
    "string": term,
    "apiKey": self.api_key,
    "pageSize": str(page_size)
}

if sabs:
    params["sabs"] = ",".join(sabs)

response = self._make_request("/search/current", params)

Technical Analysis

The UMLS API key is inserted into the params dictionary and encoded into the complete request URL. Transport uses HTTPS and the destination is the official NLM UMLS endpoint, so the credential is not sent in plaintext over the network based on the reviewed code.

Nevertheless, URL query strings are commonly captured by application diagnostics, HTTP proxies, monitoring systems, server access logs, exception telemetry, or debugging tools. Any component that records the full URL could retain the API key. This unnecessarily broadens the credential's exposure compared with an authorization header or another non-URL authentication mechanism.

API execution is opt-in through --use-api; no request occurs by default. The Skill also reads the key only from --api-key or UMLS_API_KEY. No hardcoded credential, unknown destination, or deliberate credential exfiltration was found.

Attack Path

1. A user supplies a UMLS API key and enables --use-api.
2. The script adds the key to the apiKey query parameter.
3. _make_request constructs a URL containing the complete key.
4. A local proxy, monitoring agent, debug logger, server access log, or other component records the full request URL.
5. A party with access to that log or telemetry retrieves the key.
6. The exposed key may be reused against the UMLS API until revoked or rotated.

Impact Assessment

Exposure ...[truncated 588 chars]

Remediation

View remediation

Remediation Suggestions

1. If the UMLS API supports it, transmit the credential in an authorization header rather than in the URL.
2. If the upstream API requires apiKey as a query parameter:
   • Never log complete request URLs.
   • Redact apiKey from exceptions, diagnostics, telemetry, and proxy logs.
   • Document that intermediary logging must be disabled or sanitized.
   • Use a dedicated, least-privilege API credential and rotate it after suspected exposure.
3. Prefer the UMLS_API_KEY environment variable over the --api-key argument because command-line arguments may be visible in process listings or shell history.
4. Before enabling API mode, require confirmation that submitted terms contain no PHI or other prohibited sensitive information.
5. Preserve local-only operation as the default and clearly identify --use-api as causing external data transmission.
6. Consider implementing an explicit redaction or de-identification step for batch inputs before remote lookup.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The manifest and top-level description narrow the skill to SNOMED CT mapping, but the body describes broader ontology support and external API usage including UMLS and MeSH. This mismatch can mislead operators into invoking a skill under stricter assumptions than its actual behavior, especially dangerous in biomedical contexts where text may contain sensitive data and network access may transmit it externally.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill advertises executable scripts and API-based lookups, implying filesystem, environment, and network use, but it does not declare any tool scope or permissions. This creates a transparency and containment gap: an agent or reviewer cannot reliably determine what capabilities the skill may exercise, increasing the risk of unintended data access, exfiltration, or writes during execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The 'When to Use' section mixes a specific ontology-mapping task with broad phrases like 'evidence insight tasks' and 'documented fallback path,' which could overlap with many unrelated skills. It does not provide clear exclusions or negative examples to constrain invocation scope.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest description says the skill maps biomedical text to standardized ontologies and explicitly names SNOMED CT, implying a narrower ontology scope. The code and module docstring implement MeSH mapping as a first-class capability alongside SNOMED CT, including dedicated MeSH API and local matching logic.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

When --use-api is enabled, user-supplied biomedical terms are sent to external UMLS and MeSH services over the network without any explicit consent, warning, or data-sensitivity controls. In this skill context, inputs may contain protected health information or sensitive research terms, so silent transmission to third parties creates a real confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The top-level description ends abruptly at 'SNOMED CT.' and does not fully describe scope, supported inputs, or boundaries. In a manifest-like header, this weak specificity can contribute to broad or inconsistent invocation behavior.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 60% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

dataclasses
difflib

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 60% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

dataclasses
difflib

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The code accesses the UMLS_API_KEY environment variable to authenticate external API requests. While this is functionally expected for API usage, there is no explicit warning or disclosure beyond the argument help text that the skill will read a credential from the environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The code performs a file write when --output is provided, but there is no prior disclosure or confirmation that the specified path will be created or overwritten. A post-write message is present, but it does not warn the user before the operation occurs.

Content

No source excerpt is available for this finding.