T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/main.py:679- Finding
Unrestricted Report Path Allows Overwriting Arbitrary Writable Files
- Content
View full analysis
- Remediation
View remediation
Security audit
Blockbuster Therapy Predictor
Security checks for vulnerabilities and agentic risk
Overview
This biotech scoring skill is not malicious, but it overstates its data-backed investment analysis and can overwrite user-writable files when saving reports.
Install only if you treat this as a demonstration, not as reliable investment or R&D advice. Avoid running pip install -r requirements.txt unless the dependencies are removed or pinned, and do not use --save with absolute paths, ../ paths, symlinks, or existing files until output-path validation and overwrite protection are added.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
requirements.txt:1- Finding
Unnecessary and Unpinned Third-Party Dependencies Create Supply-Chain Exposure
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill advertises local script execution and report saving, but does not declare any explicit tool scope such as allowed-tools or permissions. That mismatch can lead to overbroad runtime access or unclear enforcement boundaries, increasing the chance that file-write behavior is invoked without proper review or sandbox policy alignment.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger condition is written broadly enough to match ordinary conversations about biotech platforms, investment potential, or modality comparisons. This can cause unintended invocation of a script-capable skill in contexts where the user did not explicitly request tooling, increasing the risk of unnecessary code execution, file output, or confusing autonomous behavior.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The market potential score is derived from hardcoded per-technology lookup tables rather than analysis of the stated dimensions, so the output can present subjective embedded rankings as if they were analytic results. In this skill's context of investment and therapeutic platform selection, that mismatch increases the risk of deceptive or overconfident recommendations.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill claims to evaluate clinical trial progression, patent landscape maturity, and VC funding trends, but it actually operates on a fixed mock dataset and hardcoded assumptions. In an investment and R&D prioritization context, this is dangerous because users may rely on outputs that appear evidence-based but are not grounded in current or user-supplied data, leading to materially misleading decisions.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The document is predominantly in English, but line L156 introduces Chinese text ("AI自主验收状态: 需人工检查") without explanation or offering the user a language choice. This creates a language policy issue because the skill imposes mixed-language output/instructions without opt-in or justification.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 60% confidence
- Finding
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
- Content
text dataclasses enum
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 60% confidence
- Finding
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
- Content
text dataclasses enum
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The manifest describes prediction, analysis, and prioritization scoring for biotechnology platforms, but does not mention persisting outputs to arbitrary file paths. While report generation is related, writing to disk is additional behavior beyond the described analytic scope.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
This code writes report output to a user-supplied file path via
open(..., "w"), which can overwrite existing files. Although the script exposes a--saveoption, there is no explicit warning in the help text, prompt, or comment that using it will create or overwrite files on disk.- Content
Static analysis
No suspicious patterns detected.