Chemical Storage Sorter

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:05 AM UTC
• Version: 0.1.0

Overview

This skill is not malware, but it needs Review because it gives real-world chemical storage advice with unreliable logic and broader agent permissions than its core function needs.

Only install this with tight sandboxing and reduced permissions, and do not rely on its output for real chemical storage decisions. Treat results as a rough draft that must be checked against current SDSs, institutional EHS procedures, and qualified human review, especially for unknowns, mixtures, multi-hazard chemicals, toxics, cyanides, oxidizers, and any compatibility decision.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/main.py:48

Finding

Unsafe Fail-Open Chemical Classification Can Produce Hazardous Storage Guidance

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/main.py:77

Finding

Broad Group Matching Incorrectly Declares Chemical Pairs Compatible

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:4

Finding

Skill Declares Unnecessary Command Execution and File Modification Permissions

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Harmful Content Injection

Critical

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

This content may contain harmful instructions that could cause physical harm if followed. CRITICAL: Review carefully before use.

Content

Scanner excerpt · SKILL.md (reported line 293)May include surrounding context.

md

demo_inventory = [
    "HCl (concentrated)",
    "NaOH pellets",
    "Ethanol",
    "Hydrogen peroxide",
    "Sodium cyanide",
    "PBS",
    "Acetone"
]

groups = sorter.sort_chemicals(demo_inventory)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This tool produces laboratory chemical storage classifications and compatibility guidance in a safety-critical domain, but it does not warn users that the logic is simplified, incomplete, and unsuitable as the sole basis for storage decisions. Because the classifier relies on substring matching and limited hard-coded groups, it can misclassify hazardous chemicals and create a false sense of safety, potentially leading to dangerous co-storage decisions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This skill provides chemical classification and storage recommendations in a safety-critical domain, but the cited section lacks a prominent warning not to rely on generated output as the sole basis for handling unknown or incompletely identified chemicals. Overreliance on heuristic classifications in lab storage could cause incompatible storage decisions, leading to toxic release, fire, or other physical harm.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill’s Security Checklist and Risk Assessment claim there is no file system access, but the document elsewhere includes file-reading logic (open(file_path, 'r')) and describes generating output files. This mismatch can mislead operators, policy engines, or reviewers into granting broader trust than warranted, increasing the chance of unintended file access in real deployments.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The related-skills section uses Chinese terms '上游' and '下游' alongside English, which introduces a locale-specific presentation choice without any user opt-in or explanation. Under the language policy, skills should avoid imposing a specific language or locale unless it is optional or clearly justified.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

The docstring says the function processes a chemical inventory from a text file with one chemical per line, but the implementation also computes hazard statistics and builds an incompatibility report before returning a structured analysis object. While related to the same workflow, the docstring understates what the function actually does.

Content

No source excerpt is available for this finding.