ClawHub
Back to skill

Security audit

Chemical Structure Converter

Security checks for vulnerabilities and agentic risk

Overview

The skill is not overtly malicious, but it overstates its chemical-conversion accuracy and under-discloses local file-writing behavior.

Treat this as a small demo lookup tool, not a reliable chemistry engine. Before installing, require clearer disclosure of file writes, narrower tool permissions, and corrected claims about validation and conversion accuracy; do not rely on it for scientific, safety, or drug-discovery decisions without independent cheminformatics validation.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The skill materially overstates its capabilities, presenting broad chemical identifier conversion and validation when the underlying behavior is described as hardcoded lookup plus minimal syntax checks. In a research or drug-discovery workflow, this can cause users or downstream agents to rely on inaccurate structure conversions or false validation results, leading to bad scientific decisions or unsafe handling of chemical data.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 773)May include surrounding context.

md
- Solutions:
  - Try alternative names or synonyms
  - Use external database (PubChem API)
  - Manually create entry for novel compounds

**Problem: SMILES validation fails**
- Symptoms: Valid-looking SMILES rejected

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The document claims there is no file system access, yet examples explicitly write JSON and CSV files to disk. This contradiction can mislead users, policy engines, or automated reviewers into granting the skill broader trust than warranted, increasing the chance of unintended local data persistence or overwrite of workspace files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Contradictory risk disclosure undermines trust in the skill's self-reported security properties. When a skill says it has no file access but demonstrates file-writing behavior, operators may underestimate persistence and data-handling risks, especially in automated environments that rely on markdown declarations for review or policy decisions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The file-level documentation explicitly states the tool converts between IUPAC names, SMILES, and 2D/3D structures. The code only supports lookup between names and SMILES plus formula display from a static table, so the docstring overstates and contradicts actual behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest describes a general converter between IUPAC names, SMILES strings, and molecular formulas with support for cheminformatics workflows. In practice, the implementation is a fixed in-memory lookup table for four compounds and does not implement formula conversion, broader interconversion logic, or data-preparation operations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The manifest description focuses on converting identifiers, validating structures, and preparing cheminformatics data, which suggests transformation logic rather than persistence actions. However, the document explicitly shows generating JSON and CSV output files for database import, extending behavior into local data export/persistence beyond pure conversion.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The 'Related Skills' section uses Chinese labels '上游' and '下游' alongside English equivalents, but the document does not state any language/locale policy or user choice. This can impose a locale-specific presentation style without explicit opt-in or justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.