Cnv Caller Plotter

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:18 AM UTC
• Version: 0.1.0

Overview

This skill is a genomics analysis tool that can produce hard-coded CNV results while presenting them as real analysis output.

Review carefully before installing or using. Do not use this skill for research, clinical, publication, or patient-related decisions until the CNV algorithm, input validation, plotting, dependency specification, and privacy handling are implemented and independently validated. Treat any current output as demonstration data only.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:924
• Finding: Unpinned Third-Party Package Installation Creates a Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:924-932` **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown **Problem: Cannot install or run tool** - Symptoms: Import errors, missing dependencies, execution failures - Causes: - Missing Python packages (pysam, numpy, matplotlib) - Incompatible Python version - Missing reference genome index files - Solutions: - Install required packages: `pip install pysam numpy matplotlib pandas` - Use Python 3.8 or higher ``` ### Technical Analysis The troubleshooting instructions direct users or an AI agent with Bash access to install four packages from the configured Python package index. No versions or hashes are pinned, and the instructions do not require an isolated environment, reviewed lock file, or explicitly trusted package repository. Python package installation can execute package build hooks and other installation-time code. Because dependency resolution is mutable, the code installed when the command is run may differ from the code that existed when this skill was audited. The risk applies both to the explicitly named packages and to their transitive dependencies. No evidence indicates that the named packages are currently malicious. The vulnerability is the unsafe and non-reproducible installation procedure rather than a confirmed compromise of those packages. ### Attack Path 1. A user encounters an import or dependency error. 2. The user or agent follows the documented troubleshooting instruction. 3. `pip` resolves the latest compatible versions from its configured index and may also resolve transitive dependencies. 4. An attacker who has compromised a package release, transitive dependency, package index, or local pip index configuration supplies malicious package content. 5. Installation hooks or subsequently imported malicious code execute under the account running `pip`. ### Impact Assessment Successful exploita ...[truncated 717 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create a reviewed dependency lock file containing exact versions. 2. Require package hashes, for example: ```bash python -m venv .venv . .venv/bin/activate python -m pip install --require-hashes -r requirements.txt ``` 3. Pin all direct and transitive dependencies in `requirements.txt`. 4. Configure installation to use an explicitly trusted package index. 5. Perform dependency vulnerability and provenance scanning before releases. 6. Avoid installing packages globally or with administrator privileges. 7. Reconcile the dependency documentation: `SKILL.md` also states that no additional packages are required, which conflicts with this troubleshooting instruction. ]]>

other

Error

• Location: scripts/main.py:18
• Finding: Program Reports Fabricated CNV Results Without Reading or Validating Inputs<![CDATA[ ## Vulnerability Details **File Location**: `scripts/main.py:18-30`; related misleading claims appear in `SKILL.md:997-1010` **Vulnerability Type**: other: Fabricated Scientific Analysis Output **Risk Level**: High ### Vulnerable Code Snippet ```python def call_cnvs(self, input_file, reference): """Call CNVs from input file.""" print(f"Processing {input_file}...") # Placeholder for actual CNV calling logic return [ {"chrom": "chr1", "start": 1000000, "end": 2000000, "cn": 3}, {"chrom": "chr7", "start": 50000000, "end": 55000000, "cn": 1}, ] def plot_genome_wide(self, cnv_calls, output_path, fmt="png"): """Generate genome-wide CNV plot.""" print(f"Generating plot: {output_path}/cnv_plot.{fmt}") return f"{output_path}/cnv_plot.{fmt}" ``` The related documentation claims include: ```markdown ## Security Checklist - [x] No hardcoded credentials or API keys - [x] No unauthorized file system access - [x] Input validation for file paths - [x] Output directory restricted - [x] Error messages sanitized - [x] **CRITICAL**: HIPAA compliance required for patient data ``` ```markdown ### Success Metrics - [x] Successfully processes BAM/VCF files - [x] Detects copy number variations - [x] Generates visualization plots - [x] Outputs results in BED format ``` ### Technical Analysis `call_cnvs()` ignores both `input_file` and `reference`. It does not open, parse, authenticate, or validate either file. Instead, every invocation returns the same two hard-coded CNV records, irrespective of whether the supplied sample exists, is malformed, belongs to another patient, or contains no such variants. `plot_genome_wide()` similarly creates no plot. It prints and returns an expected path without writing a file at that path. The CLI subsequently reports the operation as successfully completed. The implementation also does not support the documentation's assertions that input paths are validated or that the output director ...[truncated 2056 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Fail closed until genuine CNV analysis is implemented: ```python def call_cnvs(self, input_file, reference): raise NotImplementedError( "CNV calling is not implemented; no scientific result was generated." ) ``` 2. Remove normal success messages and checked success metrics while the implementation remains a placeholder. 3. Validate that input and reference paths: - Exist and are regular files. - Are readable. - Use supported formats. - Contain valid BAM/VCF and FASTA data. - Are compatible with the same reference genome build. 4. Implement actual input-dependent CNV analysis with documented algorithms, quality controls, and error handling. 5. Make plotting create the requested file and verify its existence before returning success. 6. Add explicit output-path policy checks if output restriction is a security requirement. 7. Add automated tests proving that: - Missing and malformed inputs fail. - Different samples can produce different results. - No results are emitted when analysis fails. - Every reported output file exists and is nonempty. 8. Clearly label any demonstration mode and ensure synthetic results cannot be confused with real patient results. 9. Update `SKILL.md` so its security checklist, success metrics, prerequisites, and lifecycle status accurately describe the implementation. ]]>

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill markets itself as performing CNV calling, segmentation, and publication-quality plotting, while the document itself later admits the implementation is placeholder and planned improvements still include implementing the actual algorithm. In a genomics workflow, this can mislead users into making research or clinical-adjacent decisions based on fabricated or unsupported results, which is a serious integrity and safety risk even without classic code-execution abuse.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill processes and writes results derived from whole-genome data, which can contain highly sensitive patient information, but it does not give a clear operational warning near usage/output sections about handling, storage, sharing, and retention of those outputs. In this context, missing privacy guidance increases the likelihood of accidental exposure of genomic data through local files, reports, or downstream sharing.

Natural-Language Policy Violations

Low

• Confidence: 83% confidence
• Finding: The document uses Chinese labels in the 'Related Skills' section ('上游', '下游') while the rest of the skill is written in English, with no indication that multilingual output is intentional or user-selectable. This can violate language/locale policy when a specific language is imposed without opt-in or justification.

Intent-Code Divergence

Low

• Confidence: 90% confidence
• Finding: The security checklist claims input validation, output restriction, and sanitized errors, yet the same document states the implementation is placeholder and key functionality is not actually implemented. Security assertions without evidence can cause operators to trust the skill with sensitive genomic inputs under false assumptions, increasing the chance of improper data handling or deployment in regulated contexts.

Intent-Code Divergence

Low

• Confidence: 97% confidence
• Finding: The prerequisites state that no additional packages are required, but the troubleshooting section names external dependencies such as pysam, numpy, matplotlib, and pandas. This inconsistency is not a direct exploit primitive, but it can cause users to run ad hoc installation commands, weaken reproducibility, and undermine trust in the environment assumptions for a tool handling sensitive genomic data.

Static analysis

No suspicious patterns detected.