Crispr Grna Designer

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:18 AM UTC
• Version: 0.1.0

Overview

This skill is not clearly malicious, but it presents mock CRISPR guide design and simulated off-target results as if they were production-grade genomic analysis.

Install only in an isolated, low-privilege environment and do not use its guide recommendations for real genome-editing decisions without independent validation. Treat current outputs as demo data unless the publisher implements real sequence retrieval, real off-target analysis, constrained output paths, and pinned dependencies.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned and Unnecessary Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1-7
Vulnerability Type: Supply-chain exposure through unpinned and excessive dependencies
Risk Level: Medium

Complete Code Snippet:

text

bio
biopython
dataclasses
numpy
pandas
pysam
requests

Technical Analysis

Every dependency is specified without an exact version or integrity hash. Consequently, installation resolves mutable releases from the configured package index rather than a reproducible, reviewed dependency set.

The dependency list also exceeds the minimum privileges and components required by the implementation:

• The generic bio package is redundant because the script imports Bio from Biopython.
• dataclasses is part of the standard library for the declared Python 3.8+ runtime.
• NumPy, pandas, and pysam are not imported by scripts/main.py.
• Biopython is optional in the code and its imported objects are not used by the implemented workflow.
• requests is imported optionally, but the current implementation makes no network request.

Installing unnecessary packages increases the number of package distributions and installation hooks that must be trusted. Lack of hashes also means package artifacts are not cryptographically constrained to versions reviewed during the audit.

Attack Path

1. A user follows the installation instruction in SKILL.md and runs pip install -r requirements.txt.
2. Pip resolves the latest dependency versions available from the configured package index.
3. A compromised package release, dependency-confusion package, malicious transitive dependency, or unsafe installation hook is selected.
4. Package installation code executes with the privileges of the user or service installing the Skill.
5. The malicious package may access files, credentials, environment variables, or network resources available to that installation process.

This is a supply-chain risk rather tha ...[truncated 544 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove dependencies not required by the implemented code, particularly bio, dataclasses, NumPy, pandas, and pysam.
2. Remove Biopython and requests unless their corresponding functionality is implemented and required.
3. Pin each retained direct and transitive dependency to a reviewed version.
4. Generate and enforce cryptographic hashes, for example with a lock-generation tool and:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

5. Install packages only from an explicitly trusted package index.
6. Run dependency vulnerability and provenance checks in CI.
7. Install dependencies in an isolated, non-privileged virtual environment or container.
8. Separate optional functionality into explicit dependency groups so users do not install capabilities they do not need.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/main.py:432

Finding

Unrestricted User-Controlled Output File Overwrite

Content

View full analysis

Vulnerability Details

File Location: scripts/main.py:432-434
Vulnerability Type: Arbitrary writable-file overwrite through an unrestricted output path
Risk Level: Medium

Complete Code Snippet:

python

if args.output:
    with open(args.output, 'w') as f:
        f.write(output)

Technical Analysis

The --output argument is passed directly to open() in write mode without path normalization, an approved-directory check, symlink protection, or exclusive file creation. Write mode truncates an existing file before writing the generated JSON.

A caller can therefore provide an absolute path or a relative path containing traversal components such as ../. Python will also follow a symbolic link at the destination. This behavior conflicts with the Skill's own security checklist, which states that output should be restricted to the workspace.

The script does not itself elevate privileges, so it can overwrite only files writable by the account running it. Nevertheless, Agent-hosted execution may give an untrusted requester indirect access to the Agent's broader filesystem permissions.

Attack Path

1. An attacker influences the command-line arguments used to invoke the Skill.
2. The attacker supplies an output path outside the intended workspace, such as an absolute writable path or a traversal path.
3. Alternatively, the attacker places a symbolic link at an expected output location that points to another writable file.
4. The script calls open(args.output, 'w').
5. The target file is followed if it is a symlink, truncated, and replaced with JSON output.
6. Depending on the selected target, this may corrupt application data or alter configuration consumed by another process.

Impact Assessment

Exploitation permits destruction or replacement of any file writable by the process account. It does not directly grant access to otherwise unreadable or unwritable files and does not inde ...[truncated 366 chars]

Remediation

View remediation

Remediation Suggestions

1. Define a dedicated output root controlled by the application.
2. Resolve the requested path and verify that it remains beneath that root:

   python

   from pathlib import Path
   
   output_root = Path("outputs").resolve()
   destination = (output_root / args.output).resolve()
   
   if output_root not in destination.parents:
       raise ValueError("Output path must remain inside the output directory")
   

3. Reject absolute paths and traversal components when callers only need to select a filename.
4. Prevent symlink-based redirection by checking path components and using platform-appropriate no-follow file-opening controls.
5. Use exclusive creation when overwriting is unnecessary, such as mode x, and require explicit authorization before replacing an existing file.
6. For permitted replacement, write to a securely created temporary file in the same approved directory and atomically rename it.
7. Run the Skill under a dedicated, non-privileged account with filesystem access limited to its workspace.
8. Add tests covering absolute paths, ../ traversal, existing files, and symbolic-link destinations.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill advertises executable behavior with network access and file-writing capability, but it does not declare an explicit tool permission boundary such as permissions or allowed-tools. That creates ambiguity for the runtime or reviewer about what the skill is authorized to do, increasing the chance of over-broad tool access, unintended network egress, or writes outside the expected workspace when the skill is invoked.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill claims exon-specific gRNA design and off-target prediction, but the implementation always falls back to mock sequence data and does not perform real Ensembl lookup or genome-validated targeting. In a biosecurity-relevant workflow, this can mislead users into acting on incorrect guides, creating unsafe or ineffective genome-editing recommendations while appearing authoritative.

Content

No source excerpt is available for this finding.

Context Window Stuffing

Medium

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · scripts/main.py (reported line 120)May include surrounding context.

python

'sequence': (
                        'ATGGAGGAGCCGCAGTCAGATCCTAGCGTCGAGCCCCCTCTGAGTCAGGAAACATTTTCAGACCTA'
                        'TGGCCTCCTGTGCTGCTGCTGTGCTGACAGCTGCTGCTGCTGCTGCTGCTGCTGCTGCTGCTGCTG'
                        'CTGCTGCTGCTGCTGCTGCTGCTGCTGCTGCTGCTGCTGCTGCTGCTGCTGCTGCTGCTGCTGCTG'
                    ),
                    'chromosome': '17',
                    'start': 7669600,

Context Window Stuffing

Medium

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · scripts/main.py (reported line 131)May include surrounding context.

python

'sequence': (
                        'ATGGAGGAGCCGCAGTCAGATCCTAGCGTCGAGCCCCCTCTGAGTCAGGAAACATTTTCAGACCTA'
                        'TGGCCTCCTGTGCTGCTGCTGTGCTGACAGCTGCTGCTGCTGCTGCTGCTGCTGCTGCTGCTGCTG'
                        'CTGCTGCTGCTGCTGCTGCTGCTGCTGCTGCTGCTGCTGCTGCTGCTGCTGCTGCTGCTGCTGCTG'
                    ),
                    'chromosome': '17',
                    'start': 7669600,

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The advertised off-target analysis is only a hardcoded simulation for one narrow sequence motif, not a genuine genome-wide search. This is dangerous because users may rely on falsely reassuring off-target counts when selecting guides for genome editing, where missed off-targets can have serious downstream consequences.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The method documentation says that omitting an exon targets all coding exons, but the code only fetches a single mock exon record. This mismatch can cause users to believe the search space is broader than it is, producing incomplete guide sets and invalid scientific conclusions.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency bio is unpinned, so installs may resolve to different versions over time, reducing reproducibility and potentially pulling in a newly vulnerable or incompatible release. In a bioinformatics skill that processes scientific data, dependency drift can also affect correctness and increase supply-chain exposure.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

bio
biopython
dataclasses
numpy

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

biopython is unpinned, which makes builds non-reproducible and prevents assurance that only a reviewed, non-vulnerable release will be installed. Given that Biopython has known advisories in some versions, leaving it unconstrained increases supply-chain and runtime risk.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

bio
biopython
dataclasses
numpy
pandas

Unverifiable Dependency: biopython has 2 known advisory(ies) (CVE-2025-68463 (Biopython is vulnerable to doctype XML external entity (XXE) injection through B); CVE-2025-68463 (Biopython is vulnerable to doctype XML external entity (XXE) injection through B)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The manifest does not pin biopython, and advisories exist for some versions, so there is no way to verify whether an affected release will be installed. In a genomics-focused skill, this matters because file parsing libraries may process complex biological data formats that could become attack vectors if vulnerable versions are present.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

dataclasses is unpinned, so the environment may install different releases depending on resolver behavior and platform, which weakens reproducibility. Although lower risk than a network-facing package, it still represents unnecessary supply-chain uncertainty.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

bio
biopython
dataclasses
numpy
pandas
pysam

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

numpy is unpinned, so future installs may silently pull in vulnerable or behavior-changing releases. For scientific code, this is especially problematic because it affects both security posture and computational reliability.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text

bio
biopython
dataclasses
numpy
pandas
pysam
requests

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

numpy has known advisories in some releases, and because the requirement is unpinned, the deployed version cannot be verified as safe. This is a supply-chain hygiene issue that can lead to accidental installation of an affected version in some environments.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

pandas is unpinned, allowing the resolver to choose arbitrary future versions, including releases with security issues or incompatible parsing behavior. This increases supply-chain risk and may affect data-handling logic in the skill.

Content

Scanner excerpt · requirements.txt (reported line 5)May include surrounding context.

text

biopython
dataclasses
numpy
pandas
pysam
requests

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

pandas is not version-pinned despite known advisories in some releases, making it impossible to confirm whether deployments are exposed. In data-processing workflows, vulnerable parsing or deserialization paths can become relevant depending on how the library is used.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

pysam is unpinned, which creates non-deterministic builds and potential exposure to vulnerable or unstable releases. Because it often interfaces with compiled/native code and genomic file parsing, version control is important for both security and stability.

Content

Scanner excerpt · requirements.txt (reported line 6)May include surrounding context.

text

dataclasses
numpy
pandas
pysam
requests

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

requests is unpinned, so installations may pick up vulnerable or semantically changed releases over time. Since this package is frequently used for outbound network access, leaving it unconstrained raises supply-chain and runtime security risk.

Content

Scanner excerpt · requirements.txt (reported line 7)May include surrounding context.

text

numpy
pandas
pysam
requests

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

requests has multiple historical advisories, and because no version is pinned, the skill cannot demonstrate that a safe release will be installed. This is more significant here because network-capable libraries can influence confidentiality and transport security if outdated versions are resolved.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.