T08 · Insecure Dependencies
Warning
- Location
requirements.txt:1- Finding
Unpinned Third-Party Dependencies Create Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
Security audit
In Silico Perturbation Oracle
Security checks for vulnerabilities and agentic risk
Overview
This skill should be reviewed carefully because it presents simulated gene-knockout outputs as production-ready scientific guidance, though I found no evidence of theft, destructive behavior, or persistence.
Install only in an isolated environment and treat all generated biological results as simulated/demo output unless the publisher replaces the placeholder logic with verified real model inference. Do not use the target rankings, p-values, pathway results, or wet-lab guide for research or clinical decisions without independent scientific validation. Pin dependencies before installation if you proceed.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
other
Error
- Location
scripts/main.py:143- Finding
Simulated Random Output Is Presented as Foundation-Model Analysis
- Content
View full analysis
np.ndarray: """Simulate Geneformer perturbation prediction""" logger.info(f"Predicting {perturbation_type} for genes {genes} in {cell_type}") # Get reference expression ref_expr = self.get_reference_expression(cell_type) # Simulate perturbation effect (in actual implementation, call Geneformer API) perturbed_expr = self._simulate_perturbation( ref_expr, genes, perturbation_type ) return perturbed_expr def _simulate_perturbation( self, expression: np.ndarray, genes: List[str], perturbation_type: str ) -> np.ndarray: """Simulate perturbation effect (placeholder implementation)""" # In actual implementation, this would call Geneformer's in silico perturbation feature # Currently using random perturbation for demonstration purposes np.random.seed(42) noise = n ...[truncated 4168 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (37)
Possible Typosquatting: 'scanpy' resembles popular package 'scrapy'
High
- Category
- Supply Chain
- Confidence
- 70% confidence
- Finding
Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill advertises foundation-model-based virtual gene knockout prediction, but the implementation returns simulated/randomized outputs instead of real model inference. In a bioinformatics decision-support context, this is dangerous because users may trust fabricated results for downstream target selection or experimental planning, leading to scientifically invalid and potentially harmful decisions.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The perturbation logic ignores the specific input genes and instead applies generic scaling plus random noise to the whole expression profile. That means the claimed gene-specific knockout modeling is not happening, so different targets can produce misleadingly similar outputs while appearing scientifically credible to users.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill describes capabilities involving file read/write and executable scripts, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates an authorization ambiguity where an agent/runtime may grant broader access than intended, increasing the chance of unintended filesystem interaction or misuse if the skill is invoked with sensitive workspace contents.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The markdown states that the skill involves Python script execution, external API/network access, and filesystem writes, but it does not present a prominent user-facing warning or consent flow explaining the operational and security impact. In practice, this can cause users or orchestrators to run a high-risk skill without understanding that it may transmit data externally or modify local files.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The comments and docstrings describe actual Geneformer-based in silico perturbation while the implementation explicitly uses placeholder random simulation. This mismatch is dangerous because it misrepresents capability and can mislead auditors or users into trusting results as model-derived when they are not.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The differential expression and p-value calculations are simulated placeholders rather than valid statistical analysis over biological replicates or model uncertainty estimates. This can create false confidence in significance claims, causing users to overinterpret arbitrary fold-change/noise artifacts as biologically meaningful findings.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill goes beyond prediction into target prioritization and recommendation generation, which amplifies the harm from the earlier synthetic/placeholder analyses. Even if the scoring logic is heuristic, presenting ranked targets and validation recommendations can cause users to act on unsupported conclusions in a biomedical setting.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Exporting a wet-lab validation guide turns synthetic in-silico outputs into actionable experimental instructions, increasing the likelihood that users operationalize unvalidated predictions. In a life-science context, this scope expansion materially raises risk because it bridges from speculative computation to real-world biological experimentation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This YAML file contains a Chinese comment alongside otherwise English content, which can create an implicit language/locale inconsistency without documenting intended audience or offering language choice. Under the policy rule, forcing or assuming a specific language without opt-in can be a natural-language policy concern, even in comments or config documentation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This YAML file contains natural-language comments in Chinese on L56-L57, which imposes a specific language in the file without any user opt-in or justification. Under the language/locale policy, natural-language content should not force a language unless the constraint is documented and intentional.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The dependency 'anndata' is unpinned, so builds may resolve to different versions over time. This weakens reproducibility and can unintentionally introduce vulnerable or incompatible releases through normal dependency updates or supply-chain compromise.
- Content
text anndata biopython dataclasses gseapy
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
The dependency 'biopython' is unpinned, which means the environment may install different versions at different times. In a scientific skill that may parse biological data formats, this increases exposure to supply-chain risk and makes it impossible to guarantee that a safe version is used.
- Content
text anndata biopython dataclasses gseapy h5py
Unverifiable Dependency: biopython has 2 known advisory(ies) (CVE-2025-68463 (Biopython is vulnerable to doctype XML external entity (XXE) injection through B); CVE-2025-68463 (Biopython is vulnerable to doctype XML external entity (XXE) injection through B)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
Because 'biopython' is not pinned, the manifest cannot prove whether a safe or vulnerable version will be installed despite known advisories. In a genomics-oriented skill that may parse biological file formats, this uncertainty increases the chance of exposure to version-specific parser flaws such as XXE-related issues.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The dependency 'dataclasses' is unpinned, allowing uncontrolled version selection where applicable. Even though impact is generally low, unpinned dependencies reduce determinism and can introduce unexpected behavior or vulnerable transitive packages.
- Content
text anndata biopython dataclasses gseapy h5py matplotlib
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The dependency 'gseapy' is unpinned, so future installs may pull different releases without review. That creates a supply-chain and reproducibility risk, especially in research workflows that may be rerun across environments.
- Content
text anndata biopython dataclasses gseapy h5py matplotlib mygene
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The dependency 'h5py' is unpinned, permitting silent upgrades or downgrades during installation. Because it handles structured data files, unpredictable versions can also affect parsing behavior and exposure to version-specific flaws.
- Content
text biopython dataclasses gseapy h5py matplotlib mygene numpy
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
The dependency 'matplotlib' is unpinned, so the package manager may resolve to changing versions over time. While not necessarily immediately exploitable on its own, this increases supply-chain uncertainty and operational instability.
- Content
text dataclasses gseapy h5py matplotlib mygene numpy pandas
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
The dependency 'mygene' is unpinned, allowing uncontrolled dependency resolution. In a bioinformatics skill that may query or process gene-related data, this reduces assurance about the code and transitive dependencies actually installed.
- Content
text gseapy h5py matplotlib mygene numpy pandas plotly
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
The dependency 'numpy' is unpinned, meaning installations may pull arbitrary newer or older versions depending on resolver state. Given its ubiquity and advisory history, lack of version control makes it difficult to ensure the environment is not using a vulnerable release.
- Content
text h5py matplotlib mygene numpy pandas plotly pyyaml
Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The unpinned 'numpy' entry prevents verification that the deployed version is free from known advisories. Although exploitation depends on usage patterns, the inability to tie the manifest to a known-safe release is a real supply-chain hygiene weakness.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
The dependency 'pandas' is unpinned, so the installed version is not predictable or auditable from the manifest alone. In data-heavy skills, this can expose the environment to vulnerable releases or parsing behavior changes without any code changes.
- Content
text matplotlib mygene numpy pandas plotly pyyaml scanpy
Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
The manifest leaves the installed 'pandas' version ambiguous despite known advisory history. In data-processing workflows, this uncertainty makes it harder to rule out unsafe deserialization or parser-related flaws in the environment.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
The dependency 'plotly' is unpinned, introducing normal supply-chain and reproducibility risk. Uncontrolled upgrades can also bring in new transitive dependencies or altered rendering behavior.
- Content
text mygene numpy pandas plotly pyyaml scanpy scipy
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
The dependency 'pyyaml' is unpinned, which is more concerning because YAML libraries have a long history of unsafe parsing issues. If the skill or its transitive dependencies ever parse untrusted YAML, an unreviewed vulnerable version could materially increase risk.
- Content
text numpy pandas plotly pyyaml scanpy scipy scvi-tools
Static analysis
No suspicious patterns detected.