Lipinski Rule Filter

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:38 AM UTC
• Version: 1.0.0

Overview

This is a disclosed local chemistry filtering skill with ordinary dependency and CSV-output risks, but no hidden access, persistence, or deceptive behavior was found.

Install and run this only in a normal least-privileged project environment, pin or review the RDKit dependency before automated installs, provide explicit input and output paths, and treat generated CSV files as untrusted if compound names came from outside sources.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned Third-Party Dependency Creates Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code:

text

rdkit-pypi

Technical Analysis

The project declares rdkit-pypi without an exact version or integrity hash. Consequently, separate installations can resolve to different package releases and execute package code that was not covered by this audit.

Python packages may execute code during installation or when imported. If the selected release is compromised, removed and replaced, or otherwise changes incompatibly, installing the project dependencies could introduce attacker-controlled code. The lack of a lock file or hash verification also prevents installers from confirming that the downloaded artifact is the one reviewed and approved by the project.

The documentation is inconsistent with this requirement: SKILL.md lists rdkit-pypi as a dependency but later states that no additional Python packages are required. This inconsistency may cause users or automation to install the dependency without applying an established dependency-management process.

Attack Path

1. An attacker compromises a future release, distribution account, or artifact in the dependency supply chain.
2. A user or deployment pipeline runs a package installation command against requirements.txt.
3. Because no version or hash is specified, the installer resolves the currently available matching release.
4. Malicious package installation or import-time code executes under the privileges of the user or service performing the installation.
5. The malicious code can access resources available to that installation environment.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the developer, CI worker, container, or service account installing or importing the dependency. The accessible scope may include project files, buil ...[truncated 263 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a reviewed, exact version, for example rdkit-pypi==X.Y.Z.
2. Generate a locked dependency file containing cryptographic hashes and install it with hash enforcement, such as pip install --require-hashes -r requirements.lock.
3. Obtain packages only from an approved registry and disable untrusted extra indexes in deployment environments.
4. Run automated vulnerability and provenance checks against the resolved dependency and its transitive dependencies.
5. Perform dependency installation in an isolated, least-privileged build environment without unnecessary credentials.
6. Update SKILL.md so its prerequisites consistently document the required RDKit package and the approved installation procedure.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/main.py:258

Finding

Spreadsheet Formula Injection Through Untrusted Compound Names

Content

View full analysis

Vulnerability Details

File Location: scripts/main.py:258-267
Vulnerability Type: CSV spreadsheet formula injection
Risk Level: Medium

Vulnerable Code:

python

if suffix == '.csv':
    writer = csv.writer(f)
    writer.writerow(["SMILES", "Name", "MW", "LogP", "HBD", "HBA", "Violations"])
    for p in passed:
        props = p["properties"]
        writer.writerow([
            p["smiles"], p["name"],
            f"{props.get('mw', 0):.2f}",
            f"{props.get('logp', 0):.2f}",
            props.get('hbd', 0),

The affected call continues by writing the remaining property fields and the violation count. The security-relevant values are p["smiles"] and especially p["name"], which originate from input records and are written without spreadsheet-specific neutralization.

Technical Analysis

Compound names are read from user-controlled CSV, TSV, or SMILES input and copied into generated CSV output. The csv.writer class correctly handles CSV quoting and delimiters, but CSV quoting does not neutralize spreadsheet formulas.

Spreadsheet applications may interpret cells beginning with characters such as =, +, -, or @ as formulas. An attacker can therefore use a valid compound record whose name contains a formula-prefixed payload. If that compound passes the filter, the payload is written to the generated _passed.csv file.

This issue is distinct from Python code injection: the script itself does not evaluate the formula. Execution occurs later when a user opens or imports the generated file into spreadsheet software, and the exact behavior depends on the spreadsheet application and its security settings.

Attack Path

1. An attacker supplies a compound library containing a valid, passing SMILES value.
2. The associated compound name begins with a spreadsheet formula marker, for example a value beginning with =.
3. The skill parses the record and retains the atta ...[truncated 910 chars]

Remediation

View remediation

Remediation Suggestions

1. Apply a dedicated CSV-cell sanitizer to every attacker-controlled textual field before serialization.
2. Treat values beginning with =, +, -, or @ as unsafe. Also account for leading tabs, carriage returns, line feeds, and whitespace that spreadsheet software may ignore before formula detection.
3. Neutralize unsafe cells according to the output contract, such as by prefixing an apostrophe, while documenting that the exported display value may differ from the raw value.
4. Preserve raw data in a non-executable structured format such as JSON when exact round-trip fidelity is required.
5. Add tests using formula-prefixed compound names from every supported input format and verify that generated CSV cells are treated as text.
6. Warn users that compound names are untrusted data and that generated CSV files should be opened with formula execution disabled.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill advertises local file read/write behavior through its documented workflow and risk table, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates an authorization ambiguity where an agent may grant broader filesystem access than intended, increasing the risk of reading or writing unintended workspace files if the skill is invoked loosely.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The activation guidance is overly broad for a chemistry-specific skill, including generic language about 'data analysis tasks' that could cause an orchestrating agent to select this skill for unrelated requests. Overbroad routing increases the chance that file-processing code is invoked on unintended inputs, which is more dangerous here because the skill also supports local file reads and writes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The variant label broadens the apparent activation scope to generic 'data analysis tasks' rather than tightly constraining use to Lipinski-rule compound filtering. In agent settings, ambiguous or overly broad triggers can cause the skill to be invoked outside its intended domain, increasing the chance of scope drift, incorrect analysis, or unsafe reliance on domain-mismatched outputs.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The Parameters section defines --input as an input SMILES/SDF file path, and the Usage section shows file-based invocation. However, the audit-ready command uses --input with a prose sentence, which contradicts the documented behavior of the skill and could mislead operators about what the script actually accepts.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill documentation explicitly lists rdkit-pypi as a dependency, which means additional Python packages are required beyond the standard library. Saying no additional Python packages are required directly contradicts the earlier dependency declaration.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

L13-L17 state the classic Rule of Five thresholds as violations when values are greater than the limits, but L22 says violations use 'exact thresholds' and specifically claims '≥ 500, not > 500'. That directly contradicts the threshold description in the same document and would change which compounds are considered violations.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The dependency is specified without a version pin, so installs may pull different releases over time. That creates supply-chain risk and can introduce breaking changes or newly published malicious/compromised versions into the environment without any code change in the skill itself.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

rdkit-pypi

Static analysis

No suspicious patterns detected.