Metagenomic Krona Chart

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:53 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its metagenomic charting purpose, but it needs review because the generated HTML loads external JavaScript despite offline/no-network claims and the Python dependencies are unpinned.

Install only in an isolated Python environment, prefer pinned reviewed versions of pandas and plotly, and treat generated charts as network-dependent unless the code is changed to embed Plotly locally. Use the skill only with intended metagenomic taxonomy report files and choose output paths carefully to avoid overwriting files.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned Third-Party Dependencies Create Supply-Chain Exposure

Content

View full analysis

Remediation

View remediation

plotly== ``` 2. Generate a lock file containing hashes for direct and transitive dependencies, and install with hash enforcement: ```bash python -m pip install --require-hashes -r requirements.lock ``` 3. Generate locked dependencies from a controlled package index and retain the lock file in source control. 4. Use an isolated virtual environment and avoid installing the project as a privileged or administrative user. 5. Add automated dependency vulnerability and integrity scanning to the release process. 6. Review and deliberately update dependency pins rather than allowing installations to resolve arbitrary future releases. ]]>

T03 · Remote Payload Retrieval and Execution

Warning

• Location: scripts/main.py:329

Finding

Generated HTML Executes Mutable JavaScript Retrieved from a CDN

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence

Finding

The code’s core purpose does relate to metagenomic Krona-style chart generation, so the domain is aligned. However, the description overstates several important behaviors that are not implemented. There is no workflow engine or reproducibility framework, no substantial validation layer beyond simple parsing/error checks, and no structured analytical output such as JSON/report objects for downstream review. The actual behavior is a visualization generator, not a broader analysis workflow with explicit validation and structured review outputs.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill documents executable behavior and file access patterns but does not declare any explicit tool scope such as allowed tools or permissions. This creates ambiguity for an agent runtime and can lead to broader-than-expected file access if the platform defaults are permissive, especially because the workflow encourages reading user-supplied files and writing outputs.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The activation guidance is broad enough to encourage use for generic data-analysis tasks beyond Krona chart generation. In an agent setting, overscoped routing can cause the wrong skill to be selected for tasks involving unrelated data handling, increasing the chance of unsafe file processing, misleading outputs, or use outside validated assumptions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The example invocation shows passing free-form clinical-style text via --input, while the skill documentation elsewhere says the tool generates Krona charts from TSV/classification report files for metagenomic data. This directly conflicts with the documented behavior and could mislead operators about acceptable inputs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The skill documentation shows output file generation via '-o krona_chart.html' and states that output is a standalone HTML file, but it does not clearly warn users that running the skill will create or potentially overwrite files at the specified path. For markdown-scoped warning checks, file-system effects that may affect user data should be disclosed plainly.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file states 'No additional Python packages required' at L188, but elsewhere explicitly declares pandas and plotly as dependencies and provides a pip install command at L140-L148. This is an active documentation contradiction about what is needed to run the skill.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency manifest specifies pandas without a version pin, which makes builds non-reproducible and allows unexpected upstream releases to be installed later. While not an immediate exploit by itself, this increases supply-chain risk and can expose the skill to breaking or vulnerable versions over time.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

pandas
plotly

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The manifest includes pandas without a pinned version, and the scanner notes a known disputed advisory affecting some pandas releases. Because the version is not fixed, it is impossible to verify from this file whether an affected release could be installed, creating uncertainty around exposure and compounding the supply-chain risk.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency manifest specifies plotly without a version pin, so future installations may resolve to different releases with different behavior or newly introduced vulnerabilities. This weakens reproducibility and increases software supply-chain exposure.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

pandas
plotly