Multi-Omics Integration Strategist

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:58 AM UTC
• Version: 1.0.0

Overview

This is a coherent local bioinformatics analysis skill, with manageable risks around dependency hygiene and handling sensitive omics outputs.

Install this in a virtual environment or container, pin and review dependencies before production use, and treat input and output files as potentially sensitive human-subject or proprietary research data. Review the generated reports and CSV/JSON outputs before sharing them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned and Ambiguous Python Dependencies

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1-6
Vulnerability Type: Insecure dependency specification and supply-chain exposure
Risk Level: Medium

Vulnerable Code

text

dataclasses
networkx
numpy
pandas
scipy
sklearn

The documented installation command in SKILL.md:247-252 causes these unconstrained dependencies to be installed:

bash

# Python dependencies
pip install -r requirements.txt

Technical Analysis

Every dependency is specified without an exact version or an integrity hash. Consequently, the versions installed depend on the state of the configured package index at installation time. This prevents reproducible installation and increases exposure to compromised releases, unexpected breaking changes, and package-index substitution.

The dependency list also uses sklearn, while the canonical distribution imported by the application is scikit-learn. This ambiguous and deprecated package name introduces avoidable supply-chain risk. The dataclasses backport is unnecessary for the project's documented Python 3.8-or-later runtime because dataclasses is part of the Python standard library in those versions.

This finding does not establish that any dependency currently contains malicious code. The risk arises from unconstrained resolution and ambiguous package naming during future installations.

Attack Path

1. A user follows the documented prerequisite and runs pip install -r requirements.txt.
2. pip resolves mutable, unconstrained package names using the user's configured package index or mirror.
3. An attacker compromises a permitted package release or package index, or influences resolution through an untrusted mirror.
4. The malicious package artifact is selected because no reviewed version or cryptographic hash is enforced.
5. Package installation logic or malicious imported code executes under the account running pip or the application.

Impact Assessment

Successful exploitation ...[truncated 552 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the deprecated sklearn requirement with the canonical scikit-learn distribution.
2. Remove dataclasses when Python 3.8 or later is enforced.
3. Pin every direct and transitive dependency to reviewed versions using a lock file or a generated constraints file.
4. Require cryptographic hashes, for example by generating a fully resolved requirements file and installing it with pip install --require-hashes.
5. Configure installation to use an approved HTTPS package index and prevent fallback to untrusted mirrors.
6. Scan dependencies continuously with tools such as pip-audit, Dependabot, or an equivalent software-composition-analysis service.
7. Perform installation inside a least-privileged virtual environment or isolated container rather than using an administrative account.
8. Test and review dependency upgrades before updating the lock file.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (14)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 165)May include surrounding context.

md

python scripts/main.py \

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.

md

python scripts/main.py \

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill documents local script execution and output file generation but does not declare any explicit tool scope or allowed-tools/permissions boundaries. That omission weakens enforceable least-privilege controls and can allow broader-than-expected file write behavior if the skill is executed by an agent framework that relies on manifest-declared permissions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Multi-omics datasets often contain sensitive research or patient-linked biological information, and the skill describes saving multiple derived outputs without any privacy warning, minimization guidance, or handling constraints. This increases the risk of accidental exposure of regulated or confidential data through reports, HTML exports, intermediate mappings, and shared workspace artifacts.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The Parameters table documents a --create-sample option and an apparently malformed --format entry, while omitting the clearly used --pathway-db, --id-mapping, and --method options shown earlier in the usage examples. This is not just incomplete prose; the interface documentation actively presents a conflicting command-line contract for the skill.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The dependency list is unpinned, so installations may resolve to different package versions over time. That creates supply-chain and reproducibility risk because a future vulnerable or malicious release could be pulled without review.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

dataclasses
networkx
numpy
pandas

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The networkx dependency is not version-pinned, which means builds are not reproducible and may silently consume newer releases. This increases exposure to accidental breakage, newly introduced vulnerabilities, or dependency hijacking scenarios.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

dataclasses
networkx
numpy
pandas
scipy

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

NumPy is unpinned and also has known historical advisories, so the actual installed version could be vulnerable without the manifest revealing that fact. In scientific Python stacks, this is a meaningful supply-chain weakness because transitive resolution and environment drift are common.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

dataclasses
networkx
numpy
pandas
scipy
sklearn

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

NumPy has known advisories, and because no version is pinned there is no way to verify whether the environment will install a patched or affected release. This makes the manifest insufficient for security assurance and increases the chance of deploying a vulnerable scientific computing component.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

Pandas is listed without a version constraint, so deployments may receive different releases with different security and runtime characteristics. This weakens reproducibility and makes it harder to prove that known-vulnerable versions are excluded.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text

dataclasses
networkx
numpy
pandas
scipy
sklearn

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 89% confidence

Finding

Pandas has at least one advisory history, and the unpinned requirement prevents determining whether installed versions are affected. Even if exploitability depends on application behavior, the manifest does not enforce safe versions and therefore represents a real hygiene gap.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

SciPy is unpinned, so installs may resolve to versions with known defects or advisories depending on environment and timing. For data-analysis skills this is usually not immediately exploitable on its own, but it is still a real dependency hygiene issue.

Content

Scanner excerpt · requirements.txt (reported line 5)May include surrounding context.

text

networkx
numpy
pandas
scipy
sklearn

Unverifiable Dependency: scipy has 4 known advisory(ies) (CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

SciPy has known advisory history, but this manifest leaves the installed version unconstrained, so affected releases cannot be ruled out. In the context of a multi-omics analysis skill, this is more of a supply-chain and environment integrity concern than an immediately dangerous capability escalation.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 92% confidence

Finding

The sklearn requirement is unpinned, which permits uncontrolled version drift during installation. While this file alone does not show active exploitation, the lack of pinning increases supply-chain uncertainty and operational risk.

Content

Scanner excerpt · requirements.txt (reported line 6)May include surrounding context.

text

numpy
pandas
scipy
sklearn

Static analysis

No suspicious patterns detected.