NIH Biosketch Builder

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:56 AM UTC
• Version: 1.0.0

Overview

This NIH biosketch tool is mostly purpose-aligned, but it needs review because its dependencies and file path handling are under-controlled for an executable skill.

Review before installing. Use a sandboxed workspace, pin and verify dependencies, replace 'docx' with the intended 'python-docx' package, and only run it with explicit input/output paths you are comfortable reading from or overwriting. Avoid placing sensitive biosketch or grant data in shared or synced output folders, and treat PubMed import/search as sending publication identifiers or author queries to NCBI.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Incorrect and Unpinned Third-Party Dependencies

Content

View full analysis

Remediation

View remediation

requests== ``` 2. Select versions that have been reviewed for compatibility and known vulnerabilities. 3. Generate a lock file containing transitive dependencies. 4. Require package hashes during installation, for example through a hash-pinned requirements file and `pip install --require-hashes`. 5. Install only from explicitly approved HTTPS package indexes. 6. Run dependency vulnerability and license scans in CI. 7. Test installation in a clean environment to confirm that `from docx import Document` resolves to the `python-docx` distribution. 8. Keep `SKILL.md` and `requirements.txt` synchronized so they identify the same packages. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/main.py:257

Finding

Unrestricted Caller-Controlled Input and Output Paths

Content

View full analysis

Remediation

View remediation

Path: candidate = (WORKSPACE / value).resolve() if candidate != WORKSPACE and WORKSPACE not in candidate.parents: raise ValueError("Path must remain inside the workspace") return candidate ``` 2. Reject absolute paths unless explicitly required and separately authorized. 3. Validate input and output extensions by mode: - Input: `.json` - Template and PubMed output: `.json` - Biosketch output: `.docx` 4. Reject symbolic links for inputs and outputs, including links in parent path components where feasible. 5. Do not silently overwrite existing files. Use exclusive creation (`x` mode) or require an explicit `--overwrite` option. 6. Write outputs to a temporary file inside the approved destination directory and atomically rename them after successful generation. 7. Apply file-size and JSON-structure limits before processing input. 8. Run the Skill under a dedicated, least-privileged account with access limited to its workspace. 9. Avoid displaying unnecessary absolute paths in user-facing errors and logs. 10. Add automated tests covering absolute paths, `../` traversal, symlink targets, extension mismatches, and overwrite attempts. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill advertises executable code and network/file capabilities but does not declare an explicit tool scope such as allowed tools or permissions. This creates an authorization ambiguity: an agent may invoke file read/write or external network actions without a clearly bounded contract, increasing the risk of unintended data access, exfiltration, or writes beyond what the user expected.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The 'When to Use' section expands the skill from NIH biosketch generation into general academic writing, which can cause over-broad routing and execution outside the intended task. In an agent ecosystem, this increases the chance the skill is selected for unrelated writing jobs and then performs file or network actions in contexts where the user did not consent to those behaviors.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill mentions requests for the PubMed API but does not clearly warn users that publication identifiers and related query data may be transmitted to an external service. Even if PMIDs are not highly sensitive by themselves, associated bibliographic selections can reveal research focus, collaborators, or unpublished grant-preparation context.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

A biosketch builder can reasonably format provided data into NIH-compliant output, but this class adds external network retrieval and author-search functionality. Because the manifest does not mention external lookup or enrichment, these capabilities are contextually broader than the stated purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest says the skill generates NIH Biosketch documents, which matches the DOCX builder, but this file also exposes separate modes to query PubMed over the network and write standalone JSON outputs. Those data-retrieval/export capabilities go beyond document generation and are not described in the manifest.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The usage and output sections describe generating DOCX/JSON artifacts but do not clearly warn that running the tool writes files to disk. This can surprise users, cause unintentional persistence of sensitive CV/grant data, and create downstream exposure if outputs are written to shared or synced locations.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency docx is unpinned, which makes builds non-reproducible and allows future installations to silently pull in a different release than the one originally tested. This increases supply-chain risk because a vulnerable or malicious upstream version could be introduced without any change to this repository.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

docx
requests

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The dependency requests is unpinned, so installations may resolve to different versions over time, including versions with known security issues. Because requests handles outbound HTTP and may process credentials, redirects, proxies, or .netrc behavior, version drift can expose the skill to known client-side security flaws.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

docx
requests

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

requests has multiple known advisories, and because no version is pinned, it is impossible to verify whether deployment will use a patched or vulnerable release. In a skill that likely fetches or submits remote data while generating biosketch content, this uncertainty is more concerning because network-handling flaws could expose tokens, credentials, or sensitive document-related data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.