Pathology ROI Selector

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:14 AM UTC
• Version: 1.0.0

Overview

This skill claims to detect pathology image regions, but its script returns fixed mock results as detections and can write to any caller-supplied output path.

Treat this as a draft or demo only. Do not use it for real medical, research, training-data, or educational pathology ROI decisions until it performs genuine validated image analysis, rejects invalid inputs, clearly labels any synthetic output, and restricts output writes to a dedicated safe directory.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

other

Error

• Location: scripts/main.py:20

Finding

Fabricated ROI Results Presented as Genuine Image Analysis

Content

View full analysis

Vulnerability Details

File Location: scripts/main.py, lines 20-31
Vulnerability Type: Fabricated analysis output
Risk Level: High

Vulnerable Code:

python

def detect_rois(self, image_path, roi_type="tumor", min_size=1000):
    """Detect regions of interest in WSI."""
    # Placeholder for actual image analysis
    print(f"Analyzing {image_path} for {self.roi_types.get(roi_type, roi_type)}...")
    
    # Mock results
    rois = [
        {"x": 1000, "y": 2000, "width": 500, "height": 500, "confidence": 0.95},
        {"x": 3000, "y": 1500, "width": 800, "height": 600, "confidence": 0.87}
    ]
    
    return rois

Technical Analysis

The detect_rois method does not open, validate, decode, or analyze the file supplied through image_path. Instead, it returns two fixed ROI records with apparently authoritative confidence scores. The unused min_size parameter further demonstrates that the documented selection criteria are not applied.

The implementation nevertheless prints an analysis message and later describes the hard-coded records as detected regions. This creates a dangerous trust-boundary failure: callers cannot distinguish mock output from results derived from the supplied whole-slide image. It also contradicts the documented claim that the skill performs WSI region detection and the instruction in SKILL.md not to fabricate execution outcomes.

Attack Path

1. A user or automated workflow invokes the script with any path, including a nonexistent file:

   bash

   python scripts/main.py --image nonexistent.svs --output results.json
   

2. The script does not verify that nonexistent.svs exists or contains a valid pathology image.
3. It returns the same two hard-coded ROI coordinates and confidence scores for every input.
4. The results are printed as detected regions and optionally exported as JSON.
5. A downstream training, research, sampling, or e ...[truncated 922 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the placeholder implementation with genuine, tested image-processing logic before presenting any output as detected ROIs.
• Until that implementation exists, terminate with a clear nonzero-status error such as NotImplementedError; do not return mock records.
• Validate that the input exists, is a regular file, is readable, and uses a supported WSI format.
• Decode and inspect the image before reporting successful analysis.
• Validate roi_type against an explicit allowlist and enforce min_size.
• Mark synthetic results explicitly as test fixtures and restrict them to test code rather than the production entry point.
• Include provenance in exported results, such as the canonical input path, processing algorithm and version, parameters, and whether the output is synthetic.
• Add tests proving that different fixture images produce image-dependent results and that missing, invalid, or unsupported files fail safely.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/main.py:38

Finding

Caller-Controlled Output Path Allows Arbitrary Writable-File Overwrite

Content

View full analysis

Vulnerability Details

File Location: scripts/main.py, lines 38-42
Vulnerability Type: Unrestricted file write and overwrite
Risk Level: Medium

Vulnerable Code:

python

def export_rois(self, rois, output_file):
    """Export ROI coordinates."""
    import json
    with open(output_file, 'w') as f:
        json.dump(rois, f, indent=2)

The caller-controlled value reaches this method through the following code at lines 49-50 and 64-65:

python

parser.add_argument("--output", "-o", help="Output JSON file")

python

if args.output:
    selector.export_rois(filtered, args.output)
    print(f"\nExported to: {args.output}")

Technical Analysis

The --output argument is passed directly to open(output_file, 'w') without canonicalization, directory restriction, traversal prevention, symlink checks, or overwrite confirmation. Python's w mode creates a missing file or immediately truncates an existing file.

Consequently, the process can overwrite any file writable by the account running the skill. Relative traversal paths, absolute paths, and symlinks are all accepted. This violates the documented security requirement that output be restricted to the workspace.

Attack Path

1. An attacker influences the arguments supplied to the skill, such as through an untrusted workflow request.
2. The attacker supplies an absolute path or traversal path through --output, for example:

   bash

   python scripts/main.py --image sample.svs --output ../../target.json
   

3. The application passes the path directly to open() in write mode.
4. If the target is writable, it is created or truncated and replaced with ROI JSON.
5. If the target is a symlink, the write follows the link and modifies its writable destination.

Exploitation is limited by the operating-system permissions of the process. The flaw does not independently elevate privileges, but an agent or s ...[truncated 750 chars]

Remediation

View remediation

Remediation Suggestions

• Define a dedicated, trusted output directory and resolve it to a canonical path before processing user input.
• Treat the argument as a filename rather than an unrestricted path where possible.
• Resolve the candidate path and verify with Path.is_relative_to() that it remains beneath the approved output directory.
• Reject absolute paths, parent-directory traversal, existing symlinks, and non-regular-file destinations.
• Use exclusive creation mode (x) by default to prevent silent overwrites. Require explicit, separately authorized consent for replacement.
• Write to a securely created temporary file inside the approved directory and atomically rename it after serialization succeeds.
• Apply restrictive file permissions appropriate to the sensitivity of generated artifacts.
• Run the skill under a least-privileged account with write access limited to its designated workspace.
• Add tests covering absolute paths, ../ traversal, symlink destinations, existing files, and paths outside the workspace.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill description frames the tool as a generic structured data-analysis workflow, while the body reveals a specialized pathology ROI processor that handles image files and exports artifacts. This mismatch can cause inappropriate invocation on sensitive medical data or in contexts where users and orchestrators do not expect domain-specific file processing and output generation, raising the chance of misuse, privacy issues, and unsafe automation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill advertises executable behavior that can write outputs to the filesystem, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization ambiguity where an agent may invoke file-writing behavior without a narrowly defined boundary, increasing the risk of unintended file modification or broader workspace impact.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The 'When to Use' guidance is overly broad for a specialized pathology tool, encouraging selection for generic data-analysis tasks rather than tightly scoped pathology image workflows. Overbroad routing guidance can cause the skill to be applied outside its safe operating context, leading to incorrect processing, unnecessary file access, or accidental handling of sensitive biomedical data.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The module claims to automatically identify pathology ROIs in whole-slide images, but the implementation returns hard-coded mock coordinates and never analyzes the provided image. In a medical or research workflow, this can silently produce fabricated results that users may trust, leading to incorrect downstream decisions, invalid analyses, or unsafe clinical interpretation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The class documentation says it selects ROIs in pathology images, but the code does not inspect image content and emits canned results regardless of input. Because this skill is positioned as a pathology analysis helper, the mismatch is more dangerous: it can create false confidence in fabricated findings within sensitive biomedical workflows.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The manifest description frames the skill as a pathology ROI selector for analysis workflows, which suggests ROI detection/selection behavior. The implementation also includes writing arbitrary JSON output files, which is additional operational behavior not reflected in the manifest description's stated boundaries.

Content

No source excerpt is available for this finding.