Phylogenetic Tree Styler

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:05 AM UTC
• Version: 1.0.0

Overview

This skill is a local phylogenetic tree visualization tool with some documentation and dependency hygiene issues but no evidence of hidden, destructive, or exfiltrating behavior.

Install only in an isolated Python environment, review or pin dependency versions before use, and provide explicit input and output paths you are comfortable reading from and writing to. Treat the workspace/path restriction checklist as aspirational, because the current script does not enforce those restrictions itself.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1-4
Vulnerability Type: Unpinned dependencies and missing package integrity verification
Risk Level: Medium

Vulnerable Code

text

ete3
matplotlib
numpy
pandas

The installation instructions in SKILL.md:31-37 also install unconstrained versions:

text

Install dependencies:
```text
pip install ete3 matplotlib numpy pandas

text

### Technical Analysis

All third-party dependencies are declared without exact versions, hashes, or a lockfile. Consequently, each installation may resolve to different package releases from the configured package index. This makes builds non-reproducible and prevents verification that downloaded artifacts are the versions reviewed by the project maintainers.

No dependency confusion or typosquatting package was identified in the audited files; the documented package names are consistent with the imports. The security risk arises from unconstrained resolution and absent artifact-integrity controls. If an upstream package, package-index account, distribution artifact, or configured index is compromised, installation may retrieve attacker-controlled code. Python packages can execute code during installation, and package initialization code executes when imported by `scripts/main.py`.

### Attack Path

1. A threat actor compromises an upstream dependency release, maintainer account, distribution artifact, or package source used by pip.
2. A user follows the documented installation command or installs from `requirements.txt`.
3. Because no reviewed versions or hashes are enforced, pip resolves and downloads the compromised release.
4. Malicious code executes during package installation or when `scripts/main.py` imports the dependency.
5. The payload operates with the permissions of the user or agent running pip or the application.

### Impact Assessment

Successful exploitation could permit arbitrary code execution with the installer or application user
...[truncated 500 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to a reviewed, exact version rather than allowing unconstrained resolution.
2. Generate a fully resolved lock file that also pins transitive dependencies.
3. Record cryptographic hashes for all accepted distributions and enforce them during installation, for example:

bash

python -m pip install --require-hashes -r requirements.txt

4. Generate locked requirements through a controlled process, such as pip-compile --generate-hashes, and review dependency changes before merging them.
5. Use a trusted or internally mirrored package index and explicitly configure approved sources.
6. Add automated dependency vulnerability and provenance scanning to CI.
7. Keep the installation command in SKILL.md synchronized with the secured requirements file instead of instructing users to install unconstrained package names directly.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code’s primary function is to beautify and render phylogenetic trees, as indicated by its CLI options, ete3 styling logic, taxonomy color blocks, bootstrap annotation, timeline display, and image export. The declared description emphasizes data analysis, reproducible workflow, explicit validation, and structured outputs for interpretation, none of which are the main behavior here. While the code does some basic file existence and column checks, that does not amount to the described validation-oriented analytical workflow. Therefore the description materially misrepresents the actual behavior.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · scripts/main.py (reported line 32)May include surrounding context.

python

ff7f0e', '#2ca02c', '#d62728', '#9467bd', '#8c564b', '#e377c2', '#7f7f7f'],
    'phylum': ['#aec7e8', '#ffbb78', '#98df8a', '#ff9896', '#c5b0d5', '#c49c94', '#f7b6d3', '#c7c7c7'],
    'class': ['#9edae5', '#dbdb8d', '#bcbd22', '#17becf', '#e6550d', '#fd8d3c', '#31a354', '#74c476'],
}


def parse_args():
    """Parse command line parameters"""
    parser = argparse.ArgumentParser(
        description='Phylogenetic Tree Styler - Beautify evolutionary tree visualization',
        formatter_class=argparse.RawDescriptionHelpFormatter,
        epilog="""Example:
  %(prog)s -i tree.nwk -o output.png
  %(prog)s -i tree.nwk --show-bootstrap --taxonomy-file taxo.csv
  %(prog)s -i tree.nwk --show-timeline --root-age 500"""
    )
    
    parser.add_argument('-i', '--input', required=True, help='Input Newick format evolutionary tree file')
    parser.add_argument('-o', '--output', default='tree_styled.png', help='Output image file path')
    parser.add_argument('-f', '--format',

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The 'When to Use' section expands activation to general 'data analysis tasks' with qualities like bounded scope and reproducible output, which are common to many unrelated requests. This is ambiguous and could cause the skill to be selected for ordinary analysis work outside phylogenetic tree styling.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation claims protections against path traversal and unrestricted output locations, but no enforceable mechanism is shown in the skill file. Users may trust these statements and run the tool on attacker-influenced paths, enabling reads from unintended locations or writes outside the workspace if the script does not independently constrain them.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The dependencies section explicitly requires ete3, matplotlib, numpy, and pandas and provides a pip install command. Later, the prerequisites section says 'No additional Python packages required,' which directly conflicts with the earlier installation requirements.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

This markdown file contains operational guidance to modify configuration and execute a script that writes output artifacts. Although the later risk table notes file-system access, the usage steps themselves do not directly warn that running the workflow may create or overwrite files, which is the kind of user-facing disclosure expected for markdown descriptions.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency ete3 is unpinned, so installs are not reproducible and may pull in different upstream releases over time. This increases supply-chain risk because a future compromised or breaking version could be installed without review.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

ete3
matplotlib
numpy
pandas

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The matplotlib dependency is unpinned, which means builds are not deterministic and can silently consume newly published versions. That creates avoidable supply-chain exposure and can introduce vulnerable or incompatible releases into the environment.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

ete3
matplotlib
numpy
pandas

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 99% confidence

Finding

numpy is declared without a version constraint, so the actual installed package may vary by install time and environment. This prevents reliable verification against known advisories and increases the chance of pulling a vulnerable or malicious release.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

ete3
matplotlib
numpy
pandas

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

numpy has known historical advisories, but because no version is pinned, it is impossible to determine whether installations will use an affected release. In this skill context, that uncertainty is a real security weakness because scientific workflows often process external data and rely on native-code libraries where vulnerable versions can have memory-safety or file-handling issues.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 99% confidence

Finding

pandas is unpinned, making dependency resolution non-reproducible and weakening assurance that the deployed version has been reviewed. This is a supply-chain hygiene issue that can expose the skill to vulnerable or unexpected upstream changes.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text

ete3
matplotlib
numpy
pandas

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 87% confidence

Finding

pandas has at least one advisory affecting some historical versions, and the lack of a pinned version makes it impossible to verify whether the installed package is safe. In a data-analysis skill, pandas may ingest untrusted files, so ambiguity around deserialization-related issues increases risk even if exploitation depends on how the library is used.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.