Pseudotime Trajectory Viz

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:25 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches its stated single-cell analysis purpose, but a crafted gene name can cause plot files to be written outside the chosen output folder.

Review before installing. Use this skill only in an isolated workspace or container, prefer trusted .h5ad files, choose a dedicated output directory, and pin or lock dependencies before production or shared-environment use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/main.py:405

Finding

Path Traversal Through Gene-Derived Output Filenames

Content

View full analysis

10: from scipy.interpolate import UnivariateSpline idx = np.argsort(pseudotime[mask]) x = pseudotime[mask][idx] y = expression[mask][idx] try: spline = UnivariateSpline(x, y, s=len(x)) x_smooth = np.linspace(x.min(), x.max(), 100) ax.plot(x_smooth, spline(x_smooth), linewidth=2, label=f'{lineage} trend') except: pass ax.set_xlabel('Pseudotime') ax.set_ylabel(f'{gene} Expression') ax.set_title(f'{gene} Expression along Trajectory') ax.legend(loc='best') output_path = os.path.join(gene_trends_dir, f'{gene}_trend.{args.format}') plt.tight_layout() plt.savefig(output_path, dpi=args.dpi, bbox_inches='tight') ``` ### Technical Anal ...[truncated 2217 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Unpinned and Integrity-Unverified Third-Party Dependencies

Content

View full analysis

=1.9.0 anndata>=0.8.0 matplotlib>=3.5.0 seaborn>=0.12.0 numpy>=1.21.0 pandas>=1.3.0 scipy>=1.7.0 scikit-learn>=1.0.0 ``` The documented installation command in `README.md:9` and `SKILL.md:322` is: ```bash pip install -r requirements.txt ``` ### Technical Analysis Every dependency uses an open-ended minimum-version constraint. Consequently, two installations performed at different times can resolve to materially different package versions. The requirements file also provides no cryptographic hashes to verify the integrity of downloaded distributions. The listed package names are consistent with the scientific-analysis functionality, and the audit found no evidence of typosquatting, dependency confusion, or an intentionally malicious package. The risk arises from mutable dependency resolution: a future compromised, vulnerable, or incompatible release could be selected automatically without a corresponding change to the audited project. Python packages may execute code during installation and are imported with the privileges of the user running the application. Dependency integrity is therefore part of the effective trust boundary. ### Attack Path 1. An operator follows the documented `pip install -r requirements.txt` command. 2. The package resolver queries the configured Python package indexes. 3. Because only minimum versions are specified, the resolver selects any compatible current or future versions. 4. The downloaded artifacts are accepted without project-supplied hash verification. 5. If a selected release or configured package index has been compromised, malicious installation or import-time code executes with the operator's privileges. This is a supply-chain hardening weakness rather than evidence that the currently nam ...[truncated 558 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (32)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md

- Packaged executable path(s): `scripts/main.py`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md

- Packaged executable path(s): `scripts/main.py`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md

- Packaged executable path(s): `scripts/main.py`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md

- Packaged executable path(s): `scripts/main.py`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md

- Packaged executable path(s): `scripts/main.py`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

md

- Packaged executable path(s): `scripts/main.py`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

md

- Packaged executable path(s): `scripts/main.py`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

md

- Packaged executable path(s): `scripts/main.py`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

md

- Packaged executable path(s): `scripts/main.py`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

md

- Packaged executable path(s): `scripts/main.py`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

md

- Packaged executable path(s): `scripts/main.py`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.

md

- Packaged executable path(s): `scripts/main.py`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

md

- Packaged executable path(s): `scripts/main.py`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 278)May include surrounding context.

md

- Packaged executable path(s): `scripts/main.py`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 362)May include surrounding context.

md

- Packaged executable path(s): `scripts/main.py`.

Possible Typosquatting: 'scanpy' resembles popular package 'scrapy'

High

• Category: Supply Chain
• Confidence: 70% confidence

Finding

Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill advertises executable workflows that read inputs and write result files, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates ambiguity for the agent runtime and reviewers about what filesystem actions are authorized, increasing the risk of over-broad file writes or unsafe execution behavior if the skill is invoked in a permissive environment.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The audit-ready example uses a free-text string as the --input value even though the skill later documents --input as a required AnnData .h5ad file path. This inconsistency can cause operators or automated systems to run the script with invalid input, leading to failure modes, misleading validation outcomes, or accidental processing of unintended data if the implementation tries to interpret arbitrary strings as paths or content.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The PAGA branch claims to estimate pseudotime from PAGA distances, but it actually derives values from arbitrary cluster ordering and then injects random noise. In a scientific-analysis skill, this is dangerous because it can silently produce misleading, non-reproducible results that users may trust for downstream interpretation or reporting.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest describes a reproducible analysis and visualization workflow with structured outputs, but the implementation also persists a modified AnnData object and multiple result files to disk. While producing plots is expected for visualization, rewriting the dataset with newly computed annotations is a broader state-changing behavior than a pure visualization/interpretation tool implies.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The dependency is specified with only a lower bound, so builds may resolve to different versions over time. This weakens reproducibility and can allow introduction of vulnerable or breaking upstream releases through the supply chain, even if no specific exploit is present in this file.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

scanpy>=1.9.0
anndata>=0.8.0
matplotlib>=3.5.0
seaborn>=0.12.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The dependency is not pinned to an exact release, which means installations are not deterministic and may silently pick up unsafe or incompatible versions. In a workflow skill intended to be reproducible, this particularly undermines both security review and result consistency.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

scanpy>=1.9.0
anndata>=0.8.0
matplotlib>=3.5.0
seaborn>=0.12.0
numpy>=1.21.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

Using a minimum-version specifier allows future unreviewed matplotlib releases to be installed. That creates supply-chain and stability risk because behavior and security posture can change without any modification to the skill itself.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

scanpy>=1.9.0
anndata>=0.8.0
matplotlib>=3.5.0
seaborn>=0.12.0
numpy>=1.21.0
pandas>=1.3.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

An unpinned seaborn dependency makes the environment non-reproducible and leaves consumers exposed to unreviewed upstream changes. While not directly exploitable on its own, it increases attack surface in the package supply chain.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text

scanpy>=1.9.0
anndata>=0.8.0
matplotlib>=3.5.0
seaborn>=0.12.0
numpy>=1.21.0
pandas>=1.3.0
scipy>=1.7.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

numpy is unpinned despite having multiple historical advisories, so the actual installed version cannot be verified as safe. This increases supply-chain uncertainty and may expose consumers to vulnerable releases depending on resolver behavior and install time.

Content

Scanner excerpt · requirements.txt (reported line 5)May include surrounding context.

text

anndata>=0.8.0
matplotlib>=3.5.0
seaborn>=0.12.0
numpy>=1.21.0
pandas>=1.3.0
scipy>=1.7.0
scikit-learn>=1.0.0

Static analysis

No suspicious patterns detected.