Rare Disease HPO Mapper

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:13 AM UTC
• Version: 1.0.0

Overview

The skill’s HPO-mapping behavior is simple and purpose-aligned, but its install instructions ask users to install an unnecessary unpinned package that could create avoidable supply-chain risk.

Review before installing. The mapper itself appears local and limited, but users should remove `difflib` from requirements.txt or skip `pip install -r requirements.txt` unless a reviewed dependency file is provided. Treat patient symptoms as sensitive health information and verify any HPO results clinically.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unnecessary Unpinned Third-Party Dependency Creates Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1 and SKILL.md:126-134
Vulnerability Type: Unnecessary and unpinned external package installation
Risk Level: Medium

Vulnerable Code

requirements.txt:1:

text

difflib

SKILL.md:126-134:

markdown

## Prerequisites

```text

# Python dependencies
pip install -r requirements.txt

text

### Technical Analysis

The implementation imports `get_close_matches` from Python's standard-library `difflib` module:

```python
from difflib import get_close_matches

Python 3.10+, which the project declares as its baseline, already includes this module. The separately declared difflib dependency is therefore unnecessary. Following the documented prerequisite causes pip to resolve an external distribution with that name from the configured package index.

The dependency has neither a pinned version nor an integrity hash. Consequently, its contents are not constrained to a reviewed artifact. A malicious, compromised, or unexpectedly resolved distribution could run package installation or build code with the privileges of the user performing the installation.

Attack Path

1. An attacker publishes or compromises a distribution resolvable under the declared difflib package name on the user's configured package index.
2. A user follows the prerequisite instructions in SKILL.md.
3. The user runs pip install -r requirements.txt.
4. pip retrieves the externally hosted, unpinned distribution.
5. Malicious installation or build logic executes locally under the installing user's account.
6. The package can access resources available to that account, independently of the legitimate HPO-mapping behavior.

Impact Assessment

Successful exploitation may provide arbitrary code execution with the privileges of the user or automation account running pip. The accessible scope can include that account's project files, ...[truncated 443 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove difflib from requirements.txt; the implementation should continue using Python's standard-library module.
2. Remove or revise the pip install -r requirements.txt prerequisite if the project has no external dependencies.
3. Add an automated check that rejects standard-library modules mistakenly declared as third-party requirements.
4. For any future external dependencies, pin reviewed versions and cryptographic hashes, for example by using pip install --require-hashes.
5. Resolve packages only through an approved package index or internal mirror.
6. Install dependencies in an isolated, least-privileged virtual environment and audit dependency artifacts before release.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 60% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

difflib