Sanger Chromatogram QA

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:23 AM UTC
• Version: 1.0.0

Overview

This skill looks like a prototype that claims Sanger chromatogram QA capabilities the packaged code does not actually implement, so it needs review before users rely on its scientific output.

Treat this as a draft or prototype, not a validated chromatogram QA tool. Before installing or using it for mutation confirmation, require real AB1 parsing, mixed-peak detection, input validation, tests with known chromatograms, and a pinned or locked NumPy dependency installed in an isolated environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned Third-Party Dependency Creates Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

text

numpy

The documented installation workflow in SKILL.md:116 invokes this dependency specification:

bash

pip install -r requirements.txt

Technical Analysis

The project declares NumPy without an exact version or integrity hash. Consequently, installation may resolve different package artifacts over time according to the package index and resolver configuration active on the user's system.

This prevents reproducible dependency resolution and leaves the installation process dependent on the continuing integrity of the configured package source and whichever NumPy release it selects. If that source, account, package release, or local package-index configuration is compromised, an attacker-controlled artifact could be installed. Neither a lock file nor hash verification is provided to bind installation to a reviewed artifact.

The finding does not establish that the legitimate NumPy package is malicious. It identifies the absence of dependency pinning and artifact verification as the supply-chain weakness.

Attack Path

1. An attacker compromises a configured Python package source, a relevant package release, or the victim's package-index configuration.
2. The user follows the documented command pip install -r requirements.txt.
3. Because numpy has no exact version or required hash, pip resolves an artifact controlled or substituted by the attacker.
4. The malicious artifact executes package-controlled code during installation or later when numpy is imported by scripts/main.py.
5. That code runs with the permissions of the user or service performing the installation or execution.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the process installing or importing the dependency. The resulting scope may in ...[truncated 327 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin NumPy to a security-reviewed exact version:

   text

   numpy==<reviewed-version>
   

2. Generate and retain hashes for all approved distribution artifacts, then require verification during installation:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

3. Use a lock-file workflow that records all transitive dependencies, exact versions, and hashes.

4. Configure an explicitly trusted package index rather than inheriting uncontrolled global or environment-specific index settings.

5. Review and update pinned dependencies through a controlled process that includes vulnerability scanning, compatibility tests, and artifact provenance checks.

6. Install dependencies in an isolated, least-privileged virtual environment or container rather than under an administrative account.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The skill claims a specific bioinformatics QA capability and structured safety boundaries, but the described implementation appears to be a placeholder that may not actually parse AB1 chromatogram data or enforce the stated workflow controls. In a scientific workflow, this can cause users or downstream agents to trust incorrect variant/QC conclusions, creating integrity and decision-making risk even without classic exploit code execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation guidance is broad enough to match generic data-analysis requests, which can cause the wrong skill to be selected for tasks outside its actual competence. That increases the chance of misapplication, unsupported assumptions, and misleading outputs, especially because the skill already presents itself as more capable and bounded than the evidence suggests.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency manifest specifies numpy without a version constraint, making builds non-reproducible and allowing different environments to install different releases. This increases supply-chain risk because a vulnerable or incompatible version could be resolved without review, especially given NumPy's history of advisories.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

numpy

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

Because numpy is unpinned, it is impossible to determine from this manifest whether the installed version includes fixes for known advisories. While this file alone does not prove an exploitable vulnerable version will be installed, the lack of version control leaves the skill exposed to potentially affected releases and weakens security assurance.

Content

No source excerpt is available for this finding.