SMILES De-salter

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:20 AM UTC
• Version: 1.0.0

Overview

This is a local SMILES de-salting utility with some documentation and dependency hygiene issues, but no evidence of hidden persistence, credential access, network exfiltration, or destructive behavior.

Install and run this only in a project workspace or virtual environment, pin and review pandas and rdkit versions before production use, and invoke it only for SMILES de-salting tasks with explicit input and output paths.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned Third-Party Dependencies Permit Unreviewed Supply-Chain Changes

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1-2 and SKILL.md:162
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable code in requirements.txt:1-2:

text

pandas
rdkit

Related installation instruction in SKILL.md:162:

text

pip install rdkit pandas

Technical Analysis

The project declares pandas and rdkit without exact versions or package hashes. The documented installation command likewise installs whichever releases the configured package index resolves at installation time.

Consequently, installations are not reproducible and may consume dependency releases that were never reviewed with this skill. The declaration also fails to enforce the RDKit version expectation documented elsewhere in SKILL.md. If a package index, package release, maintainer account, or dependency in the transitive dependency graph is compromised, installation or import-time code from the affected package could execute locally.

This finding does not establish that the currently published pandas or rdkit packages are malicious. The vulnerability is the absence of controls that bind installation to reviewed artifacts.

Attack Path

1. An operator follows the documented command or installs packages from requirements.txt.
2. pip queries the operator's configured package index and dynamically resolves package versions and transitive dependencies.
3. A compromised, substituted, or unexpectedly incompatible release is selected because no exact versions or integrity hashes constrain resolution.
4. Package installation hooks, native components, or import-time initialization execute when the dependency is installed or imported by scripts/main.py.
5. Malicious code in such a package executes with the permissions of the user running the installation or skill.

Exploitation therefore requires control over, or compromise of, an applicable package artif ...[truncated 611 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to an exact, reviewed version, for example:

   text

   pandas==<reviewed-version>
   rdkit==<reviewed-version>
   

2. Generate a lock file containing resolved transitive dependencies and cryptographic hashes using an appropriate dependency-management tool.
3. Require hash verification during installation, such as pip install --require-hashes -r requirements.txt.
4. Use only trusted, explicitly configured package indexes and disable unneeded supplemental indexes to reduce substitution risks.
5. Run dependency vulnerability and license scanning against the complete locked dependency graph before release.
6. Update SKILL.md so its installation command uses the locked requirements file rather than unconstrained package names.
7. Perform dependency installation and skill execution in a least-privileged virtual environment, container, or sandbox without unnecessary credentials.
8. Establish a controlled update process in which dependency changes are reviewed, tested, and accompanied by regenerated hashes.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents the skill as general-purpose data analysis with reproducible workflow guarantees, while the body reveals a narrower SMILES transformation utility with file I/O and local script execution. This mismatch can cause the skill to be selected in inappropriate contexts, leading users or agents to grant broader trust, inputs, or permissions than the implementation actually warrants.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence

Finding

The skill documents file-reading and script execution behavior but does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization ambiguity where an orchestrator or reviewer cannot reliably enforce least privilege, increasing the chance of unintended file access when the skill is invoked.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The activation guidance is broad enough to match many generic analysis tasks unrelated to SMILES de-salting. Overbroad invocation criteria can cause the skill to be routed sensitive or unsuitable data and executed in contexts where its file-handling and transformation behavior were not intended, increasing the risk of misuse and over-permissioning.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill is documented throughout as processing chemical SMILES strings from files or a single SMILES value, with --input defined as a file path at L117 and examples using CSV/TSV/SMILES files. The command at L073 instead passes a clinical-style narrative string to --input, which contradicts the stated interface and purpose of the tool.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The text at L236 says "No additional Python packages required," which directly conflicts with the documented dependencies at L028-L029 and installation command at L160-L161. This is an active documentation contradiction that could cause failed execution and undermines the claimed reproducible workflow.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

Although the file says the skill matches its documented purpose, the surrounding guidance elsewhere is broad enough that the trigger boundary remains unclear, and there are no concrete non-applicable examples. For markdown files, the absence of explicit exclusions or a precise trigger list can make activation conditions ambiguous.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency on pandas is unpinned, which makes builds non-reproducible and can cause the environment to resolve to an unexpected or vulnerable version over time. In a security-sensitive workflow, this weakens supply-chain control and makes it harder to verify whether known advisories affect the installed package.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

pandas
rdkit

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 87% confidence

Finding

The manifest references pandas without a version pin, and pandas has at least one known advisory in some historical releases. Because the version is unspecified, it is impossible to determine from this file alone whether deployments will resolve to an affected version, which creates avoidable supply-chain uncertainty.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency on rdkit is also unpinned, creating the same supply-chain and reproducibility risk: future installs may pull different releases with different behavior or security posture. This is especially relevant for analysis workflows where deterministic results and controlled environments are expected.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

pandas
rdkit