T08 · Insecure Dependencies
Warning
- Location
requirements.txt:1- Finding
Unpinned Third-Party Dependencies Create Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
Security audit
Target Novelty Scorer
Security checks for vulnerabilities and agentic risk
Overview
The skill is not destructive, but it presents simulated biomedical literature scores as real PubMed/PMC analysis, so it should be reviewed before use.
Do not rely on this skill for real target-selection, literature review, biomedical reporting, or investment/research decisions unless it is changed to query real sources and label provenance clearly. If installed for demo use, run it in a sandbox, avoid opening CSV output from untrusted target names in spreadsheet software, and write reports only to disposable workspace paths.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/main.py:363- Finding
CSV Formula Injection Through Attacker-Controlled Target Names
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/main.py:445- Finding
Unrestricted Output Path Allows Overwriting User-Writable Files
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The file-level documentation markets the tool as a literature-mining novelty scorer, but the core search implementation fabricates pseudo-random results instead of querying PubMed. In a biotech/pharma context, this materially increases risk because users may trust the output for research strategy, target selection, or reporting, leading to deceptive analysis and potentially harmful downstream decisions.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill advertises executable Python workflows and explicit write-capable outputs, but it does not declare any tool scope such as permissions or allowed-tools. That creates a policy gap where an agent may execute file-writing behavior without an explicit least-privilege boundary, increasing the chance of unintended filesystem modification or misuse if the companion script is invoked automatically.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
In a markdown file, trigger guidance should clearly distinguish when the skill should and should not be used. The 'When to Use' section uses broad phrasing such as 'evidence insight tasks' and repeats an incomplete description, but does not provide concrete trigger phrases, exclusions, or negative examples, which could lead to unintended invocation.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The CLI exposes a
--dboption suggesting users can choose PubMed/PMC/all, but the selected value is never used and the program always relies on simulated data. This is dangerous because it can mislead users into believing results came from a real biomedical source, causing incorrect scientific or prioritization decisions based on fabricated evidence.- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
The dependency 'dataclasses' is unpinned, so builds may resolve to different versions over time and reduce reproducibility. While this package is generally low risk and is backported mainly for older Python versions, leaving it unpinned still increases supply-chain uncertainty and makes it harder to assess exposure to vulnerable releases.
- Content
text dataclasses numpy
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The dependency 'numpy' is unpinned, which allows installation of different versions across environments and time. This creates supply-chain risk because a vulnerable or incompatible release could be pulled in without review, and NumPy has a history of security advisories that cannot be ruled out without version pinning.
- Content
text dataclasses numpy
Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 92% confidence
- Finding
Because numpy is not pinned, it is impossible to determine whether the installed version is affected by one of the known advisories associated with the package. In a literature-mining skill, this is not especially high-risk by context, but it still weakens supply-chain assurance and could expose the environment to known flaws depending on what version gets resolved.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This code presents all user-facing CLI descriptions, help text, examples, and status messages in English only. The policy requires flagging language or locale constraints when the skill forces a specific language without user opt-in, and no alternative language selection or justification is provided here.
- Content