ClawHub
Back to skill

Security audit

Toxicity Structure Alert

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local molecular toxicity alert scanner with some documentation and dependency-quality issues, but no evidence of hidden access, persistence, exfiltration, or destructive behavior.

Use this only for molecular structure inputs such as valid SMILES strings, not clinical notes or general prose. Install it in an isolated environment, prefer pinned or reviewed dependencies, and treat its toxicity alerts as screening guidance rather than a substitute for full toxicology review.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
requirements.txt:1
Finding

Unpinned and Unnecessary Third-Party Dependencies

Content
View full analysis

Vulnerability Details

File Location: requirements.txt:1-3
Vulnerability Type: Supply-chain exposure through unpinned and unnecessary dependencies
Risk Level: Medium

Vulnerable Code

text
dataclasses
enum
rdkit

The installation workflow is documented in SKILL.md:210-215:

text
# Python dependencies
pip install -r requirements.txt

Technical Analysis

Every dependency is declared without a fixed version or integrity hash. Consequently, separate installations can resolve to different package releases whose content was not part of this audit.

The project declares Python 3.8 or later, where dataclasses and enum are standard-library modules. Installing third-party packages with these names is unnecessary and creates avoidable module-shadowing and dependency-confusion exposure. Of the listed packages, only RDKit is required as a third-party dependency by the audited implementation.

Because Python packages and their installation mechanisms may execute code during installation, dependency resolution from an untrusted or compromised index can lead to arbitrary code execution under the privileges of the user performing the installation.

Attack Path

  1. A user follows the documented setup instructions and runs pip install -r requirements.txt.
  2. pip resolves mutable, unpinned package names through its configured package index or mirror.
  3. An attacker compromises a referenced package release or controls a package/index selected by the environment.
  4. The attacker-controlled distribution is downloaded and installed.
  5. Malicious installation or imported package code executes with the privileges of the installing or runtime user.

This path requires compromise or attacker influence over dependency resolution; the audited repository itself does not contain a remote payload.

Impact Assessment

Successful exploitation could execute arbitrary code within the installation environment. The resulting access is bounded b ...[truncated 343 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove dataclasses and enum because they are included in the standard library for the documented Python 3.8+ runtime.
  2. Pin RDKit to a reviewed, compatible version rather than allowing unrestricted resolution.
  3. Generate a lock file containing cryptographic hashes and require hash verification during installation.
  4. Install dependencies only from an approved package index or controlled internal mirror.
  5. Perform installation in a dedicated, least-privileged virtual environment or container.
  6. Add automated dependency vulnerability and provenance checks to the release process.
  7. Periodically update the pinned dependency through a documented review and testing process.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill’s 'When to Use' section broadens usage from molecule toxicity screening to generic data-analysis tasks, which can cause an agent to select and run this skill on unrelated user inputs. In an agentic setting, overbroad routing guidance increases the chance of inappropriate script execution, malformed inputs reaching code paths, and incorrect or misleading outputs being treated as authoritative.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill documentation consistently states that the tool scans molecular structures using SMILES/SMARTS strings, and the parameters section defines --input as a required SMILES string. However, the audit-ready command supplies free-form medical-style prose instead, which directly conflicts with the documented interface and intended behavior.

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The run plan instructs users to run the script and review the generated output, and later sections mention file-system access and saved output files, but there is no explicit user-facing warning near usage that execution may create files in the workspace. For markdown skills, behaviors affecting user data or the filesystem should be clearly disclosed as part of the operational description.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
96% confidence
Finding

The dependency is unpinned, so future installs may resolve to a newer release than originally tested. That creates supply-chain and reproducibility risk because a compromised or breaking upstream release could be pulled automatically during installation.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
dataclasses
enum
rdkit

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
98% confidence
Finding

This package is specified without a version, allowing dependency resolution to drift over time. That can introduce unreviewed code or unexpected behavior from upstream releases and is unnecessary here because enum functionality is generally provided by the standard library in supported Python versions.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text
dataclasses
enum
rdkit

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
98% confidence
Finding

rdkit is an unpinned third-party dependency, so installations may fetch different versions over time. In a chemistry-related skill, this is somewhat more operationally relevant because analysis behavior may change across releases, and a malicious or compromised upstream package version could affect integrity of results or the environment.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text
dataclasses
enum
rdkit