Waste Disposal Guide

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:58 AM UTC
• Version: 1.0.0

Overview

The skill is not trying to access the system, but its chemical-mixture disposal guidance can produce unsafe recommendations that contradict its own instructions.

Review before installing or using for real laboratory decisions. The skill appears locally contained, but it should not be trusted for mixed, ambiguous, incompatible, or high-risk chemical waste streams until mixture parsing and safety validation are fixed; users should consult their institution's EHS office for disposal decisions.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/main.py:64

Finding

Unsafe First-Match Classification of Chemical Mixtures

Content

View full analysis

Vulnerability Details

File Location: scripts/main.py:64-73; documented behavior contradicted at SKILL.md:29-31
Vulnerability Type: Unsafe input classification and missing mixture validation
Risk Level: High

Vulnerable Code

python

def lookup(self, chemical):
    """Look up disposal category for chemical."""
    chemical_lower = chemical.lower().strip()
    
    for category, info in self.WASTE_CATEGORIES.items():
        if any(chemical_lower in accept or accept in chemical_lower 
               for accept in info["accepts"]):
            return info
    
    return None

The documented workflow promises behavior that is not implemented:

markdown

4. **Mixture handling:** If the user provides a mixture (e.g., "chloroform + ethanol"), identify the most hazardous component and assign the container for that component. Emit a note: "Mixed waste containing halogenated solvents must go into the halogenated (orange) container regardless of other components."
5. If the chemical is not found, state that clearly and suggest the closest category based on chemical class.
6. If inputs are incomplete, state which fields are missing and request only the minimum additional information.

Technical Analysis

The lookup algorithm uses bidirectional substring matching:

python

chemical_lower in accept or accept in chemical_lower

It then returns the first matching category according to dictionary insertion order. It does not tokenize mixtures, identify every component, check incompatibilities, rank hazards, or apply the documented halogenated-waste precedence rule.

For example, the input ethanol + nitric acid contains recognized components from two different categories. The non_halogenated category is evaluated before the acid category, so the occurrence of ethanol causes an immediate recommendation for the red non-halogenated organic-waste container. The nitric acid ...[truncated 1836 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace bidirectional substring matching with normalized exact alias matching. Map each accepted alias to a canonical chemical and category.
2. Parse explicitly supported mixture separators, including +, commas, semicolons, and words such as and, before classification.
3. Classify every mixture component independently. Do not return after the first match.
4. Implement an explicit, reviewed compatibility and precedence policy. At minimum, enforce the documented rule that any recognized halogenated solvent causes assignment to the halogenated-waste category.
5. Do not assume that selecting a single “most hazardous” component is safe for arbitrary mixtures. Reject incompatible, ambiguous, partially recognized, or unsupported mixtures and direct the user to the institution's environmental health and safety office.
6. Display all recognized components, unresolved components, and the rule used to derive the final recommendation.
7. Add regression tests for:
   • Halogenated and non-halogenated solvent mixtures.
   • Acid and organic-solvent mixtures.
   • Acid and base mixtures.
   • Oxidizer and organic mixtures.
   • Unknown components combined with known components.
   • Partial names, negated descriptions, and aliases.
   • Inputs containing multiple separators.
8. Keep SKILL.md synchronized with actual executable behavior and avoid documenting safety controls until they are implemented and tested.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.