ClawHub
Back to skill

Security audit

Western Blot Quantifier

Security checks across malware telemetry and agentic risk

Overview

The skill shows no hidden access or destructive behavior, but it materially overstates real Western blot analysis capabilities that the packaged code does not implement.

Review this skill before installing or relying on it. It appears to be an incomplete or misdocumented scientific demo, not a working Western blot quantification tool. Use an isolated Python environment, validate behavior on known test images, and do not rely on its normalized values or advertised CSV/API workflow without independent verification.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The skill claims to calculate normalized values relative to loading controls, but the implementation merely divides every band intensity by the first detected band in a chosen control lane. This can produce scientifically misleading results because it does not identify the correct loading-control band, verify band correspondence, or ensure normalization is being performed against an appropriate reference, which could lead users to trust inaccurate quantitative conclusions.

Description-Behavior Mismatch

Medium
Confidence
98% confidence
Finding
The executable interface advertises image-based analysis through an --image argument, but the non-demo path never loads or processes the supplied image and instead only prints a message. This is dangerous because users may believe real image analysis occurred when it did not, causing silent failure, false confidence in outputs, or incorrect downstream scientific or operational decisions.

Vague Triggers

Medium
Confidence
82% confidence
Finding
The invocation criteria are broad enough that an agent may select this skill for loosely related 'data analysis' tasks outside its actual safe scope. That increases the chance of inappropriate activation, misleading outputs, or unnecessary local script execution on user-provided files.

Missing User Warnings

Low
Confidence
76% confidence
Finding
The skill states that it saves output files but does not clearly warn that execution may create or overwrite artifacts in the workspace. This can lead to accidental data loss or unintended file modification, especially when agents run tools automatically.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.