Security audit

Automd Gromacs

Security checks across malware telemetry and agentic risk

Overview

This appears to be a legitimate GROMACS automation skill, but it can run heavy simulations and includes optional install/download guidance that users should control carefully.

Install only if you intend to run GROMACS workflows. Use a project directory, conda environment, container, or HPC job sandbox; review commands before execution; do not set AUTOMD_AUTO_INSTALL=1 or AUTOMD_CG_ALLOW_DOWNLOAD=1 unless you accept network/package changes; avoid uploading proprietary structures to web services without approval.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (27)

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The file’s own routing model says validation targets should remain distinct from execution helpers, yet `protein-analysis` is mapped to `scripts/advanced/protein.sh`, which appears to be an execution/setup script rather than an analysis workflow. In an agentic setting, this semantic mismatch can cause a request for analysis to trigger simulation/setup actions instead of read-only validation, leading to unintended state changes, wasted compute, or execution of a more privileged workflow than the user intended.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The document explicitly proposes auto-installing packages via conda or pip from within workflow scripts, which changes the host environment without an explicit approval step. In an AI-operated automation context, this is risky because dependency installation can execute package lifecycle code, alter reproducibility, and expand the trust boundary beyond the declared MD workflow itself.

Intent-Code Divergence

Low

Confidence: 89% confidence
Finding: The guide explicitly presents a validation-skipping path ('Quick bypass validation') and frames it as suitable for 'Trusted inputs' without clearly stating what checks are disabled or the risks of bypassing them. In a scientific preprocessing workflow, this can normalize unsafe operation and lead users to generate invalid or misleading simulation inputs that are harder to diagnose later.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The script can proceed with a metadynamics fallback when true accelerated MD via PLUMED is unavailable, while still presenting itself as an aMD workflow. In this scientific automation context, that is a real integrity and reproducibility risk because users may run, interpret, or publish results under the wrong methodological assumption despite the method producing materially different sampling and reweighting behavior.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The script can download and extract remote MARTINI force-field archives when an environment flag is enabled. Even though this supports the simulation workflow, it introduces a supply-chain and remote-content trust risk because code or data from the network is fetched and unpacked without integrity verification, pinning, or explicit user confirmation at execution time.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The script can invoke pip3 to install vermouth-martinize automatically when a flag is set. This is dangerous because it gives the skill package-management capability and executes unpinned third-party code from package repositories, creating a supply-chain risk and changing the host environment unexpectedly.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The script includes runtime package-management behavior that can install missing tools via conda or pip when AUTOMD_AUTO_INSTALL=1 is set. Even though this is gated by an environment variable, it still expands the script's capabilities beyond simulation into network/package execution, which increases supply-chain and environment-integrity risk in scientific or shared compute environments.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The script can install missing tools at runtime via conda or pip when AUTOMD_AUTO_INSTALL=1, which introduces supply-chain and environment-modification risk during execution. In a scientific workflow script, changing the host environment and fetching packages from external registries is dangerous because it can execute unreviewed code, reduce reproducibility, and violate least-privilege expectations.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: Invoking conda install or pip install from within the script gives the workflow a context-inappropriate capability to fetch and run external package installation logic on the host. Even though it is gated by an environment variable, this still creates a meaningful attack surface through malicious packages, dependency confusion, compromised indexes, or unexpected host mutation.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The script contains runtime package installation logic via conda/pip, which changes the execution environment and pulls code from external package sources during workflow execution. In a scientific automation skill this is not inherently malicious, but it expands the attack surface because a user who enables AUTOMD_AUTO_INSTALL=1 may unknowingly execute unpinned, unverified third-party packages or trigger unintended environment modification.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The README presents copy-pasteable commands that invoke setup and simulation scripts, but it does not warn users or downstream AI agents that these operations may create, overwrite, or modify files and may start computationally expensive MD jobs. In an AI-agent-oriented toolkit, this omission increases the chance of unsafe automatic execution in the wrong directory or on unintended inputs, leading to data loss, resource exhaustion, or accidental job submission.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The usage guidance tells an agent to 'match skill based on user need' at a very broad level, without requiring explicit confirmation, scope checks, or least-privilege routing. In a skill pack that includes many scripts with execution and auto-fix behavior, ambiguous matching can cause the wrong workflow to be selected and run, leading to unintended commands or system changes.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The index explicitly encourages executing scripts that may auto-install dependencies and apply automatic fixes, but it does not present a clear warning that these actions modify the host system. In an agent setting, this can turn a documentation lookup into package installation, environment mutation, or broader command execution without informed user consent.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The guidance promotes automated package installation and use of external tools without requiring user approval, provenance checks, environment isolation, or supply-chain warnings. In an agent context, this can lead to unreviewed software installation, execution of third-party code, and unintended changes to the host environment.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documentation includes website upload workflows without any privacy or data-handling warning. In a skill intended for AI agents, suggesting uploads of ligands or simulation inputs to third-party services can cause confidential research data, proprietary molecular structures, or regulated information to be disclosed externally.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The proposed implementation installs packages automatically but does not include any user warning that the script will modify the environment. This is dangerous for agent-driven execution because it can unexpectedly change system state, bypass change-control expectations, and trigger execution of unreviewed package installation logic.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The implementation guidance repeats the pattern of automatically installing missing tools inside scripts, again without a warning, confirmation gate, or restriction to controlled environments. In a scientific automation skill, this increases supply-chain and integrity risk because AI agents may execute these steps unattended on shared workstations or clusters.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The instructions tell users to download a remote script and place it into a system-wide executable path using privileged operations, but do not clearly require integrity verification, source trust validation, or least-privilege alternatives first. If the remote file or transport path is compromised, this can lead to arbitrary code execution for all users of the system.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The document instructs users to fetch and execute a remote Python script directly from the internet without a clear trust-and-verification warning. Even though this is common in tooling docs, it is dangerous because a compromised upstream, mirror, or network path could result in executing attacker-controlled code.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The document recommends uploading ligand/protein structures to third-party web services such as LigParGen, ACPYPE Web, CGenFF, PDB2PQR, and WHATIF without any warning about confidentiality, data retention, licensing, or institutional data-sharing restrictions. In scientific and pharmaceutical workflows, these structures may be unpublished, proprietary, or export-controlled, so encouraging external upload can cause unintended disclosure.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The guide tells users to upload a protein structure to CHARMM-GUI, which transfers potentially proprietary or sensitive research data to a third-party service, but it does not clearly disclose that external sharing occurs or advise users to verify data-handling requirements. In scientific and enterprise environments, unpublished structures, ligand complexes, or client data may be confidential, so this omission creates a real data-exposure risk.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The documentation recommends an in-place sed edit to change the MDP file without warning that the command permanently modifies the user's configuration. This can silently destroy original settings, hinder reproducibility, and cause accidental propagation of altered simulation parameters.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The suggested sed command deletes lines from the MDP file in place, which is a destructive modification presented without caution or backup guidance. Users may unintentionally remove important settings, making troubleshooting harder and potentially corrupting a working configuration.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The document instructs users to run `sudo apt-get install dssp`, which performs a privileged, system-wide package installation without any warning or safer alternatives. While common in Linux setup guidance, recommending `sudo` in a troubleshooting file can lead users to execute high-privilege commands they do not fully understand, increasing the risk of unintended system changes in shared, managed, or sensitive environments.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: This block performs pip3 installation without runtime confirmation once the enabling flag is present. In a skill context, that is risky because users may not expect environment mutation or third-party package execution during a simulation run, and the package is not version-pinned or verified.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.