Security audit

Automd Gromacs

Security checks for vulnerabilities and agentic risk

Overview

This GROMACS automation skill is mostly coherent, but it includes unsafe installation and troubleshooting instructions that can install unverified code globally or weaken the host environment.

Review commands before letting an agent run them. Prefer a fresh conda environment or disposable container, preinstall pinned dependencies yourself, avoid AUTOMD_AUTO_INSTALL and AUTOMD_CG_ALLOW_DOWNLOAD unless you trust the sources, do not install downloaded scripts into /usr/local/bin without verifying them, and avoid persistent ~/.bashrc or Docker capability changes unless you understand the host impact.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (6)

T03 · Remote Payload Retrieval and Execution

Error

Location: references/tools/INSTALLATION.md:219
Finding: Unverified Remote Python Payload Downloaded and Installed as a System Command<![CDATA[ ## Vulnerability Details **File Location**: `references/tools/INSTALLATION.md:219-231` **Vulnerability Type**: Remote payload retrieval through HTTP or a mutable GitHub branch **Risk Level**: Critical ### Vulnerable Code ```bash wget http://cgmartini.nl/images/tools/insane/insane.py wget https://github.com/Tsjerk/Insane/raw/master/insane.py chmod +x insane.py sudo mv insane.py /usr/local/bin/insane insane --help ``` ### Technical Analysis The instructions retrieve an executable Python file directly from an external server. The first source uses plaintext HTTP, which provides no transport integrity and is vulnerable to interception or content substitution. The fallback source uses the mutable `master` branch of a personal GitHub repository rather than a fixed commit or signed release. No checksum, digital signature, release tag, or immutable commit is verified before the file is made executable and installed under `/usr/local/bin`. The verification command then executes the downloaded payload. This behavior creates a direct time-of-review versus time-of-execution gap: the effective code run by the user can change without any modification to this Skill package. ### Attack Path 1. An attacker intercepts the plaintext HTTP request, compromises the hosting server, or compromises the GitHub repository. 2. The attacker replaces `insane.py` with a modified Python payload. 3. A user follows the installation instructions and downloads the substituted file. 4. The user marks the payload executable and moves it into `/usr/local/bin`. 5. The `insane --help` verification command or a subsequent membrane workflow executes the payload. 6. The payload runs with the privileges of the invoking user and can access that user's files, simulation data, environment variables, and network resources. 7. Because the command is installed globally, other users or privileged workflows may later invoke the substituted executable. ### Impact Assessment The initial paylo ...[truncated 589 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the plaintext HTTP download entirely. 2. Do not download executable code from a mutable branch. 3. Use an official, immutable release artifact or pin an audited Git commit. 4. Publish and verify a SHA-256 checksum or cryptographic signature before installation. 5. Prefer an authenticated package repository with version and hash pinning. 6. Install into a dedicated virtual environment, Conda environment, or user-local directory rather than `/usr/local/bin`. 7. Do not require `sudo` for this workflow. 8. Inspect downloaded code before its first execution. 9. Fail closed if integrity verification cannot be completed. ]]>

T08 · Insecure Dependencies

Error

Location: references/tools/INSTALLATION.md:52
Finding: Unpinned Git Repository Code Is Installed or Enabled for Execution<![CDATA[ ## Vulnerability Details **File Location**: `references/tools/INSTALLATION.md:52-60`, `references/tools/INSTALLATION.md:238-242`, and `references/troubleshoot/coarse-grained-errors.md:43-51` **Vulnerability Type**: Execution or installation of mutable third-party source repositories **Risk Level**: High ### Vulnerable Code From `references/tools/INSTALLATION.md:52-60`: ```bash git clone https://github.com/alanwilter/acpype.git cd acpype python setup.py install chmod +x acpype.py sudo cp acpype.py /usr/local/bin/acpype acpype --help ``` From `references/tools/INSTALLATION.md:238-242`: ```bash git clone https://github.com/Tsjerk/Insane.git cd Insane pip install . ``` From `references/troubleshoot/coarse-grained-errors.md:43-51`: ```bash pip3 install vermouth-martinize git clone https://github.com/cgmartini/martinize.py cd martinize.py chmod +x martinize.py martinize2 --help ``` ### Technical Analysis Each `git clone` operation retrieves the repository's current default branch. No commit hash, signed release tag, subresource checksum, or reviewed source snapshot is specified. `python setup.py install` and `pip install .` can execute arbitrary package build and installation logic. Marking repository files executable and copying them into a command path similarly permits unreviewed upstream changes to become local executable code. The Skill therefore delegates effective code selection to mutable upstream repositories. A repository compromise or malicious upstream update can alter behavior after the Skill has passed review. ### Attack Path 1. An attacker compromises one of the referenced repositories or an upstream maintainer account. 2. The attacker modifies package setup logic or executable scripts on the default branch. 3. A user follows the installation or troubleshooting instructions. 4. `git clone` retrieves the attacker-controlled revision. 5. `setup.py`, `pip`, or a later direct invocation executes the malicious code. 6. If the exe ...[truncated 721 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every repository to an audited full commit hash or verified signed release. 2. Record expected commit hashes and artifact checksums in the project. 3. Replace legacy `python setup.py install` with a locked, isolated package installation process. 4. Use package hashes, such as pip requirements with `--require-hashes`, where supported. 5. Install dependencies in a dedicated virtual or Conda environment. 6. Avoid copying scripts into `/usr/local/bin`. 7. Require explicit user approval before retrieving or executing third-party source. 8. Document provenance, version, license, and integrity-verification steps for every external tool. 9. Re-audit dependencies before updating pinned revisions. ]]>

T08 · Insecure Dependencies

Error

Location: scripts/advanced/freeenergy.sh:10
Finding: Opt-In Runtime Dependency Installation Executes Unpinned Packages<![CDATA[ ## Vulnerability Details **File Location**: `scripts/advanced/freeenergy.sh:10-44` and `scripts/advanced/coarse-grained.sh:173-189` **Vulnerability Type**: Unpinned package installation during workflow execution **Risk Level**: High ### Vulnerable Code From `scripts/advanced/freeenergy.sh:10-44`: ```bash auto_install_dependencies() { local tools=("$@") local installed=0 if [[ "${AUTOMD_AUTO_INSTALL:-0}" != "1" ]]; then local missing="" for tool in "${tools[@]}"; do if ! command -v "$tool" &> /dev/null; then missing="$missing $tool" fi done if [[ -n "$missing" ]]; then echo "[MISSING] Missing tools:$missing" return 1 fi return 0 fi for tool in "${tools[@]}"; do if ! command -v "$tool" &> /dev/null; then if command -v conda &> /dev/null; then conda install -c conda-forge "$tool" -y &> /dev/null && installed=1 elif command -v pip &> /dev/null; then pip install "$tool" &> /dev/null && installed=1 fi if [ $installed -eq 1 ]; then echo "[SUCCESS] $tool installed" else return 1 fi fi done return 0 } ``` From `scripts/advanced/coarse-grained.sh:173-189`: ```bash if [[ "${AUTOMD_AUTO_INSTALL:-0}" != "1" ]]; then error "martinize not available — install it or set AUTOMD_AUTO_INSTALL=1" fi if command -v pip3 &> /dev/null; then pip3 install vermouth-martinize 2>&1 | tail -5 || { error "martinize unavailable" } fi ``` ### Technical Analysis When `AUTOMD_AUTO_INSTALL=1`, simulation scripts install packages dynamically from Conda or pip without exact version constraints, package hashes, a lockfile, or mandatory environment isolation. Package installation can execute build backends, setup hooks, native compilation steps, and transitive dependencies. ...[truncated 1265 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove package installation from simulation and analysis scripts. 2. Require dependencies to be provisioned before workflow execution. 3. Supply a version-locked Conda environment or requirements file. 4. Pin all direct and transitive dependencies to reviewed versions. 5. Verify hashes or signatures for downloaded packages. 6. Require a dedicated environment rather than installing into the active interpreter. 7. If auto-install remains available, use a strict allowlist mapping tool names to exact package names, versions, channels, and hashes. 8. Display the complete proposed installation plan and require explicit confirmation. 9. Do not suppress installer output, because doing so conceals security-relevant warnings and provenance information. ]]>

T08 · Insecure Dependencies

Warning

Location: scripts/advanced/coarse-grained.sh:106
Finding: Downloaded Force-Field Archives Are Extracted Without Integrity or Path Validation<![CDATA[ ## Vulnerability Details **File Location**: `scripts/advanced/coarse-grained.sh:106-135` **Vulnerability Type**: Unverified archive download and unsafe extraction **Risk Level**: Medium ### Vulnerable Code ```bash if [[ "$MARTINI_VERSION" == "3" ]]; then if command -v wget &> /dev/null; then wget -q https://cgmartini.nl/images/parameters/martini_v3.0.0/martini_v3.0.0.tar.gz -O martini3.tar.gz || { error "MARTINI 3 force field unavailable" } tar -xzf martini3.tar.gz rm martini3.tar.gz fi else if command -v wget &> /dev/null; then wget -q https://cgmartini.nl/images/parameters/martini_v2.2/martini_v2.2.tar.gz -O martini2.tar.gz || { error "MARTINI 2 force field unavailable" } tar -xzf martini2.tar.gz rm martini2.tar.gz fi fi ``` ### Technical Analysis When `AUTOMD_CG_ALLOW_DOWNLOAD=1`, the script downloads a remote tar archive and immediately extracts it. HTTPS protects the connection against ordinary passive interception, but the script does not verify an expected checksum or signature and therefore cannot detect a compromised origin or altered upstream artifact. The script also does not inspect archive member paths before extraction. A malicious archive could contain absolute paths, `../` traversal components, symbolic links, or files designed to overwrite existing content writable by the current user. Even when no executable payload is present, altered force-field data can silently change scientific calculations and invalidate results. ### Attack Path 1. A user enables automatic coarse-grained force-field downloads. 2. The hosting origin or its distribution infrastructure is compromised. 3. The server provides a modified archive. 4. The workflow downloads the archive under a fixed local filename. 5. `tar -xzf` extracts all members without checking their paths or integrity. 6. Crafted members overwrite accessible files, or modified force-fiel ...[truncated 580 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin each supported archive to a documented SHA-256 checksum. 2. Verify the checksum before extraction and delete the file on mismatch. 3. Prefer signed release artifacts and verify their signatures. 4. List archive contents before extraction. 5. Reject absolute paths, parent-directory traversal, unsafe symbolic links, device files, and unexpected file types. 6. Extract into a newly created, restricted directory rather than an existing project directory. 7. Use `tar` safety options appropriate to the supported platform. 8. Validate the expected directory structure and force-field files after extraction. 9. Preserve provenance and integrity information in generated experiment reports. ]]>

T07 · Tool Hijacking and Spoofing

Error

Location: references/gpu/gpu-installation.md:27
Finding: Unverified CMake Binary Is Installed Into the Global Command Path<![CDATA[ ## Vulnerability Details **File Location**: `references/gpu/gpu-installation.md:27-33` **Vulnerability Type**: Global tool replacement using an unverified downloaded binary archive **Risk Level**: High ### Vulnerable Code ```bash cd /tmp wget https://github.com/Kitware/CMake/releases/download/v4.0.1/cmake-4.0.1-linux-x86_64.tar.gz tar xzf cmake-4.0.1-linux-x86_64.tar.gz mv cmake-4.0.1-linux-x86_64 /opt/cmake-4.0.1 ln -sf /opt/cmake-4.0.1/bin/cmake /usr/local/bin/cmake cmake --version ``` ### Technical Analysis The documented procedure downloads a precompiled CMake distribution and installs it into `/opt`, then creates or replaces `/usr/local/bin/cmake` with a symbolic link to the downloaded binary. The artifact comes from an official GitHub release URL, which is safer than a personal mutable branch, but no release checksum or signature is verified. The command also changes the system-wide resolution of `cmake`, affecting processes unrelated to this Skill. The final `cmake --version` command executes the newly installed binary. If the artifact or download process is compromised, this becomes immediate code execution. Replacing a globally resolved tool also violates least privilege because a per-user path or isolated build container is sufficient for the declared GPU-build workflow. ### Attack Path 1. An attacker compromises the release artifact, hosting account, or relevant delivery infrastructure. 2. A user downloads the substituted CMake archive. 3. The archive is extracted and installed under `/opt`. 4. `/usr/local/bin/cmake` is redirected to the downloaded executable. 5. `cmake --version` immediately executes the malicious binary. 6. Future users, build scripts, or privileged automation invoking `cmake` also execute the substituted tool. ### Impact Assessment The malicious binary initially obtains the privileges of the user running `cmake`. The filesystem changes under `/opt` and `/usr/local/bin` normally require administrative privileges, ...[truncated 305 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Verify the official CMake release checksum or signature before extraction. 2. Pin the expected checksum in the installation guide. 3. Install CMake in a user-owned directory or isolated build environment. 4. Prepend an explicit temporary path only for the current build instead of replacing `/usr/local/bin/cmake`. 5. Avoid instructing users to run the complete workflow as root. 6. If system installation is necessary, separate verified download and inspection from the minimal privileged file-copy step. 7. Refuse to continue when integrity verification fails. 8. Document how to restore the previous system CMake configuration. ]]>

T06 · System Persistence

Warning

Location: references/gpu/gpu-installation.md:122
Finding: GPU Installation Instructions Persistently Modify Shell Startup Configuration<![CDATA[ ## Vulnerability Details **File Location**: `references/gpu/gpu-installation.md:122-140` **Vulnerability Type**: Persistent shell environment modification **Risk Level**: Medium ### Vulnerable Code ```bash cat > /opt/gromacs-2025.4-gpu/env.sh << 'EOF' export GMX=/opt/gromacs-2025.4-gpu export PATH=$GMX/bin:$PATH export LD_LIBRARY_PATH=$GMX/lib64:$LD_LIBRARY_PATH export CUDA_HOME=/usr/local/cuda-12.8 export PATH=$CUDA_HOME/bin:$PATH export LD_LIBRARY_PATH=$CUDA_HOME/lib64:$LD_LIBRARY_PATH EOF echo 'source /opt/gromacs-2025.4-gpu/env.sh' >> ~/.bashrc source /opt/gromacs-2025.4-gpu/env.sh gmx --version 2>&1 | grep -iE "GPU|CUDA|SIMD" ``` ### Technical Analysis The installation guide appends a `source` command to `~/.bashrc`, causing `/opt/gromacs-2025.4-gpu/env.sh` to run in every future interactive Bash session. This is cross-session persistence and is not required to complete a single GROMACS build or simulation. The sourced script modifies `PATH` and `LD_LIBRARY_PATH`, which influence executable and shared-library resolution. If the `/opt` installation or environment script is later replaced, every new shell can be redirected to attacker-controlled commands or libraries. Repeated execution also appends duplicate entries because the command does not check whether the line already exists. ### Attack Path 1. A user follows the GPU installation instructions. 2. The persistent `source` directive is appended to `~/.bashrc`. 3. An attacker who can later modify the `/opt` environment script, GROMACS binary directory, or referenced libraries changes their contents. 4. The user starts a new Bash session. 5. Bash automatically sources the modified script. 6. The attacker-controlled path or library configuration affects commands run in that and subsequent sessions. ### Impact Assessment The startup hook executes with the privileges of the affected user on every interactive Bash session. A compromised environment script can run arbitrary shell commands, ...[truncated 285 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not modify `~/.bashrc` automatically. 2. Provide an explicit, temporary activation command for users to run only when needed. 3. Prefer an environment module, container, Conda activation script, or project-local wrapper. 4. If persistent configuration is optional, require informed user consent and clearly explain the security consequences. 5. Check for an existing entry before modifying a startup file. 6. Use a narrowly scoped environment script with ownership and permission validation. 7. Avoid unnecessary `LD_LIBRARY_PATH` changes; prefer build-time runtime paths where possible. 8. Provide a documented removal and rollback procedure. ]]>

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (171)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The description presents a broad AutoMD-GROMACS skill with workflow automation plus enhanced sampling, special-system simulation, advanced analysis, publication-ready visualization, troubleshooting, and token optimization. The supplied code chunk only implements a single ligand–protein simulation pipeline in Bash. It does include some troubleshooting-oriented behavior (error messages, fallback ligand parameterization, optional dependency auto-install), so that part partially aligns. However, the main mismatch is that the declared purpose is substantially broader than the actual behavior shown. Additionally, the code has an undeclared capability to install packages at runtime via conda or pip when AUTOMD_AUTO_INSTALL=1, which is a meaningful side effect not reflected in the declared permissions/capabilities. The report it generates contains analysis and visualization instructions, but does not actually perform advanced analysis or produce publication-ready visualizations. Therefore the description does not accurately represent this specific code chunk.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The code is related to the declared domain of molecular dynamics automation for GROMACS, so it is not wholly unrelated. However, the supplied chunk implements a much narrower capability than the description claims. It handles one specialized membrane-protein setup/equilibration pipeline and basic report generation. It does not implement enhanced sampling methods, substantive advanced analysis, publication-ready visualization generation, or any clearly AI-facing/token-optimization features. The script does include limited troubleshooting-style behavior through dependency checks, optional auto-install, and error messages, and it fits 'special-system simulation' in the membrane-protein sense. Still, the declared description overstates the capabilities actually present in this code chunk, so this should be flagged as a description-behavior mismatch.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The supplied code chunk does fit part of the declared purpose: it is an automation workflow for GROMACS and is AI-friendly in the sense of structured steps and concise error messages. However, the description substantially overstates the implemented capabilities in this chunk. The script only orchestrates a standard six-step MD pipeline and basic analysis via other scripts. There is no evidence here of enhanced sampling methods, special-system simulation support, advanced analysis, or publication-ready visualization. Troubleshooting is limited to basic dependency/input checks and fixed error hints, not robust built-in troubleshooting. This is not a harmful undeclared capability issue; rather, the declared description is materially broader than the observed behavior, so it should be flagged as a description/behavior mismatch.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The description presents a comprehensive AutoMD-GROMACS system for end-to-end molecular dynamics automation, including workflow management, enhanced sampling, special-system simulation, advanced analysis, visualization, and troubleshooting. The supplied code chunk is much narrower: it is a basic analysis script for existing GROMACS outputs (`md.tpr`, `md.xtc`). It preprocesses trajectories and runs standard analyses (RMSD, RMSF, gyration radius, hydrogen bonds, SASA, optional DSSP), computes simple summary statistics, and writes a Markdown report. There is some built-in troubleshooting via checks and error messages, so that aspect is partially consistent. However, the code does not implement simulation workflow orchestration, enhanced sampling, special-system handling, advanced analysis beyond standard metrics, or publication-ready visualization. Therefore the declared description materially overstates the behavior of this code chunk.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The supplied code chunk is narrowly focused on preparing a standard GROMACS system from a PDB through topology generation, boxing, solvation, ion addition, energy minimization, and report generation. It does include basic troubleshooting/error messages and a small amount of automatic parameter selection, which partially aligns with 'automation' and 'built-in troubleshooting.' However, the declared description promises a much broader platform: enhanced sampling, special-system simulation, advanced analysis, publication-ready visualization, and wider workflow orchestration. None of those capabilities are present in this code chunk. The primary purpose of the code is initial system setup, not the full-featured molecular dynamics automation suite described. Therefore the description materially overstates what this code actually does.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description presents a comprehensive molecular dynamics automation system with workflow orchestration, enhanced sampling, simulation support, advanced analysis, visualization, and troubleshooting. The supplied code does not implement those broad capabilities. It only parses CLI flags, checks for `gmx`, validates an input file, and dispatches to a few basic GROMACS commands (`trjconv`, `make_ndx`) for convert/center/fit/PBC/index tasks. There is no evidence here of workflow automation, simulation setup/execution, enhanced sampling, special-system handling, advanced analysis, or publication-ready visualization. This is therefore a description-to-behavior mismatch due to substantial overstatement of the implemented functionality in the provided code chunk.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The description claims a comprehensive AutoMD-GROMACS system with broad MD workflow automation, enhanced sampling, special simulations, analysis, visualization, and troubleshooting. The supplied code chunk is only a simple Bash utility wrapper around standard GROMACS commands for preprocessing and trajectory manipulation. While it is related to GROMACS and molecular dynamics, it does not implement most of the declared headline capabilities. This is a material description-to-behavior mismatch due to substantial overstatement of functionality.

Credential Access

High

Category: Privilege Escalation
Content: ### 全新安装 (Ubuntu 22.04+) ```bash # 安装 NVIDIA CUDA keyring wget https://developer.download.nvidia.com/compute/cuda/repos/ubuntu2204/x86_64/cuda-keyring_1.1-1_all.deb dpkg -i cuda-keyring_1.1-1_all.deb apt-get update
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: ### 全新安装 (Ubuntu 22.04+) ```bash # 安装 NVIDIA CUDA keyring wget https://developer.download.nvidia.com/compute/cuda/repos/ubuntu2204/x86_64/cuda-keyring_1.1-1_all.deb dpkg -i cuda-keyring_1.1-1_all.deb apt-get update
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: ### 全新安装 (Ubuntu 22.04+) ```bash # 安装 NVIDIA CUDA keyring wget https://developer.download.nvidia.com/compute/cuda/repos/ubuntu2204/x86_64/cuda-keyring_1.1-1_all.deb dpkg -i cuda-keyring_1.1-1_all.deb apt-get update
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Content: �心数 make install ``` ## 环境配置 ```bash # 创建环境脚本 cat > /opt/gromacs-2025.4-gpu/env.sh << 'EOF' export GMX=/opt/gromacs-2025.4-gpu export PATH=$GMX/bin:$PATH export LD_LIBRARY_PATH=$GMX/lib64:$LD_LIBRARY_PATH export CUDA_HOME=/usr/local/cuda-12.8 export PATH=$CUDA_HOME/bin:$PATH export LD_LIBRARY_PATH=$CUDA_HOME/lib64:$LD_LIBRARY_PATH EOF # 自动加载（写入 .bashrc） echo 'source /opt/gromacs-2025.4-gpu/env.sh' >> ~/.bashrc ``` ## 验证 ```bash source /opt/gromacs-2025.4-gpu/env.sh gmx --version 2>&1 | grep -iE "GPU|CUDA|SIMD" ``` 期望输出： ``` GPU support: CUDA SIMD instructions: AVX2_256 GPU FFT library: cuFFT CUDA compiler: /usr/local/cuda-12.8/bin/nvcc ``` ## CUDA 架构对照表 | GPU 系列 | 架构 | CMAKE_CUDA_ARCHITECTURES | |----------|------|--------------------------| | RTX 5090/5080/5070/5060 | Blackwell | `120` | | RTX 4090/4080/4070/4060 | Ada Lovelace | `89` | | RTX 3090/3080/3070 | Ampere | `86` | | A100/H10
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Privileged Container / Container Escape

High

Category: Privilege Escalation
Content: > 不在 /etc/hosts 中会导致 OpenMPI 进程间无法通信。 > 在物理机/共享集群上，不应修改 /etc/hosts，应联系系统管理员配置域名解析。 #### Fix 3: Docker 容器需要 --cap-add=SYS_PTRACE > ⚠️ `SYS_PTRACE` 是 Linux security capability，授予容器进程 ptrace 权限。仅信任的容器镜像使用。如果在容器内完成 Fix 1+2 后 mpirun 仍卡死： ```bash
Confidence: 97% confidence
Finding: Advising the addition of `SYS_PTRACE` to a container grants powerful debugging and process-inspection capability that is unnecessary for most molecular dynamics workflows. In the context of untrusted or broadly scoped containers, this increases the risk of sensitive process inspection, bypass of hardening assumptions, and greater impact from a compromised image.

Privileged Container / Container Escape

High

Category: Privilege Escalation
Content: ``` **需要容器管理员**在启动时添加： ```bash docker run --cap-add=SYS_PTRACE ... ``` 如果无法修改容器权限，只能使用单核模式 (`%pal nprocs 1 end`)
Confidence: 98% confidence
Finding: The explicit `docker run --cap-add=SYS_PTRACE ...` command operationalizes a privileged container configuration that weakens container isolation. Because this is a copy-paste-ready command in troubleshooting documentation, it materially increases the chance that users will grant elevated capabilities without fully understanding the security consequences.

Tool Parameter Abuse

High

Category: Tool Misuse
Content: **重新生成拓扑:** ```bash # 从头开始 rm -rf output/* ./setup.sh --input protein.pdb --output output ```
Confidence: 91% confidence
Finding: The documentation instructs users to run `rm -rf output/*`, which is a destructive filesystem operation. While the path is not obviously attacker-controlled in this snippet, blindly recommending recursive deletion can cause unintended data loss if executed from the wrong directory, if `output` is a symlink, or if users adapt the command unsafely in automation.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: - **INSTALLATION.md warnings** — security advisories added before all `sudo`, `/etc/`, and system-level operations; `insane.py` download uses HTTPS; `~/.gromacs_env.sh` warns against adding to `.bashrc` - **ligand-topology.md warnings** — `apt-get`, `/etc/ld.so.conf.d/`, and `ldconfig` commands now commented out with security advisories and conda alternatives - **qmmm-errors.md warnings** — `/etc/hosts` modification now includes security context and container-only guidance; `SYS_PTRACE` capability risk documented - **membrane-errors.md warnings** — `sudo mv insane.py` replaced with user-path `~/.local/bin/` install; HTTPS download ## [5.3.2] - 2026-06-01
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: - **INSTALLATION.md warnings** — security advisories added before all `sudo`, `/etc/`, and system-level operations; `insane.py` download uses HTTPS; `~/.gromacs_env.sh` warns against adding to `.bashrc` - **ligand-topology.md warnings** — `apt-get`, `/etc/ld.so.conf.d/`, and `ldconfig` commands now commented out with security advisories and conda alternatives - **qmmm-errors.md warnings** — `/etc/hosts` modification now includes security context and container-only guidance; `SYS_PTRACE` capability risk documented - **membrane-errors.md warnings** — `sudo mv insane.py` replaced with user-path `~/.local/bin/` install; HTTPS download ## [5.3.2] - 2026-06-01
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: - **INSTALLATION.md warnings** — security advisories added before all `sudo`, `/etc/`, and system-level operations; `insane.py` download uses HTTPS; `~/.gromacs_env.sh` warns against adding to `.bashrc` - **ligand-topology.md warnings** — `apt-get`, `/etc/ld.so.conf.d/`, and `ldconfig` commands now commented out with security advisories and conda alternatives - **qmmm-errors.md warnings** — `/etc/hosts` modification now includes security context and container-only guidance; `SYS_PTRACE` capability risk documented - **membrane-errors.md warnings** — `sudo mv insane.py` replaced with user-path `~/.local/bin/` install; HTTPS download ## [5.3.2] - 2026-06-01
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: - **INSTALLATION.md warnings** — security advisories added before all `sudo`, `/etc/`, and system-level operations; `insane.py` download uses HTTPS; `~/.gromacs_env.sh` warns against adding to `.bashrc` - **ligand-topology.md warnings** — `apt-get`, `/etc/ld.so.conf.d/`, and `ldconfig` commands now commented out with security advisories and conda alternatives - **qmmm-errors.md warnings** — `/etc/hosts` modification now includes security context and container-only guidance; `SYS_PTRACE` capability risk documented - **membrane-errors.md warnings** — `sudo mv insane.py` replaced with user-path `~/.local/bin/` install; HTTPS download ## [5.3.2] - 2026-06-01
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: - **INSTALLATION.md warnings** — security advisories added before all `sudo`, `/etc/`, and system-level operations; `insane.py` download uses HTTPS; `~/.gromacs_env.sh` warns against adding to `.bashrc` - **ligand-topology.md warnings** — `apt-get`, `/etc/ld.so.conf.d/`, and `ldconfig` commands now commented out with security advisories and conda alternatives - **qmmm-errors.md warnings** — `/etc/hosts` modification now includes security context and container-only guidance; `SYS_PTRACE` capability risk documented - **membrane-errors.md warnings** — `sudo mv insane.py` replaced with user-path `~/.local/bin/` install; HTTPS download ## [5.3.2] - 2026-06-01
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: - **INSTALLATION.md warnings** — security advisories added before all `sudo`, `/etc/`, and system-level operations; `insane.py` download uses HTTPS; `~/.gromacs_env.sh` warns against adding to `.bashrc` - **ligand-topology.md warnings** — `apt-get`, `/etc/ld.so.conf.d/`, and `ldconfig` commands now commented out with security advisories and conda alternatives - **qmmm-errors.md warnings** — `/etc/hosts` modification now includes security context and container-only guidance; `SYS_PTRACE` capability risk documented - **membrane-errors.md warnings** — `sudo mv insane.py` replaced with user-path `~/.local/bin/` install; HTTPS download ## [5.3.2] - 2026-06-01
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: - **INSTALLATION.md warnings** — security advisories added before all `sudo`, `/etc/`, and system-level operations; `insane.py` download uses HTTPS; `~/.gromacs_env.sh` warns against adding to `.bashrc` - **ligand-topology.md warnings** — `apt-get`, `/etc/ld.so.conf.d/`, and `ldconfig` commands now commented out with security advisories and conda alternatives - **qmmm-errors.md warnings** — `/etc/hosts` modification now includes security context and container-only guidance; `SYS_PTRACE` capability risk documented - **membrane-errors.md warnings** — `sudo mv insane.py` replaced with user-path `~/.local/bin/` install; HTTPS download ## [5.3.2] - 2026-06-01
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: - **INSTALLATION.md warnings** — security advisories added before all `sudo`, `/etc/`, and system-level operations; `insane.py` download uses HTTPS; `~/.gromacs_env.sh` warns against adding to `.bashrc` - **ligand-topology.md warnings** — `apt-get`, `/etc/ld.so.conf.d/`, and `ldconfig` commands now commented out with security advisories and conda alternatives - **qmmm-errors.md warnings** — `/etc/hosts` modification now includes security context and container-only guidance; `SYS_PTRACE` capability risk documented - **membrane-errors.md warnings** — `sudo mv insane.py` replaced with user-path `~/.local/bin/` install; HTTPS download ## [5.3.2] - 2026-06-01
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: - **INSTALLATION.md warnings** — security advisories added before all `sudo`, `/etc/`, and system-level operations; `insane.py` download uses HTTPS; `~/.gromacs_env.sh` warns against adding to `.bashrc` - **ligand-topology.md warnings** — `apt-get`, `/etc/ld.so.conf.d/`, and `ldconfig` commands now commented out with security advisories and conda alternatives - **qmmm-errors.md warnings** — `/etc/hosts` modification now includes security context and container-only guidance; `SYS_PTRACE` capability risk documented - **membrane-errors.md warnings** — `sudo mv insane.py` replaced with user-path `~/.local/bin/` install; HTTPS download ## [5.3.2] - 2026-06-01
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Content: - **INSTALLATION.md warnings** — security advisories added before all `sudo`, `/etc/`, and system-level operations; `insane.py` download uses HTTPS; `~/.gromacs_env.sh` warns against adding to `.bashrc` - **ligand-topology.md warnings** — `apt-get`, `/etc/ld.so.conf.d/`, and `ldconfig` commands now commented out with security advisories and conda alternatives - **qmmm-errors.md warnings** — `/etc/hosts` modification now includes security context and container-only guidance; `SYS_PTRACE` capability risk documented - **membrane-errors.md warnings** — `sudo mv insane.py` replaced with user-path `~/.local/bin/` install; HTTPS download ## [5.3.2] - 2026-06-01
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README gives direct commands to run setup, simulation, analysis, and visualization scripts but does not warn that these operations may consume substantial CPU/GPU time, require licensed or heavyweight scientific dependencies, and create or overwrite files in the working directory. In an AI-agent context, copy-pastable execution examples materially increase the chance of unintended expensive or destructive runs, especially when an agent may treat documentation examples as safe defaults.

Static analysis

No suspicious patterns detected.