Phylo Tree

• Outcome: Review
• Latest audit: May 28, 2026 · 4:50 AM UTC
• Version: 1.0.2

Overview

Phylo Tree mostly performs the advertised phylogenetic analysis, but it needs Review because some scripts can run injected R code through crafted paths and some helper instructions make persistent or cloud-publishing changes without clear scoping.

Install only after review. Prefer --fasta mode for offline analysis, use an isolated conda environment, avoid output paths containing quotes or unusual characters, back up ~/.condarc before following installation fixes, and do not run generate_feishu_report.py unless you intend to publish the report and figures through your configured Feishu/Lark bot account.

SkillSpector

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# Root the tree
    print("\n[3b] Rooting tree (R/ape)")
    subprocess.run([
        "Rscript", "-e", f'''
        library(ape)
        t <- midpoint(read.tree("{tree_file}"))

• Confidence: 90% confidence
• Finding: This code builds inline R source with Python f-strings that interpolate filesystem paths directly into quoted R code. If an attacker controls the output directory or related path values and includes characters like quotes or backslashes, they can break out of the R string literal and inject arbitrary R commands, leading to code execution when Rscript runs.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

subprocess.run(["Rscript", str(r_script)], env=env, check=True)
    else:
        # Inline minimal visualization
        subprocess.run([
            "Rscript", "-e", f'''
            library(ape)
            tree <- read.tree("{tree_file}")

• Confidence: 90% confidence
• Finding: This inline Rscript invocation embeds tree_file and fig_dir directly into an R expression using f-strings. Because args.output is user-controlled and influences these paths, a crafted path containing quotes can inject arbitrary R code, resulting in command execution under the user's privileges.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

report = project_dir / "REPORT.md"
    
    # Get tree stats
    stats = subprocess.run([
        "Rscript", "-e", f'''
        library(ape)
        t <- read.tree("{project_dir / "trees" / "tree_rooted.nwk"}")

• Confidence: 89% confidence
• Finding: The report-generation step again constructs inline R code with a path derived from the user-controlled output directory. An attacker can exploit improper quoting in the embedded path to inject additional R statements, causing arbitrary code execution during what appears to be a harmless statistics collection phase.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

cat("✓ Basic figures generated\\n")
    """
    
    subprocess.run(["Rscript", "-e", r_script], check=True)

# ============================================================================
# Main Pipeline

• Confidence: 96% confidence
• Finding: This call executes an R interpreter with an inline script built via Python f-string interpolation of user-influenced paths such as tree_file and output_dir. Although subprocess.run is invoked with a list and not shell=True, the danger is shifted into the R code itself: quotes, backslashes, or crafted content in file paths can break R string literals and enable arbitrary R code execution.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"""
    
    try:
        subprocess.run(["Rscript", "-e", r_script], check=True, 
                      capture_output=True, text=True)
        print_success(f"Rooted tree: {output_tree}")
    except subprocess.CalledProcessError as e:

• Confidence: 98% confidence
• Finding: The inline R script interpolates `input_tree` and `output_tree` directly into R source code and then executes it with `Rscript -e`. If an attacker controls the prefix or output path, they may inject characters that terminate the R string and append arbitrary R expressions, leading to code execution under the script's privileges.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The script generates authoritative-sounding scientific claims about data provenance, tools, parameter choices, and analysis steps that it does not verify from source artifacts. In a research reporting context, this can silently produce false or misleading documents, enabling integrity failures, misrepresentation of methods, and downstream publication or compliance issues.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The guide instructs users to modify ~/.condarc to change the solver, which is a persistent user-level configuration change. While not overtly malicious, it can silently alter future conda behavior across environments and may overwrite an intentional setup without adequate warning, backup guidance, or a safer scoped alternative.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The one-click script performs multiple impactful actions automatically, including editing ~/.condarc, creating environments, installing packages, and running R package installation commands. In a skill context, users may copy-paste and execute it without reviewing the consequences, making persistent configuration changes and network-installed package execution more dangerous due to reduced scrutiny.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The guide instructs users to edit ~/.condarc in place, which permanently changes the user's global Conda configuration without warning, backup, or scoped alternative. This can affect unrelated environments and future installs, making troubleshooting harder and potentially breaking expected package resolution behavior across the system.

Static analysis

No suspicious patterns detected.