Phylo Tree

• Outcome: Review
• Latest audit: May 29, 2026 · 9:35 PM UTC
• Version: 1.0.2

Overview

Phylo Tree mostly performs the advertised phylogenetic analysis, but it needs Review because some scripts can run injected R code through crafted paths and some helper instructions make persistent or cloud-publishing changes without clear scoping.

Install only after review. Prefer --fasta mode for offline analysis, use an isolated conda environment, avoid output paths containing quotes or unusual characters, back up ~/.condarc before following installation fixes, and do not run generate_feishu_report.py unless you intend to publish the report and figures through your configured Feishu/Lark bot account.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# Root the tree
    print("\n[3b] Rooting tree (R/ape)")
    subprocess.run([
        "Rscript", "-e", f'''
        library(ape)
        t <- midpoint(read.tree("{tree_file}"))

• Confidence: 90% confidence
• Finding: subprocess.run([ "Rscript", "-e", f''' library(ape) t <- midpoint(read.tree("{tree_file}")) write.tree(t, "{project_dir / "trees" / "tree_rooted.nwk"}") cat

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

subprocess.run(["Rscript", str(r_script)], env=env, check=True)
    else:
        # Inline minimal visualization
        subprocess.run([
            "Rscript", "-e", f'''
            library(ape)
            tree <- read.tree("{tree_file}")

• Confidence: 90% confidence
• Finding: subprocess.run([ "Rscript", "-e", f''' library(ape) tree <- read.tree("{tree_file}") pdf("{fig_dir}/tree_circular.pdf", 12, 12) plot

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

report = project_dir / "REPORT.md"
    
    # Get tree stats
    stats = subprocess.run([
        "Rscript", "-e", f'''
        library(ape)
        t <- read.tree("{project_dir / "trees" / "tree_rooted.nwk"}")

• Confidence: 89% confidence
• Finding: stats = subprocess.run([ "Rscript", "-e", f''' library(ape) t <- read.tree("{project_dir / "trees" / "tree_rooted.nwk"}") cat(length(t$tip.label), max(node.depth.ed

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

cat("✓ Basic figures generated\\n")
    """
    
    subprocess.run(["Rscript", "-e", r_script], check=True)

# ============================================================================
# Main Pipeline

• Confidence: 96% confidence
• Finding: subprocess.run(["Rscript", "-e", r_script], check=True)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"""
    
    try:
        subprocess.run(["Rscript", "-e", r_script], check=True, 
                      capture_output=True, text=True)
        print_success(f"Rooted tree: {output_tree}")
    except subprocess.CalledProcessError as e:

• Confidence: 98% confidence
• Finding: subprocess.run(["Rscript", "-e", r_script], check=True, capture_output=True, text=True)

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The script generates authoritative-sounding scientific claims about data provenance, tools, parameter choices, and analysis steps that it does not verify from source artifacts. In a research reporting context, this can silently produce false or misleading documents, enabling integrity failures, misrepresentation of methods, and downstream publication or compliance issues.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The guide instructs users to modify ~/.condarc to change the solver, which is a persistent user-level configuration change. While not overtly malicious, it can silently alter future conda behavior across environments and may overwrite an intentional setup without adequate warning, backup guidance, or a safer scoped alternative.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The one-click script performs multiple impactful actions automatically, including editing ~/.condarc, creating environments, installing packages, and running R package installation commands. In a skill context, users may copy-paste and execute it without reviewing the consequences, making persistent configuration changes and network-installed package execution more dangerous due to reduced scrutiny.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The guide instructs users to edit ~/.condarc in place, which permanently changes the user's global Conda configuration without warning, backup, or scoped alternative. This can affect unrelated environments and future installs, making troubleshooting harder and potentially breaking expected package resolution behavior across the system.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.