T08 · Insecure Dependencies
Error
- Location
scripts/install_dependencies.sh:107- Finding
Unverified IQ-TREE Binary Is Downloaded and Installed into a Trusted Executable Path
- Content
View full analysis
- Remediation
View remediation
Security audit
Protein Phylogeny
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a coherent local bioinformatics workflow, but its installer and publishing guidance create review-worthy risks around privileged installs, unverified downloads, and possible third-party upload of research outputs.
Install only in an isolated environment such as a container, virtual machine, or dedicated conda/venv. Avoid running the installer with sudo, verify any downloaded binaries yourself, and do not use the Feishu/Lark upload steps unless you explicitly intend to send the generated report and figures to that service.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
scripts/install_dependencies.sh:39- Finding
Unpinned Python Dependencies Are Installed with System Package Protections Disabled
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/run_full_workflow.sh:16- Finding
Unquoted User-Controlled Paths Permit Word Splitting, Glob Expansion, and Option Injection
- Content
View full analysis
" $INPUT) grep -A 1 "evidence=experimental\|reviewed" $INPUT > $OUTPUT_DIR/stage1.fasta || cp $INPUT $OUTPUT_DIR/stage1.fasta cd-hit -i $OUTPUT_DIR/stage2.fasta -o $OUTPUT_DIR/stage3.fasta \ -c 0.90 -n 5 -M 0 -T 0 -d 0 > $OUTPUT_DIR/cdhit.log 2>&1 mafft --maxiterate 1000 --localpair --thread -1 --quiet \ $OUTPUT_DIR/stage5.fasta > $OUTPUT_DIR/stage6.fasta 2> $OUTPUT_DIR/mafft.log trimal -in $OUTPUT_DIR/stage6.fasta -out $OUTPUT_DIR/stage7.fasta \ -automated1 > $OUTPUT_DIR/trimal.log 2>&1 ``` ### Technical Analysis `INPUT`, `OUTPUT_DIR`, and the result of `dirname ...[truncated 2144 chars]- Remediation
View remediation
" -- "$INPUT") grep -A 1 "evidence=experimental\|reviewed" -- "$INPUT" \ > "$OUTPUT_DIR/stage1.fasta" || cp -- "$INPUT" "$OUTPUT_DIR/stage1.fasta" cd-hit -i "$OUTPUT_DIR/stage2.fasta" \ -o "$OUTPUT_DIR/stage3.fasta" \ -c 0.90 -n 5 -M 0 -T 0 -d 0 \ > "$OUTPUT_DIR/cdhit.log" 2>&1 ``` ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (23)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The description presents a broad end-to-end phylogenetic analysis workflow, but the provided code chunk only covers one component: sequence quality control plus alignment/trimming and simple validation metrics. It does not build phylogenetic trees, compute residue conservation, perform coevolution/network analysis, or generate publication-ready visualizations/reports. While the implemented QC steps are consistent with part of the declared workflow, the actual behavior is materially narrower than the declared primary purpose, so this is a description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description promises a broad, comprehensive workflow for protein family evolutionary analysis, including QC, conservation, coevolution, visualization, and publication-ready outputs. The supplied code chunk only implements one specific subtask: phylogenetic inference from an already aligned FASTA using IQ-TREE, plus extraction of basic statistics and bootstrap summaries. This is related to the declared domain, but materially narrower than the declared functionality. There is no evidence of sequence quality control, residue conservation analysis, coevolution network analysis, figure generation, or a full systematic analysis pipeline. Therefore the description overstates the implemented capabilities, making it a mismatch.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill instructs execution of shell scripts and implies file read/write behavior, but it does not declare any explicit tool scope or permissions boundaries. That creates an authorization ambiguity where an agent may run commands with broader-than-expected access, increasing the risk of unsafe filesystem or shell operations if the referenced scripts are malicious, modified, or invoked on sensitive paths.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
wget "https://rest.uniprot.org/uniprotkb/stream?query=family:kinase+AND+reviewed:true&format=fasta&limit=200" -O kinase.fasta
text **Or create a test file:** ```bash cat > test_sequences.fasta << 'EOF' >seq1
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
The documentation instructs users to run sudo apt-get install, which executes package installation with root privileges on the host machine. Although standard for system package management, encouraging privileged execution in skill documentation can be risky if users do not understand the trust boundary or run it in sensitive environments.
- Content
md conda install -c bioconda cd-hit mafft trimal iqtree # Or via apt (Ubuntu/Debian) sudo apt-get install cd-hit mafft trimal # IQ-TREE wget https://github.com/iqtree/iqtree2/releases/download/v2.2.0/iqtree-2.2.0-Linux.tar.gz
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 98% confidence
- Finding
The instructions download an archive from the internet and then copy a binary into /usr/local/bin using sudo, granting system-wide availability via a privileged file operation. This is more dangerous than package-manager installation because it bypasses repository trust controls and can expose users to supply-chain risk if the binary or URL is compromised.
- Content
IQ-TREE
wget https://github.com/iqtree/iqtree2/releases/download/v2.2.0/iqtree-2.2.0-Linux.tar.gz tar -xzf iqtree-2.2.0-Linux.tar.gz sudo cp iqtree-2.2.0-Linux/bin/iqtree2 /usr/local/bin/
text ### Issue 2: Python Packages Missing
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The implementation guide extends a scientific phylogeny skill into external Feishu/Lark document creation and media upload, which is outside the stated manifest scope. That scope drift is dangerous because an agent may transmit analysis outputs to a third-party service without the user expecting data egress or having approved an external publication step.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The guide instructs use of
lark-cli, an external platform CLI unrelated to the core scientific analysis function. Introducing an unjustified external tool increases attack surface and creates a path for data exfiltration, credential misuse, or unintended network actions by agents following the instructions mechanically.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The guide tells agents to upload reports and figures to Feishu without any user-facing disclosure that analysis outputs will leave the local environment. This is particularly risky because scientific data, figures, and reports may contain unpublished or sensitive research material, and silent transmission to an external service violates user expectations and can cause confidentiality loss.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script claims to filter for experimentally supported or reviewed sequences, but the
grep ... || cpfallback silently copies the entire unfiltered input when no matches are found. This creates a fail-open integrity flaw: users may believe low-quality or predicted sequences were excluded when they were not, which can contaminate downstream alignments, trees, and biological conclusions without any warning.- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh conda install -c bioconda mafft -y elif [[ "$OS" == "linux" ]] && command_exists apt-get; then echo " Installing via apt..." sudo apt-get install -y mafft elif [[ "$OS" == "mac" ]] && command_exists brew; then echo " Installing via brew..." brew install mafft
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh conda install -c bioconda mafft -y elif [[ "$OS" == "linux" ]] && command_exists apt-get; then echo " Installing via apt..." sudo apt-get install -y mafft elif [[ "$OS" == "mac" ]] && command_exists brew; then echo " Installing via brew..." brew install mafft
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 85% confidence
- Finding
The script downloads an IQ-TREE archive from the internet, extracts it, and then copies the binary into
/usr/local/binwithsudo. Installing a remotely fetched executable with elevated privileges and without checksum or signature verification creates a supply-chain risk: if the download source, transport, or release artifact is compromised, a malicious binary could be placed in a privileged system path.- Content
sh if [[ "$OS" == "linux" ]]; then wget -q https://github.com/iqtree/iqtree2/releases/download/v2.2.0/iqtree-2.2.0-Linux.tar.gz tar -xzf iqtree-2.2.0-Linux.tar.gz sudo cp iqtree-2.2.0-Linux/bin/iqtree2 /usr/local/bin/ || cp iqtree-2.2.0-Linux/bin/iqtree2 ~/.local/bin/ rm -rf iqtree-2.2.0-Linux* echo " ✓ IQ-TREE installed to /usr/local/bin/ or ~/.local/bin/" elif [[ "$OS" == "mac" ]]; then
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 85% confidence
- Finding
This macOS branch downloads a ZIP from GitHub and then uses
sudo cpto placeiqtree2into/usr/local/bin. As with the Linux branch, elevating a downloaded executable into a globally trusted location without verifying authenticity or integrity exposes users to supply-chain compromise and persistent execution of attacker-controlled code.- Content
sh elif [[ "$OS" == "mac" ]]; then wget -q https://github.com/iqtree/iqtree2/releases/download/v2.2.0/iqtree-2.2.0-MacOSX.zip unzip -q iqtree-2.2.0-MacOSX.zip sudo cp iqtree-2.2.0-MacOSX/bin/iqtree2 /usr/local/bin/ || cp iqtree-2.2.0-MacOSX/bin/iqtree2 ~/.local/bin/ rm -rf iqtree-2.2.0-MacOSX* echo " ✓ IQ-TREE installed to /usr/local/bin/ or ~/.local/bin/" else
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The testing instructions direct users to run dependency installation commands on a fresh machine without an explicit warning that these actions modify the local system and may install software from external sources. While common for setup documentation, this can still lead to unintended system changes if users follow the instructions blindly.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The troubleshooting section suggests remediation steps that modify the host system, including package installation and copying binaries into system paths, but does not warn users about the scope of these changes. This increases the chance of accidental system modification during troubleshooting.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This markdown file includes code that saves analysis results to
conservation.csv, which is a file write affecting the user's filesystem. The surrounding skill description does not provide any explicit warning or disclosure that running the documented workflow will create or overwrite local files.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The document instructs users to save several plots as PNG files via
plt.savefig(...), which creates files on disk. There is no nearby warning that the workflow generates output artifacts in the working directory.- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The function says it plots 'distribution of MI scores' and extracts
pair['MI'], but the vertical line at 0.5 is labeled as the 'Strong coevolution threshold'. Earlier in the document, the 0.5 threshold is explicitly defined for NMI, so this inline documentation/labeling contradicts the code's actual metric and could mislead users interpreting results.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
This markdown file documents that the workflow produces multiple output files, including CSV, TXT, JSON, and earlier PNG files, but it does not include any explicit warning that running the example code will write files into the working directory. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors that could affect user data or system state; here the file-creation behavior is disclosed by examples but not clearly warned about.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The skill's overall purpose includes publication-ready visualization, so generating figures is in scope. However, this file also recommends compressing outputs with external CLI tools (
pngquantoroptipng) and provides a bash automation script that invokes multiple Python programs, introducing shell-command execution capability that is not directly necessary for the visualization logic itself.- Content