ClawHub
Back to skill

Security audit

Protein Sequence Qc Pro

Security checks across malware telemetry and agentic risk

Overview

This looks like a real protein-analysis workflow, but it is too tied to one hard-coded local research environment and does not match its advertised generic command-line usage.

Review before installing. Only use this in a disposable or well-understood workspace, and expect to edit the scripts before running them on your own data. The skill should be parameterized to require explicit input and output paths, remove hard-coded /root/autodl-tmp locations, and replace shell=True command strings with safer argument-list subprocess calls.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
log(f"开始: {description}")
    log(f"命令: {cmd}")
    
    result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
    
    if result.returncode != 0:
        log(f"❌ 失败: {description}")
Confidence
91% confidence
Finding
result = subprocess.run(cmd, shell=True, capture_output=True, text=True)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill advertises and instructs use of shell commands, file reads, and file writes, but declares no permissions or trust boundaries. That creates a real security issue because the runtime may execute filesystem and shell-capable actions without explicit user-visible consent or policy review, increasing the chance of unintended command execution or modification of local data.

Tp4

High
Category
MCP Tool Poisoning
Confidence
81% confidence
Finding
The documented behavior does not fully match the described purpose: it appears to include undeclared IR08-specific operations, mutation-priority outputs, fixed absolute local paths, and a top-level script whose behavior differs from what the documentation claims. This is dangerous because hidden or environment-specific behavior reduces auditability and can cause the skill to access unintended local files, mislead users about what will run, or produce unsafe assumptions in automated execution pipelines.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.