SynBO (Synthetic Bayesian Optimization)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:52 AM UTC
• Version: 0.1.1

Overview

The skill mostly matches a chemistry optimization workflow, but its installation and persistence instructions rely on mutable external code and make local changes with limited safeguards.

Review this skill before installing. Use pinned and verified installers/packages where possible, avoid running the installer from an elevated shell, inspect any conda init changes to shell startup files, and confirm exact file paths before allowing it to write or overwrite proprietary reaction data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: reference/installation.md:13

Finding

Unpinned Dependencies and Unverified Remote Installer Execution

Content

View full analysis

Remediation

View remediation

miniconda.sh" | sha256sum --check - ``` 3. Prefer official publisher distribution locations unless the mirror is an explicitly trusted organizational requirement. 4. Pin exact, reviewed versions of `qspoc`, `synbo`, and their transitive dependencies. 5. Use a lockfile or requirements file containing cryptographic hashes, and install with hash enforcement: ```bash python -m pip install --require-hashes -r requirements.lock ``` 6. Build and test dependencies in an isolated environment before use. Consider maintaining an internally reviewed package mirror. 7. Separate downloading from execution and require explicit user confirmation after displaying the source, version, and successful integrity check. 8. Avoid automatically running `conda init`. Document its shell-configuration effects and obtain explicit consent before modifying startup files. 9. Run installation and scientific workloads as a non-privileged user, and do not use `sudo` or an administrator shell. 10. Periodically review pinned versions for security updates and update the lockfile through a controlled dependency-review process. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The code largely aligns with the general domain and primary purpose: it uses the synbo package to initialize reaction optimization for chemical experiments by loading settings, descriptors, reaction space, and producing suggested initial samples. However, the declared description claims broader capabilities such as downloading recommended conditions and uploading results. This code chunk performs neither; it only saves results locally. That is a material mismatch for claimed capabilities, though the core optimization purpose is consistent. Additionally, the script depends on args.project_dir but does not define a --project-dir argument in parse_arguments, which suggests an inconsistency in the implemented behavior versus its stated usage/workflow.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill directs the agent to immediately write or update config.json after receiving user input, without requiring explicit confirmation that files will be created or overwritten on disk. In an agentic environment, silent persistence can modify local state unexpectedly, overwrite prior configuration, or place sensitive project paths into skill-local files without adequate user awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill instructs immediate saving of optimization settings into optimization_settings.json with a strict schema, but does not warn the user that an existing project file may be created or overwritten. This can corrupt project state, replace prior experimental settings, or persist untrusted user-provided content in a way the user did not explicitly approve.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill mandates saving all user-provided reaction-space data into files under project_wd/rxn_space without explicit disclosure that chat-provided chemical data will be written to disk. In this chemistry context, the data may be proprietary or sensitive R&D information, so silent persistence increases confidentiality and integrity risk even though it is not overtly malicious.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The guide instructs users to download an installer script with curl and execute it with bash, effectively running third-party code obtained over the network. Even though the source appears to be a well-known mirror, this pattern is dangerous because compromise of the mirror, transport, or referenced artifact could lead to arbitrary code execution on the user's system.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The instructions run conda init zsh and source the shell rc file, which persistently modifies the user's startup configuration without clearly warning about that side effect. While common in installation guides, hidden persistence changes can surprise users, alter future shell behavior, and create a foothold for broader environment manipulation if users do not understand what is being changed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The Linux instructions use conda init bash followed by sourcing ~/.bashrc, which changes persistent shell startup behavior without disclosure. In a developer setup this is often legitimate, but undocumented modifications to login scripts reduce transparency and can normalize running commands that permanently alter the user's environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The instruction to send the generated Excel file directly to the user creates a real data-handling risk because the file may contain sensitive reaction data, project identifiers, prior results, or proprietary experimental context. In a chemistry optimization workflow, exported recommendation files can easily include confidential research information, so distributing them without an explicit review, minimization, or sanitization step may expose sensitive project data.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The module docstring instructs users to run the script with --project-dir examples, but parse_arguments() never adds a --project-dir argument. The implementation later accesses args.project_dir, so the documented invocation contradicts the actual CLI behavior and would fail at runtime.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The argument definition sets default="lhs", but the help string says the default is kmeans. This is an active contradiction in inline documentation about what behavior users should expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This code creates a results directory and saves CSV and Excel output files, which is a file-write operation covered by the warning requirement for code files. Although progress is printed, the script does not clearly disclose before execution that it will create or overwrite result artifacts in the project directory, and the top-level docstring does not warn about this side effect.

Content

No source excerpt is available for this finding.