LobsterBio - Use

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:44 PM UTC
• Version: 1.0.1

Overview

The skill is a coherent Lobster bioinformatics guide, but its setup instructions recommend executing unverified remote installers directly in the user's shell.

Review the installer path before installing. Prefer a verified, version-pinned package-manager install in an isolated non-admin environment, avoid curl | bash or irm | iex unless you trust and inspect the installer, and be aware that Lobster may store API keys, download datasets, and create analysis outputs in local workspaces.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:34

Finding

Unverified Remote Installer Executed Directly by a Unix Shell

Content

View full analysis

Remediation

View remediation

' ``` 3. If a standalone installer is required: - Publish immutable, version-specific installer URLs. - Download the installer to a local file rather than piping it to a shell. - Publish and verify a pinned SHA-256 digest. - Cryptographically sign releases and verify the publisher signature. - Allow the user to inspect the downloaded script before execution. 4. Explicitly instruct users not to run the installer as root or through `sudo`. 5. Pin and review dependencies installed by the script. 6. Document the authoritative publisher, registry, signing key, and release verification process. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:39

Finding

Unverified Remote Installer Executed Directly by PowerShell

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:44

Finding

Unpinned Executable Packages and Broad Optional Dependency Sets

Content

View full analysis

Remediation

View remediation

' ``` 2. Maintain a lockfile or constraints file that pins transitive dependencies. 3. Require package hashes where supported, such as a hash-locked requirements file used with `pip --require-hashes`. 4. Avoid the `full` extra by default; install only the packages needed for the requested analysis. 5. Document the authoritative package registry and verified publisher identity. 6. Review dependency changes before upgrades and avoid automatic installation of newly released versions. 7. Perform installations in an isolated, non-administrative environment. 8. Add provenance, signature, and software bill of materials information for reviewed releases. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (14)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The skill instructs users to execute a remote installer by piping network content directly into a shell. This is dangerous because any compromise of the hosting domain, CDN, TLS termination point, or installer script would result in arbitrary code execution on the user's machine with the user's privileges.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

macOS / Linux

bash

curl -fsSL https://install.lobsterbio.com | bash

Windows (PowerShell)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The command chains a remote fetch directly into bash, removing the user's opportunity to review the script before execution and magnifying the risk of command injection or supply-chain compromise. In a skill document, this is especially risky because users may copy-paste the command as authoritative guidance.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

macOS / Linux

bash

curl -fsSL https://install.lobsterbio.com | bash

Windows (PowerShell)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The command curl -fsSL https://install.lobsterbio.com | bash fetches an external script and executes it immediately, creating a direct arbitrary-code-execution path if the remote source or delivery channel is compromised. The skill context makes this more dangerous because users may copy commands from the reference verbatim during setup, increasing likelihood of unsafe execution.

Content

Scanner excerpt · references/cli-commands.md (reported line 11)May include surrounding context.

md

| Platform | Command |
|----------|---------|
| macOS / Linux | `curl -fsSL https://install.lobsterbio.com \| bash` |
| Windows (PowerShell) | `irm https://install.lobsterbio.com/windows \| iex` |
| Manual (any) | `uv tool install 'lobster-ai[full,anthropic]' && lobster init` |
| pip (any) | `pip install 'lobster-ai[full]' && lobster init` |

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/cli-commands.md (reported line 36)May include surrounding context.

bash

lobster init                    # Workspace setup (interactive)
lobster init --global           # Global defaults
lobster init --force            # Overwrite existing config

Starting Lobster

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/cli-commands.md (reported line 112)May include surrounding context.

md

| `/data` | Current dataset info (shape, columns, stats) |
| `/plots` | List generated visualizations |
| `/save` | Save current session state |
| `/clear` | Clear conversation history |

### Analysis Commands

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The listed trigger phrases include generic terms such as "cluster," "single-cell," "RNA-seq," and "bioinformatics" without constraints or exclusion conditions. In a markdown skill description, such broad phrases can cause unintended invocation because they match common domain discussion rather than a clearly bounded request to use this skill.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill manifest frames this capability as RNA-seq and related biological data analysis, but the agent reference file advertises additional premium domains including proteomics, genomics, and general ML. This scope expansion can cause unsafe over-delegation or user/operator confusion about what the skill is authorized to do, increasing the chance that unrelated or higher-risk analyses are attempted under this skill's trust boundary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation recommends piping remote content directly into a shell (curl | bash and irm | iex), which executes unreviewed code from the network with the user's privileges. If the hosting domain, TLS path, or published installer is compromised, users could run arbitrary code without an opportunity to inspect it first.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file states the agent is selected via "automatic routing" but does not define the trigger scope, exclusion conditions, or example non-triggers. Because the document also contains many generic commands like "show" and "create," the activation boundary is unclear and could cause unintended invocation for ordinary visualization-related requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This markdown file explains that the skill uses a default workspace and creates output files, and elsewhere instructs users to download GEO data, but it does not provide a clear warning that using the skill may write files locally and fetch external datasets. Because markdown files should warn about behaviors affecting user data or system state, an explicit disclosure is missing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Documenting lobster init --force as an overwrite operation without a warning can cause users to unintentionally destroy or replace existing configuration. While this is not code execution, it can lead to loss of settings, broken environments, or accidental reconfiguration of sensitive defaults.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly instructs users to download GEO/SRA datasets but gives no warning that these actions create local files and may consume substantial disk space or bandwidth. In a data-analysis skill this is not a code-execution issue, but it can still cause unintended local writes, storage exhaustion, or confusion about where sensitive or large research data is being placed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The end-to-end workflow includes a step to "Download that dataset" without warning the user that local file creation will occur as part of the workflow. Because this appears in a guided sequence, users are more likely to trigger downloads implicitly, increasing the chance of unexpected disk usage or writes in the current workspace.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This is a markdown file, so SQP-2 applies to omissions in user-facing warnings. The workflow instructs users to export marker genes, export a notebook, and save the session, but it does not mention that these actions create persisted artifacts that may contain sensitive biological data or analysis results.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.