T08 · Insecure Dependencies
Warning
- Location
SKILL.md:40- Finding
Mandatory Installation of Unpinned Third-Party Packages
- Content
View full analysis
- Remediation
View remediation
Security audit
LobsterBio - Dev
Security checks for vulnerabilities and agentic risk
Overview
This is mostly a legitimate Lobster development guide, but it tells agents to install unpinned packages automatically and includes unsafe API-key setup guidance.
Install only after reviewing the exact Lobster package source/version you intend to use, preferably with pinned dependencies or a lockfile. Do not paste API keys into chat or pass long-lived secrets on command lines; use safer secret handling where available. Treat the skill as suitable for Lobster-specific development, not as a general development assistant trigger.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
references/cli.md:60- Finding
Secret Values Encouraged Through Command-Line Arguments
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
Findings (8)
Instruction Override
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
- Content
--workspace, -w PATH Set workspace directory --model, -m MODEL LLM model to use (default: from config) --verbose, -v Enable verbose output --debug Enable debug mode
text **In-chat commands:**
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
md Options: --global, -g Save config globally (~/.config/lobster/) for all projects --force, -f Overwrite existing configuration --non-interactive Non-interactive mode (for CI/CD and coding agents) --anthropic-key KEY Claude API key (non-interactive) --gemini-key KEY Google Gemini API key (non-interactive)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | Mode | Config | Credentials | |------|--------|-------------| | Workspace (default) | `.lobster_workspace/provider_config.json` | `.env` | | Global (`--global`) | `~/.config/lobster/providers.json` | `~/.config/lobster/credentials.env` (0600) | Agent selection stored in `.lobster_workspace/agents.json`.
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill includes executable shell and Python commands for environment discovery and installation, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates ambiguity about what actions the agent may take and increases the risk of unreviewed file reads or command execution in environments where skill instructions are auto-followed.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases are broad enough to activate on many normal software-development requests such as 'fix bug', 'add feature', 'write tests', or 'contribute'. Over-broad activation can cause the skill to be invoked in unrelated contexts, pulling in strong instructions like forced installation and scaffold requirements that may lead to unnecessary environment changes or mis-scoped actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The CLI documentation explicitly instructs users to pass API keys and cloud credentials as command-line arguments in non-interactive mode, but does not warn that such secrets may be exposed via shell history, process listings, CI logs, or telemetry. In a development/agent-oriented tool, this increases the chance of credential leakage because automation commonly captures command invocations verbatim.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Earlier guidance says system prompts must never duplicate tool information already present in tool docstrings/schemas and explicitly forbids a <Your_Tools> section or duplicate tool listings. The testing requirement at L550 for semantic prompt tests ensuring 'all tools documented by name' conflicts with that documented intent and would push contributors to add the very duplication the file says to avoid.
- Content
Scope Creep
Low
- Category
- Excessive Agency
- Confidence
- 70% confidence
- Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
- Content
md - Importing signal track files (bigWig, bedGraph) as coverage matrices over defined genomic windows - Importing fragment files from assays that produce per-read coordinate data (e.g., ATAC-seq fragments) These illustrate that IMPORT is not limited to count matrices — any domain-specific file format that needs parsing into the internal AnnData representation is an IMPORT tool. **Boundary with `data_expert`:** Lobster's `data_expert` agent (in core) already handles generic file loading via `load_modality(adapter="...")` and database downloads via `execute_download_from_queue`. Your domain IMPORT tools should only handle **formats requiring domain expertise to parse** (vendor-specific outputs, domain-specific file structures with scientific defaults). Do not duplicate generic CSV/H5AD loading — that is `data_expert`'s job. See `creating-agents.md` → "Data Loading Boundary" for the full decision rule.
Static analysis
No suspicious patterns detected.