Drug Team

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:57 PM UTC
• Version: 1.0.0

Overview

The skill mostly matches its drug-design purpose, but it can silently create fabricated persistent lab inventory data and has overly broad triggers that may run the workflow unexpectedly.

Review this skill before installing in any real research or lab environment. It may send molecule and target search terms to Google Patents, and its stock-check path can create fake persistent inventory data if the expected inventory file is missing. Use only in an isolated workspace with non-production inventory data unless those behaviors are fixed.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/orchestrate.py:153

Finding

Cross-Skill Inventory Modification with Fabricated Persistent Data

Content

View full analysis

Vulnerability Details

File Location: scripts/orchestrate.py, lines 153-158
Vulnerability Type: Cross-skill state modification and least-privilege violation
Risk Level: Medium

Vulnerable Code:

python

# Assume stock.csv in lab-inventory
stock_path = os.path.join(LAB_INVENTORY_DIR, 'stock.csv')
# Create dummy if not exists? For testing.
if not os.path.exists(stock_path):
    with open(stock_path, 'w') as f:
        f.write('reagent,quantity,unit,price\nacid,5,g,10.0\n')

Technical Analysis

When stock checking is enabled and stock.csv does not exist, the orchestrator creates a fabricated inventory file inside the separate lab-inventory Skill directory. This crosses the expected boundary between consuming another Skill and modifying its persistent data.

The behavior is not necessary to perform a read-only inventory check and is not disclosed in SKILL.md. The generated record is treated as real stock even though it is explicitly dummy test data. Because the file remains after execution, it can affect later runs and other components that share the same inventory directory.

Exploitation requires the process to have write access to the sibling Skill directory and the inventory file to be absent. No privilege elevation at the operating-system level occurs; the issue is an abuse of already granted filesystem access beyond the orchestrator's legitimate task requirements.

Attack Path

1. An attacker or user invokes the Skill with a query containing check stock.
2. The sibling lab-inventory/stock.csv file is absent, removed, or renamed.
3. check_inventory() writes a new persistent stock.csv into the sibling Skill directory.
4. The new file falsely records five grams of acid as available inventory.
5. The current run or later inventory operations consume the fabricated record.
6. Candidate feasibility, reagent availability, and cost calculations may consequently be based on ...[truncated 696 chars]

Remediation

View remediation

Remediation Suggestions

• Remove all logic that creates dummy inventory in the sibling Skill directory.
• Treat a missing inventory file as an explicit configuration or operational error.
• Keep test fixtures in test-only directories and ensure production code cannot activate them.
• Require an explicitly configured inventory path rather than deriving and modifying another Skill's installation directory.
• Open the configured inventory in read-only mode for stock checks.
• If generated state is genuinely required, place it in an isolated per-run workspace with restrictive permissions and delete it after use.
• Validate the inventory schema and provenance before using records for availability or cost calculations.
• Separate application code, immutable Skill assets, and mutable operational data through filesystem permissions.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/orchestrate.py:192

Finding

Predictable Output Files Permit Symlink-Based File Overwrite and Cross-Run Interference

Content

View full analysis

Vulnerability Details

File Locations: scripts/orchestrate.py, lines 136-138, 192-200, and 224-227
Vulnerability Type: Unsafe temporary and output file handling
Risk Level: Medium

Vulnerable Code:

python

route_path = os.path.join(temp_dir, 'route.json')
with open(route_path, 'w') as f:
    json.dump(plan, f)

python

results = []
temp_dir = 'temp'
os.makedirs(temp_dir, exist_ok=True)
viz_dir = 'viz'
os.makedirs(viz_dir, exist_ok=True)

# Patent scout step
candidates_path = os.path.join(temp_dir, 'candidates.json')
with open(candidates_path, 'w') as f:
    json.dump([{"smiles": s} for s in cands], f)

python

mol = Chem.MolFromSmiles(smiles)
img_path = f"viz/cand_{i}.png"
if mol:
    MolToFile(mol, img_path)

Technical Analysis

The Skill stores intermediate and visualization data under fixed relative directories and predictable filenames. Files are opened with ordinary write semantics, which truncate existing files and follow symbolic links. The code does not create a private per-run temporary directory, validate file ownership, reject symbolic links, use exclusive creation, or protect concurrent executions.

temp/route.json is additionally reused for every candidate in a run. The same paths are shared across independent executions launched from the same working directory.

If an attacker can prepare entries in the working directory, they can create symbolic links at predictable output paths. When the Skill runs with an account capable of writing to the symlink target, generated JSON or image content will overwrite that target. Concurrent executions can also replace each other's intermediate route and candidate data, causing integrity failures even without a malicious actor.

Attack Path

1. The attacker obtains write access to the directory from which the Skill will execute, or to an existing shared temp or viz directory.
2. The attacker crea ...[truncated 1340 chars]

Remediation

View remediation

Remediation Suggestions

• Create an isolated workspace for each execution with tempfile.TemporaryDirectory().
• Use absolute paths rooted in that private workspace rather than process-relative temp and viz paths.
• Generate unique filenames for every candidate and every run.
• Apply restrictive directory permissions so untrusted users cannot pre-create or replace entries.
• Reject pre-existing symbolic links and non-regular files before writing.
• Where supported, open sensitive files with exclusive and no-follow semantics, such as O_CREAT | O_EXCL | O_NOFOLLOW.
• Write to a newly created temporary file and atomically rename it into place after validation.
• Avoid reusing route.json; assign each candidate a separate route path.
• Validate the type, ownership, and resolved location of files returned by sibling tools before opening or moving them.
• Add synchronization or run isolation so concurrent executions cannot consume each other's intermediate files.
• Permit user-visible output to be copied from the private workspace only to an explicitly configured and validated destination.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Several listed triggers, including terms like "drug design," "patent," or "design molecule," are ambiguous and may match benign or unrelated user requests. In this context, accidental activation is more concerning because the skill orchestrates specialized agents for chemical design, synthesis planning, toxicity review, and patent scouting, which could expose high-risk capabilities without sufficiently precise user intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list includes generic terms like "patent," "novelty," and "prior art," which are broad enough to activate this skill outside a drug-design context. Because this skill launches an orchestrator that coordinates multiple agents and external tooling, unintended activation could invoke chemistry, synthesis, and patent-search workflows in irrelevant conversations, increasing the chance of unsafe or unnecessary actions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The comment suggests harmless testing behavior, but the implementation mutates the actual LAB_INVENTORY_DIR/stock.csv path. That mismatch is dangerous because reviewers or operators may underestimate the side effect, while the code persists fabricated inventory data into what appears to be a real system location.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code writes directly to the shared lab-inventory path when stock.csv does not exist, creating or modifying persistent local inventory data without user consent. In an orchestrator that chains multiple tools, this side effect can silently alter downstream behavior, pollute operational data, and mask missing-inventory conditions by injecting fake stock.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill creates/modifies inventory data without any disclosure, prompt, or audit signal to the user. In this chemistry/lab context, hidden mutation of stock records is more dangerous because users may rely on inventory outputs for purchasing, planning, or safety decisions, and the silent write can distort those decisions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script sends user-derived patent search terms, including molecule identifiers such as SMILES strings and candidate names, to Google Patents over the network without any notice, consent prompt, or data-sensitivity warning. In this skill context, those terms may represent confidential research compounds or project directions, so external transmission can leak proprietary information to a third party and create privacy or trade-secret exposure.

Content

No source excerpt is available for this finding.