Security audit
Security checks for vulnerabilities and agentic risk
The skill is a real miRNA analysis toolkit, but its dependency installer can make system-wide changes and build downloaded third-party code without strong upfront warnings or integrity checks.
Review and preferably run the analysis in a conda/container environment. Avoid running scripts/install_dependencies.sh on a sensitive host unless you accept sudo package changes and an unverified source build; preinstall miRanda/RNAhybrid/TargetScan from trusted package managers when possible. Do not submit unpublished or sensitive gene lists/sequences to the online annotation/enrichment features unless third-party API disclosure is acceptable.
If the real behavior centers on environment/dependency installation rather than the documented biological analysis, the skill can cause users or agents to execute shell commands under false expectations. That mismatch matters because setup actions often have broader filesystem and network impact than the user intended to authorize.
If the real behavior centers on environment/dependency installation rather than the documented biological analysis, the skill can cause users or agents to execute shell commands under false expectations. That mismatch matters because setup actions often have broader filesystem and network impact than the user intended to authorize.
If the real behavior centers on environment/dependency installation rather than the documented biological analysis, the skill can cause users or agents to execute shell commands under false expectations. That mismatch matters because setup actions often have broader filesystem and network impact than the user intended to authorize.
If the real behavior centers on environment/dependency installation rather than the documented biological analysis, the skill can cause users or agents to execute shell commands under false expectations. That mismatch matters because setup actions often have broader filesystem and network impact than the user intended to authorize.
If the real behavior centers on environment/dependency installation rather than the documented biological analysis, the skill can cause users or agents to execute shell commands under false expectations. That mismatch matters because setup actions often have broader filesystem and network impact than the user intended to authorize.
If the real behavior centers on environment/dependency installation rather than the documented biological analysis, the skill can cause users or agents to execute shell commands under false expectations. That mismatch matters because setup actions often have broader filesystem and network impact than the user intended to authorize.
If the real behavior centers on environment/dependency installation rather than the documented biological analysis, the skill can cause users or agents to execute shell commands under false expectations. That mismatch matters because setup actions often have broader filesystem and network impact than the user intended to authorize.
If the real behavior centers on environment/dependency installation rather than the documented biological analysis, the skill can cause users or agents to execute shell commands under false expectations. That mismatch matters because setup actions often have broader filesystem and network impact than the user intended to authorize.
If the real behavior centers on environment/dependency installation rather than the documented biological analysis, the skill can cause users or agents to execute shell commands under false expectations. That mismatch matters because setup actions often have broader filesystem and network impact than the user intended to authorize.
Referenced artifact was not completely inspected
Script: `scripts/predict_targets_genome.py`
Referenced artifact was not completely inspected
Script: `scripts/predict_targets_genome.py`
Referenced artifact was not completely inspected
Script: `scripts/predict_targets_genome.py`
Referenced artifact was not completely inspected
Script: `scripts/predict_targets_genome.py`
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
cat <<'EOF'
No conda/mamba found. Install R with your system package manager, e.g.:
Ubuntu/Debian : sudo apt-get update && sudo apt-get install -y r-base r-base-dev
macOS (brew) : brew install r
Fedora : sudo dnf install -y R R-devel
The skill advertises and documents capabilities that involve shell execution, file read/write, and network access, but it does not declare any explicit tool scope such as permissions or allowed-tools. In an agent setting, this weakens least-privilege controls and makes it harder for reviewers or runtime policy to constrain potentially risky operations like package installation, downloads, and writing to cache or output paths.
The skill explicitly describes automatic downloads and use of external services such as miRBase, RNAcentral, MyGene.info, g:Profiler, and Ensembl, but it does not warn users that submitted miRNA names, sequences, or gene lists may be transmitted off-host. In research and biomedical settings, even seemingly non-PII inputs can be sensitive or embargoed, so silent outbound transmission creates a real privacy and compliance risk.
The workflow explicitly states that gene annotation and enrichment use MyGene.info and g:Profiler online APIs, but it does not clearly warn users that submitted gene lists and species selections are transmitted to external services. In a bioinformatics setting, input datasets may be unpublished or sensitive, so omitting an explicit disclosure can lead to unintended data exposure.
The manifest advertises built-in support for human, mouse, rat, sheep, goat, cow, pig, and chicken, but this script's species map only supports human, mouse, rat, sheep, goat, and cow. In addition, the module docstring and CLI help repeat the narrower set, so the implemented behavior does not fully match the stated built-in species coverage.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
if shutil.which('Rscript') is None:
return False, 'Rscript not found on PATH'
try:
proc = subprocess.run(['Rscript', '-e', 'cat(R.version.string)'],
capture_output=True, text=True, timeout=180)
version = proc.stdout.strip() or 'version unknown'
except Exception as exc:
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
return False, 'Rscript failed: %s' % exc
check = ' && '.join('requireNamespace("%s", quietly=TRUE)' % p for p in R_PLOT_PKGS)
try:
proc = subprocess.run(['Rscript', '-e', 'cat(%s)' % check],
capture_output=True, text=True, timeout=240)
ok = proc.stdout.strip().upper().startswith('TRUE')
except Exception:
Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.
print("\nPython packages:")
for pkg in required_packages:
try:
__import__(pkg)
print(" OK %s (required)" % pkg)
except ImportError:
print(" MISSING %s (required)" % pkg)
Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.
print("\nPython packages:")
for pkg in required_packages:
try:
__import__(pkg)
print(" OK %s (required)" % pkg)
except ImportError:
print(" MISSING %s (required)" % pkg)
This subprocess call executes an external Rscript program from PATH and passes user-controlled values such as --outdir and --prefix into another script. Although it does not use shell=True, so classic shell injection is reduced, it still creates a trust boundary issue: a malicious or trojanized Rscript on PATH, or unsafe downstream handling in plot_conservation.R, could lead to arbitrary code execution in the tool's context. In a scientific analysis skill that may run on shared workstations or automation hosts, invoking external interpreters increases the attack surface beyond pure Python processing.
'--outdir', outdir, '--prefix', prefix,
'--seed-start', str(seed_start), '--seed-end', str(seed_end)]
print(" drawing figures with R (ggplot2) ...")
return subprocess.call(cmd) == 0
def run_conservation(records, names, seed_start, seed_end, outdir, prefix,
The script immediately performs privileged package-management actions with sudo, modifying the host system, but does not explicitly warn the user that it requires elevated privileges and will make system-wide changes. This increases the chance of unsafe execution in environments where users may not expect host modification or may run the script with excessive trust.
The script fetches a source archive from the network, extracts it, builds it, and installs it without any integrity verification or explicit warning that it is executing third-party code on the host. If the upstream repository, release artifact, or transport path were compromised, this could lead to arbitrary code execution during configure/make/install.