mirna-target-tools

• Outcome: Review
• Latest audit: Sep 2, 2026 · 2:21 PM UTC
• Version: 1.0.4

Overview

The skill mostly matches its bioinformatics purpose, but its optional installer makes high-impact system changes and installs downloaded software with root privileges.

Review before installing. Prefer manually installing dependencies or running the installer in an isolated environment, because it can make system-wide changes with sudo and install code downloaded from GitHub. Treat gene lists and miRNA identifiers as data that may be sent to MyGene.info or g:Profiler, and verify merged outputs by checking the FoundInBoth column before using results as high-confidence intersections.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (25)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The implemented code only covers downstream annotation and enrichment analysis of a provided gene list. While GO/KEGG enrichment is consistent with the description, key declared capabilities are absent: there is no TargetScan or miRanda-based target prediction logic, and no Cytoscape network generation/export. Additionally, the code relies on MyGene.info and g:Profiler web services, which is a material implementation/resource difference from the named tools in the description. Therefore, the declared description overstates and partly misrepresents the actual behavior.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: 声明的核心用途是“miRNA 靶基因预测与注释分析”，应围绕靶基因识别、功能富集和网络构建展开。但该代码文件的主功能完全不同，聚焦于 miRNA 成熟序列在多物种间的保守性分析。它会访问 miRBase 下载 mature.fa，提取同源序列，做 Needleman-Wunsch 比对和 progressive MSA，计算 Shannon 信息量、identity、coverage，并生成 logo 和 alignment 图。以上行为与靶基因预测/注释分析并不相符，属于 materially different primary purpose；同时包含未声明的网络访问资源（miRBase）和一组未声明的分析能力。因此应判定为描述与代码行为不匹配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The code chunk is narrowly focused on invoking the external miRanda tool and parsing its output. That partially matches the declared description's miRanda prediction component, but the broader declared workflow also claims TargetScan prediction, GO/KEGG enrichment, and Cytoscape network construction, none of which are implemented in this supplied code. There are no suspicious undeclared capabilities beyond subprocess execution of miRanda and local file I/O, which are consistent with the prediction task. Because the declared description substantially overstates what this code chunk actually does, this should be flagged as a description-behavior mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The declared description presents a broader bioinformatics workflow: miRNA target prediction, functional annotation/enrichment, and Cytoscape network building. However, the provided code chunk is a standalone plotting utility that visualizes already-generated enrichment results from a TSV file. It does not run TargetScan or miRanda, does not compute enrichment itself, and does not construct any Cytoscape-compatible network. While plotting enrichment results is related to annotation analysis, the actual behavior is only a narrow visualization step and materially underdelivers relative to the declared primary purpose.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The code’s primary function is narrowly limited to invoking TargetScan and optionally parsing its results. This partially matches the declared description’s TargetScan component, but the broader declared workflow promises multiple additional analysis capabilities—miRanda, GO/KEGG enrichment, and Cytoscape network building—that are absent from the provided code. There are no suspicious undeclared capabilities beyond executing the external TargetScan tool and reading/writing local files, which are consistent supporting behaviors. Because the declared description materially overstates the implemented functionality in this code chunk, this should be flagged as a mismatch.

Ae1

High

• Category: analysis-evasion

Content

使用脚本：`scripts/annotate_targets.py`

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill advertises scripts that read and write files, invoke shell-accessed external tools, and call online services, but the manifest does not declare any explicit tool scope or permissions. That makes the skill's runtime capabilities opaque to users and policy enforcement, increasing the chance of unintended file access, command execution, or network egress without informed consent.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill states that annotation and conservation features use online APIs and remote sequence retrieval, but it does not clearly warn users that their gene lists, miRNA identifiers, or related analysis inputs will be transmitted to third-party services. In bioinformatics settings, these inputs may be unpublished or sensitive research data, so undisclosed network egress creates confidentiality and compliance risk.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest describes miRNA target gene prediction and annotation analysis using TargetScan/miRanda, GO/KEGG enrichment, and Cytoscape network construction. This section documents an additional independent function for multi-species miRNA conservation analysis, including downloading miRBase data, alignment, and sequence-logo generation, which is a distinct analytical workflow not covered by the stated description.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution

Content

print("\nChecking required Python packages...")
    for pkg in required_packages:
        try:
            __import__(pkg)
            print(f"✅ {pkg} installed")
        except ImportError:
            print(f"❌ {pkg} not installed")

• Confidence: 75% confidence
• Finding: Dynamic __import__() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution

Content

print("\nChecking required Python packages...")
    for pkg in required_packages:
        try:
            __import__(pkg)
            print(f"✅ {pkg} installed")
        except ImportError:
            print(f"❌ {pkg} not installed")

• Confidence: 75% confidence
• Finding: Dynamic __import__() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The module docstring and implementation are centered on extracting homologous mature miRNA sequences, performing multiple sequence alignment, calculating conservation metrics, and generating sequence-logo/alignment plots. This does not implement the manifest's stated capabilities of TargetScan/miRanda target prediction, GO/KEGG enrichment, or Cytoscape network construction, indicating a semantic mismatch between declared skill purpose and actual behavior.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

cd miRanda-3.3a
    ./configure
    make
    sudo make install
    cd /tmp
    rm -rf miRanda-3.3a.tar.gz miRanda-3.3a

• Confidence: 80% confidence
• Finding: Running 'sudo make install' on software fetched from a remote GitHub archive introduces risk because unreviewed build/install scripts execute with elevated privileges. If the upstream archive, release asset, or build system is compromised, this can lead to arbitrary root-level code execution and persistence on the host.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

cd miRanda-3.3a
    ./configure
    make
    sudo make install
    cd /tmp
    rm -rf miRanda-3.3a.tar.gz miRanda-3.3a

• Confidence: 80% confidence
• Finding: Running 'sudo make install' on software fetched from a remote GitHub archive introduces risk because unreviewed build/install scripts execute with elevated privileges. If the upstream archive, release asset, or build system is compromised, this can lead to arbitrary root-level code execution and persistence on the host.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

cd miRanda-3.3a
    ./configure
    make
    sudo make install
    cd /tmp
    rm -rf miRanda-3.3a.tar.gz miRanda-3.3a

• Confidence: 80% confidence
• Finding: Running 'sudo make install' on software fetched from a remote GitHub archive introduces risk because unreviewed build/install scripts execute with elevated privileges. If the upstream archive, release asset, or build system is compromised, this can lead to arbitrary root-level code execution and persistence on the host.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

cd miRanda-3.3a
    ./configure
    make
    sudo make install
    cd /tmp
    rm -rf miRanda-3.3a.tar.gz miRanda-3.3a

• Confidence: 80% confidence
• Finding: Running 'sudo make install' on software fetched from a remote GitHub archive introduces risk because unreviewed build/install scripts execute with elevated privileges. If the upstream archive, release asset, or build system is compromised, this can lead to arbitrary root-level code execution and persistence on the host.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

cd miRanda-3.3a
    ./configure
    make
    sudo make install
    cd /tmp
    rm -rf miRanda-3.3a.tar.gz miRanda-3.3a

• Confidence: 80% confidence
• Finding: Running 'sudo make install' on software fetched from a remote GitHub archive introduces risk because unreviewed build/install scripts execute with elevated privileges. If the upstream archive, release asset, or build system is compromised, this can lead to arbitrary root-level code execution and persistence on the host.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

cd miRanda-3.3a
    ./configure
    make
    sudo make install
    cd /tmp
    rm -rf miRanda-3.3a.tar.gz miRanda-3.3a

• Confidence: 80% confidence
• Finding: Running 'sudo make install' on software fetched from a remote GitHub archive introduces risk because unreviewed build/install scripts execute with elevated privileges. If the upstream archive, release asset, or build system is compromised, this can lead to arbitrary root-level code execution and persistence on the host.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The script and its docstring promise a high-confidence intersection of TargetScan and miRanda results, but later logic silently falls back to outputting the union when no overlap exists. In a bioinformatics analysis pipeline, this can mislead downstream users into treating low-confidence, single-tool predictions as validated-by-both results, causing integrity and reproducibility issues.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The '--only-intersection' argument suggests configurable behavior, but the code never uses the flag and may still emit the union when no intersection exists. This creates deceptive and non-deterministic pipeline behavior, where callers may believe they are enforcing strict overlap filtering while actually receiving weaker results.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print(f"Running miRanda with command: {' '.join(cmd)}")
    
    try:
        result = subprocess.run(cmd, capture_output=True, text=True)
        if result.returncode != 0:
            print(f"Error running miRanda:\n{result.stderr}")
            return False

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print(f"Running miRanda with command: {' '.join(cmd)}")
    
    try:
        result = subprocess.run(cmd, capture_output=True, text=True)
        if result.returncode != 0:
            print(f"Error running miRanda:\n{result.stderr}")
            return False

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Missing User Warnings

Low

• Confidence: 93% confidence
• Finding: The README documents auto-download of miRBase data and use of the g:Profiler REST API, but it does not present a prominent user warning that running enrichment and conservation features will initiate outbound network connections and fetch external data. In a bioinformatics pipeline this is usually expected behavior, but lack of explicit disclosure can create security, privacy, and reproducibility issues in restricted or air-gapped environments and may surprise users handling sensitive datasets.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: This markdown file presents all instructions, headings, and operational guidance exclusively in Chinese. Under the policy rule for natural-language violations, forcing a specific language without offering the user a choice or documenting a justified locale constraint is a reportable issue.

Natural-Language Policy Violations

Low

• Confidence: 96% confidence
• Finding: The module docstring, usage guidance, and user-facing descriptions are written entirely in Chinese, and later CLI help/error/output strings follow the same pattern. For a general-purpose analysis script, this imposes a specific language/locale on users without opt-in or justification, which matches the language-policy concern in SQP-3.

Static analysis

No suspicious patterns detected.