ClawHub
Back to skill

Security audit

dnasp

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local population-genetics analysis tool whose file access and output behavior are disclosed and aligned with its purpose.

Install only if you are comfortable with the tool copying supplied sequence, VCF, population, and HKA input files into the chosen output directory for reproducibility. Keep outputs private when working with sensitive or identifiable genetic data, and run it in a normal project sandbox with a fresh output folder.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (12)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
─────────────────────────────────────────
# Demo data
# ─────────────────────────────────────────────────────────────────────────────

DEMO_FASTA = """\
>pop1_seq1
TTTTATCATGATAATAAAGAACAATGTATTATCATAGCTGGTCCTACTGTTTTGCTTTCTCGTATGTGGTTTTATCATGATAATAAAGAACAATGTATTATCATAGCTGGTCCTACTGTTTTGCTTTCTCGTATGTGGTTTTATCATGATAATAAAGAACAATGTATTATCATAGCTGGTCCTACTGTTTTGCTTTCTCGTATGTGGTTTTATCATGATAATAAAGAACAATGTATTATCATAGCTGGTCCTACTGTTTTGCTTTCTCGTATGTGGGCTGGTACTGTTTTTAAAGAATCT
>pop1_seq2
TTTTATCATGATAATAAAGAACAATGTATTATCATAGCCGGTCCTACTGTTTTGCTTTCTCGTATGTGGTTTTATCATGATAATAAAGAACAATGTATTATCATAGCTGGTCCTACTGTTTTGCTTTCTCGTATGTGGTTTTATCATGATAATAAAGAACAATGTATTATCATAGCTGGTCCTACTGTTTTGCTTTCTCGTATGTGGTTTTATCATGATAATAAAGAACAATGTATTATCATAGCTGGTCCTACTGTTTTGCTTTCTCGTATGTGGGCTGGTACTGTT
Confidence
80% confidence
Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill declares it can execute a Python CLI that reads user-supplied files, writes outputs, and invokes shell-like execution, but it does not constrain or document those capabilities with an explicit tool scope. In an agent environment, missing permission boundaries can let the agent use this skill more broadly than intended, increasing the risk of arbitrary file access or command execution if the runtime does not enforce isolation separately.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding
Suspicious Unicode normalization or mixed-script content

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding
Suspicious Unicode normalization or mixed-script content

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding
Suspicious Unicode normalization or mixed-script content

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding
Suspicious Unicode normalization or mixed-script content

Vague Triggers

Low
Confidence
85% confidence
Finding
The trigger keyword "population expansion" is a common scientific phrase that could refer to broad evolutionary or demographic discussion rather than a request to run this specific skill. Although most other triggers are domain-specific, this one lacks enough constraint to clearly distinguish invocation from general conversation.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
"""
    def serialise(value):
        if is_dataclass(value):
            return {f.name: serialise(getattr(value, f.name)) for f in fields(value)
                    if f.name not in {'pairs', 'incompatible_pairs'}}
        if isinstance(value, dict):
            return {json.dumps(k) if isinstance(k, tuple) else str(k): serialise(v)
Confidence
50% confidence
Finding
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Missing User Warnings

Low
Confidence
86% confidence
Finding
The reproducibility feature copies user-supplied input files into the output bundle automatically, which can unintentionally duplicate sensitive genomic or metadata files into a secondary location. In an agent or shared-runner environment, this increases the risk of unintended data retention, exfiltration through artifact collection, or disclosure to downstream consumers of the output directory.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
'Tajima D': 'TajimaD', "Tajima's D": 'TajimaD', 'Fu & Li D*': 'FuLiD_star',
        'Fu & Li D* (no outgroup)': 'FuLiD_star', 'Fu & Li F*': 'FuLiF_star',
        'Fu & Li F* (no outgroup)': 'FuLiF_star', 'R2': 'R2', 'Ramos-Onsins & Rozas R2': 'R2'}
    if label in direct: return getattr(rs, direct[label])
    if 'θ_W' in label: return rs.ThetaW_nuc
    if label.startswith('ZnS'): return r['ld'].ZnS
    if label in {'ZA', 'ZZ'}: return getattr(r['ld'], 'Za' if label == 'ZA' else 'ZZ')
Confidence
50% confidence
Finding
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if label in direct: return getattr(rs, direct[label])
    if 'θ_W' in label: return rs.ThetaW_nuc
    if label.startswith('ZnS'): return r['ld'].ZnS
    if label in {'ZA', 'ZZ'}: return getattr(r['ld'], 'Za' if label == 'ZA' else 'ZZ')
    if label.startswith('Rm'): return r['recombination'].Rm
    if label.startswith('Raggedness'): return r['popsize'].raggedness
    if label == 'Mismatch: mean': return r['popsize'].mean
Confidence
50% confidence
Finding
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if label.startswith('MK '):
        field = next((x for x in ('Pn', 'Ps', 'Dn', 'Ds') if f' {x} ' in label), None)
        if field is None: field = 'NI' if 'Neutrality' in label else 'alpha' if 'α' in label else 'fisher_p'
        return getattr(r['mk'], field)
    if label == 'Ka (dN)': return r['kaks'].Ka
    if label == 'Ks (dS)': return r['kaks'].Ks
    if label == 'ω = Ka/Ks': return r['kaks'].omega
Confidence
50% confidence
Finding
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
dnasp.py:4937