Security audit

scellrun

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a legitimate single-cell analysis helper, but it needs review because it gives unsafe credential-handling and unpinned install guidance for sensitive data hosts.

Install only after reviewing the operational risks. Prefer pinned or internally mirrored scellrun packages, run under a dedicated least-privilege account with access only to needed input and output directories, confirm any SSH target before running, and use `--no-ai` unless the user explicitly authorizes external AI calls. If AI is needed, use a secrets manager or ephemeral environment injection rather than putting API keys in shell commands, chat, history, logs, or persistent plaintext files.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:496
Finding: Unpinned third-party package installation on sensitive data hosts
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:645
Finding: Anthropic API key can be exposed through shell history or persistent plaintext storage
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest description advertises a 'single-cell + multi-omics analysis CLI', suggesting the skill is appropriate for multimodal datasets. However, the body explicitly says multimodal inputs are not truly supported and that QC, integration, and annotation ignore modalities like ADT, ATAC, and CITE-seq, making the manifest materially broader than the documented behavior.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest description says to use this skill when the user asks "anything that involves" several file types, including generic tsv/csv expression matrices described later in the document. That scope is very broad and lacks explicit exclusions or negative examples in the trigger text itself, which increases the chance of unintended invocation for general data-analysis requests that merely mention these common formats.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill instructs the agent to SSH to wherever data lives, create environments, run commands, and write artifacts, but it does not require an upfront user confirmation before operating on remote infrastructure. In an agent setting, this can lead to unintended actions on sensitive servers, creation of files on the wrong host, or execution under the wrong account, especially because the skill encourages active remote command execution by default.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 65% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 601)May include surrounding context.
md
to reference if the connection drops or the agent times out before the run completes. ### Long-running remote jobs (tmux / nohup / scheduler) - A `scellrun analyze` on a real cohort takes 5-30 min on a workstation, longer on integration-heavy multi-sample. SSH disconnects mid-run

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 639)May include surrounding context.
md
`00_decisions.jsonl` (what scellrun decided so far). The last stage that completed has its report; failed-mid-stage will be empty or partial. - Don't `rm -rf` the run-dir to "start clean" without checking first — the user may want the failed artifacts for debugging. Use a fresh run-dir name instead.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 88% confidence
Finding: The skill recommends persisting ANTHROPIC_API_KEY in ~/.config/scellrun/.env and sourcing it later. Even with mode 600, long-lived plaintext secrets on disk increase the risk of credential exposure through backups, compromised accounts, accidental inclusion in support bundles, or later misuse by unrelated sessions.
Content: Scanner excerpt · SKILL.md (reported line 652)May include surrounding context.
md
- For interactive debugging: prefix the command, e.g. `ANTHROPIC_API_KEY=sk-... scellrun analyze ...`. Bash discards prefix-vars from history with `HISTCONTROL=ignoreboth`. - For automation: write the key to `~/.config/scellrun/.env` (mode 600) and `source` it before invocation. - Never commit a key, never paste a key into chat with the user. - If no key is set, `--no-ai` works. The deterministic pipeline runs

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 802)May include surrounding context.
md
downstream stages ran. The user decides whether to accept or re-run. - **"I'll add an `--auto-fix` because the user is busy."** Only if the user said "just fix it" or you've already shown them the suggestion and they agreed. Auto-fixing without consent silently changes the thresholds the analysis ran with. ## Source of truth

Static analysis

No suspicious patterns detected.