Security audit

Variant Annotation

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate research variant-annotation skill, but it needs review because it can transmit sensitive genetic inputs externally and has a medical-classification flaw when population data is missing.

Use this only for research or education, not diagnosis or treatment. Before installing, review whether variant identifiers or batch files are sensitive, assume queries go to NCBI, avoid passing valuable API keys on the command line, and treat ACMG output as provisional until the missing-frequency scoring bug and dependency issue are fixed.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/main.py:154
Finding: NCBI API Key Embedded and Repeated in Request URLs
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: requirements.txt:1
Finding: Unnecessary and Unpinned Third-Party Dependency
Content: View full analysis
Remediation: View remediation

other

Error

Location: scripts/main.py:274
Finding: Missing Population Frequency Data Is Misclassified as ACMG PM2 Evidence
Content: View full analysis
max_freq: max_freq = freq if max_freq < 0.0001: criteria.append("PM2") score += self.ACMG_SCORES["PM2"] evidence["PM2"] = f"Absent from population databases (max MAF: {max_freq:.2e})" elif max_freq > 0.05: criteria.append("BA1") score += self.ACMG_SCORES["BA1"] evidence["BA1"] = f"Common variant (MAF: {max_freq:.3f} > 5%)" elif max_freq > 0.01: criteria.append("BS1") score += self.ACMG_SCORES["BS1"] evidence["BS1"] = f"Allele frequency greater than expected ({max_freq:.3f})" ``` ### Technical Analysis `max_freq` is initialized to zero. If all supplied population frequency values are `None`, the loop never changes it. The code then interprets this synthetic zero as an observed maximum frequency below `0.0001` and awards ACMG criterion PM2. Missing data and an observed allele frequency of zero are materially different states. The resulting evidence summary falsely states that the variant is absent from population databases even when no usable population observation was obtained. The implementation only attempts limited dbSNP frequency extraction and does not query the gnomAD or ExAC sources advertised in `SKILL.md`. Nevertheless, the scoring input includes an unpopulated gnomAD field. This makes the unsafe missing-data path likely for variants without a successfully parsed dbSNP frequency. ### Attack Path 1. A user submits a variant for which no usable population frequency is returned or parsed. 2. The frequency fields passed to `_calculate_acmg_score()` are all `None`. 3. `max_freq` remains at its initialized value of `0.0`. 4. The code awards PM2 and adds two pathogenicity points. 5. The output incorrect ...[truncated 815 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill advertises network and file read/write behavior but does not declare any explicit tool scope or permissions boundary. In an agent environment, this creates ambiguity about what resources the skill may access and increases the risk of unintended file access, data exfiltration, or broader tool invocation than reviewers and orchestrators expect.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The trigger text is broad enough to activate on general discussions of pathogenicity or clinical significance, not just concrete variant-annotation tasks. Over-broad activation can cause the skill to process unintended user content, invoke networked lookups unnecessarily, and return medical-style interpretations in contexts where the user did not ask for this specialized workflow.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.
md
- **PM3**: For recessive disorders, detected in trans with a pathogenic variant - **PM4**: Protein length changes as a result of in-frame deletions/insertions in a nonrepeat region or stop-loss variants - **PM5**: Novel missense change at an amino acid residue where a different missense change determined to be pathogenic has been seen before - **PM6**: Assumed de novo, but without confirmation of paternity and maternity ### Supporting Pathogenic (PP) - **PP1**: Cosegregation with disease in multiple affected family members in a gene definitively known to cause the disease

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/acmg-guidelines.md (reported line 39)May include surrounding context.
md
- **PM3**: For recessive disorders, detected in trans with a pathogenic variant - **PM4**: Protein length changes as a result of in-frame deletions/insertions in a nonrepeat region or stop-loss variants - **PM5**: Novel missense change at an amino acid residue where a different missense change determined to be pathogenic has been seen before - **PM6**: Assumed de novo, but without confirmation of paternity and maternity ### Supporting Pathogenic (PP) - **PP1**: Cosegregation with disease in multiple affected family members in a gene definitively known to cause the disease

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This file contains concrete genetic variant examples with asserted pathogenic/benign interpretations and expected outputs, but it does not state that the content is for testing/reference only and not for clinical, diagnostic, or medical decision-making. In a variant-annotation skill, users or downstream agents could mistakenly treat these examples as authoritative medical guidance, creating a risk of unsafe health interpretation or overconfident automation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The code sends user-supplied variant identifiers and an optional NCBI API key to external NCBI endpoints without any explicit consent flow, warning, or data-handling notice. In this skill’s context, variant queries can reveal highly sensitive genetic and health-related information, so silent transmission creates a real privacy and compliance risk even if the destination is a legitimate biomedical service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The tool ingests variant lists from local files and then processes them for annotation without warning that the file contents may contain sensitive genetic data. Because this skill is specifically designed to analyze clinical significance and pathogenicity, users may unknowingly submit regulated or personally sensitive genomic information for external lookup, increasing privacy, confidentiality, and compliance exposure.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The line 'AI自主验收状态: 需人工检查' introduces Chinese-language content in the skill documentation without offering a language choice or explaining a locale-specific requirement. This can violate language/locale policy expectations for user-facing skill materials.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 60% confidence
Finding: Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
dataclasses

Static analysis

No suspicious patterns detected.