ClawHub
Back to skill

Security audit

Variant Pathogenicity Predictor

Security checks for vulnerabilities and agentic risk

Overview

The skill is not malware, but it presents simplified genetic variant scoring as clinical-style pathogenicity and ACMG interpretation without adequate limitations or user safeguards.

Review carefully before installing or using. This appears to be a simple educational or research helper, not a clinically validated variant interpretation tool; do not use its classifications for diagnosis, patient care, reporting, or authoritative research triage without independent validated interpretation.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

High
Confidence
95% confidence
Finding
This script outputs a medical-style pathogenicity classification such as 'Pathogenic' and 'Likely Pathogenic' without any disclaimer that the result is a simplified heuristic and not suitable for clinical or diagnostic decision-making. In a genomics context, users may over-trust these labels and use them for patient care, research triage, or reporting, creating a meaningful risk of harmful misinterpretation.

Static analysis

No suspicious patterns detected.