Security audit

KEGG Query

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a transparent KEGG biomedical lookup helper with disclosed network use and no evidence of hidden access, persistence, or destructive behavior.

Install only if you are comfortable with the agent making public KEGG REST API requests. Treat the examples as reference code, add request timeouts before production use, and choose explicit filenames before running any curl examples that redirect output to files.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Note

Location: examples/disease_discovery.py:19
Finding: Outbound KEGG API Requests Do Not Enforce Network Timeouts
Content: View full analysis
Remediation: View remediation
str: url = f"{KEGG_API_BASE}/{operation}" if args: url += "/" + "/".join(str(a) for a in args) kwargs.setdefault("timeout", (5, 30)) response = requests.get(url, **kwargs) response.raise_for_status() return response.text ``` 4. For retries, catch timeout and connection exceptions, impose a finite retry count, use bounded exponential backoff, and avoid retrying indefinitely. 5. Consider enforcing an overall workflow deadline in addition to per-request timeouts so multiple retries cannot exceed the agent task's execution budget. ]]>

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The code clearly matches part of the description: it queries the KEGG REST API for drug information and extracts several relevant drug fields. However, the declared purpose is substantially broader than the supplied code. The code only demonstrates KEGG DRUG lookup and parsing for a single drug entry example; it does not perform pathway analysis in the sense of retrieving pathway genes/compounds/modules, nor does it implement disease-associated drug/gene/pathway discovery for repurposing. There are no undeclared dangerous capabilities, but the declared description overstates the implemented functionality, so this is a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The code clearly interacts with the KEGG REST API and does support one declared area: pathway analysis, specifically retrieving and parsing pathway genes, compounds, modules, related pathways, and formatting a report. However, the declared description presents a broader skill centered on drug information lookup and disease-drug-target discovery in addition to pathway analysis. This code chunk does not implement drug efficacy/target/metabolism/interaction lookup, nor disease-associated drug/gene/pathway discovery or repurposing logic. Since the supplied code’s actual behavior is materially narrower than the declared overall purpose, this is a description-behavior mismatch for the provided chunk.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill documents clear network-backed functionality against the KEGG API but does not declare any tool scope, permissions, or allowed-tools constraints. In an agent runtime, this can lead to overbroad or implicit network access, making it harder to enforce least privilege and increasing the risk of unauthorized outbound requests or misuse if the skill is extended or invoked unexpectedly.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The comment at L153 says the code is parsing disease entries 'under EFFICACY', but the branch is actually executed when current_field == "DISEASE" at L152. This is a direct documentation/code contradiction, even though the implementation itself remains read-only and in-scope.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This markdown file includes shell examples that redirect API responses into local files (> pathway.png and > pathway.xml). The documentation does not warn users that running these commands will create or overwrite files in the current directory, which is a user-visible file-modifying operation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.