Security audit

Admet Prediction

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent ADMET screening helper, but its bundled script presents simplified toxicity and drug-safety estimates in a way that could be mistaken for validated scientific predictions.

Install only in an isolated environment with pinned, reviewed dependencies. Treat all predictions as rough early-screening estimates, not clinical, regulatory, toxicological, or definitive safety evidence; require expert review and experimental validation before acting on hERG, DILI, Ames, or drug-likeness results.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:13
Finding: Unpinned and Inconsistently Declared Third-Party Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:13-15` and `SKILL.md:162-166` **Vulnerability Type**: Unpinned third-party dependencies and insufficient supply-chain verification **Risk Level**: Medium ### Vulnerable Code ```yaml dependencies: - rdkit - admet-models ``` ```bash pip install rdkit # Optional for advanced models pip install deepchem admet-x ``` ### Technical Analysis The project instructs users to install third-party Python packages without exact versions, cryptographic hashes, a lockfile, or a trusted package-index configuration. Consequently, package resolution depends on mutable releases available from the user's configured Python package index at installation time. The declared dependency `admet-models` also differs from the advanced dependencies named in the installation instructions, `deepchem` and `admet-x`. This inconsistency makes dependency provenance and review more difficult and may cause users or automation to install packages that were not part of the reviewed dependency declaration. This does not establish that any named package is malicious. However, the installation pattern creates exposure to compromised upstream releases, dependency confusion, package replacement, and unexpected behavior introduced by future releases. Python packages can execute code during installation or when imported. ### Attack Path 1. A user or CI system follows the installation instructions in `SKILL.md`. 2. `pip` queries its configured package index and resolves the latest compatible release because no exact version or hash is specified. 3. An attacker compromises an upstream package or publishes an attacker-controlled package through a dependency-confusion or package-substitution scenario. 4. The package is downloaded without integrity verification against a repository-controlled hash. 5. Malicious package installation or import-time code executes with the privileges of the user or CI runner invoking `pip`. ### Impact Asses ...[truncated 538 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Create a reviewed dependency file or lockfile containing exact versions for every direct and transitive dependency. 2. Generate and verify cryptographic hashes, then install with a command such as: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Reconcile `admet-models`, `deepchem`, and `admet-x` so the metadata and installation documentation identify the same audited dependencies. 4. Configure an explicit trusted package index or an internally controlled package mirror rather than relying on arbitrary user-level pip configuration. 5. Review package ownership, release history, source repository, and published artifacts before approval. 6. Run dependency installation and execution in an isolated virtual environment or container with minimal filesystem access and no unnecessary credentials. 7. Add automated dependency scanning and lockfile-integrity checks to CI. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The code returns ADMET and toxicity assessments such as hERG inhibition, DILI risk, Ames, bioavailability, and drug-likeness as authoritative-looking outputs, but the underlying logic is explicitly simplified heuristics and rough rules of thumb. In a drug discovery context, presenting these results without prominent warnings can mislead users into treating them as reliable safety or clinical evidence, which can cause unsafe prioritization or de-prioritization of compounds.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The CLI summary prints concise toxicity and ADMET conclusions like 'hERG: Yes', 'DILI: Concern', and 'Status: Pass' without any cautionary framing, which makes the output appear definitive and decision-ready. In the context of medicinal chemistry and safety screening, that presentation increases the risk of misuse by non-experts or automated workflows that may consume the output as if it were validated scientific prediction.

Static analysis

No suspicious patterns detected.