Bioinformatics

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:15 PM UTC
• Version: 1.0.0

Overview

The skill is mostly a coherent bioinformatics helper, but it asks to persist broad activation preferences in unspecified main memory and store potentially sensitive project context across sessions.

Install only if you are comfortable with the skill storing bioinformatics project context and activation preferences across sessions. Prefer keeping memory limited to ~/bioinformatics/memory.md, review or delete that file when needed, and avoid saving sensitive sample, patient, unpublished, or regulated study details unless explicitly intended.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

• Location: setup.md:18

Finding

Persistent Activation Preference Written to Unspecified Main Memory

Content

View full analysis

Vulnerability Details

File Location: setup.md, lines 18–24
Vulnerability Type: Persistent memory poisoning through an undeclared storage boundary
Risk Level: Medium

Complete Code Snippet:

markdown

### 1. First: Integration (within first 2-3 exchanges)

Figure out when this skill should activate. Ask:
- "Should I help whenever you're working with sequence data?"
- "Do you want me to assist when you mention NGS, FASTQ, or genomics?"

Save their answer to their main memory for future sessions.

Technical Analysis

The skill instructs the agent to save activation behavior in the user's unspecified “main memory,” allowing a rule established during the current session to influence future sessions. This exceeds the storage boundary declared elsewhere in the project: SKILL.md states that preferences are stored under ~/bioinformatics/ with consent.

The workspace consent requested by setup.md lines 9–14 applies to creating and using ~/bioinformatics/; it does not clearly authorize writing to a separate global or main-memory facility. Furthermore, the activation questions are broad enough to make the skill trigger whenever common genomics terms are mentioned.

This is classified as memory poisoning because persistent behavioral instructions are written into long-term state and can subsequently alter when the skill activates. The persisted content originates from the user's answer rather than a fixed malicious payload, so the finding does not demonstrate credential theft, arbitrary code execution, or data exfiltration.

Attack Path

1. The bioinformatics skill is loaded for the first time.
2. The setup instructions direct the agent to ask whether it should activate for broad topics such as sequence data, NGS, FASTQ, or genomics.
3. A broad activation preference is obtained from the current conversation.
4. The agent writes that preference to an unspecified main-memory mechanism rather tha ...[truncated 907 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the instruction to write activation preferences to unspecified “main memory.”
2. Store the preference only in the declared ~/bioinformatics/memory.md file after obtaining explicit, informed consent for that specific data.
3. Explain that the preference persists across sessions and identify exactly where it will be stored.
4. Scope activation rules narrowly to explicit bioinformatics requests rather than incidental mentions of broad terms.
5. Provide users with a documented way to inspect, modify, disable, and delete the persisted activation preference.
6. Keep all skill state within the skill-specific namespace and prevent it from modifying global agent behavior.
7. Reconcile setup.md with the privacy boundary in SKILL.md, ensuring both files describe the same storage location and consent requirements.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

md

## Common Traps

- **Wrong chromosome naming** — `chr1` vs `1` causes silent failures. Check and convert with `sed 's/^chr//'`
- **Unsorted BAM** — Most tools expect sorted input. Symptoms: errors or wrong results with no warning
- **Index missing** — BAM needs `.bai`, VCF needs `.tbi`. Commands fail cryptically without them
- **Memory exhaustion** — Large BAM operations kill the session. Stream or use `--threads` wisely
- **Stale indices** — After modifying BAM/VCF, regenerate index. Old index = corrupt reads

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · memory-template.md (reported line 20)May include surrounding context.

md

memory_gb: 32

## Reference Genomes
<!-- Track which references are downloaded and used -->

## Active Projects
<!-- Current analyses with status -->

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The setup instructions direct the agent to establish persistent cross-session tracking and to save user preferences/project context, which extends behavior beyond the stated bioinformatics analysis scope. Even though consent is requested for workspace creation, the instructions still normalize ongoing retention of potentially sensitive research metadata without a clear manifest-level disclosure, creating privacy and scope-creep risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The activation prompts ask to trigger whenever the user is working with broad categories like sequence data, NGS, FASTQ, or genomics, making future activation boundaries vague and expansive. Overbroad activation can cause the skill to engage and collect or retain information in situations the user did not specifically intend, increasing the chance of oversharing and persistent data capture.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill description presents a technical analysis capability but does not warn that user project details may be retained across sessions in memory. This omission undermines informed consent because users may share sensitive experimental or infrastructure details believing the interaction is ephemeral when it is not.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly persists project details such as organism, reference genome, compute environment, and tool preferences to a local memory file across sessions, but that storage is not reflected in the manifest description. In a bioinformatics context, project metadata can reveal sensitive research directions, unpublished work, or regulated sample context, so undisclosed retention creates meaningful confidentiality and trust concerns.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This markdown skill instructs the user to create output directories and generate analysis artifacts such as QC reports, alignments, counts, and CSV exports, but it does not include any warning that running the commands will write files into the working tree. Because SQP-2 applies to markdown files when user-impacting behavior is undocumented, a brief notice about generated outputs and possible overwrites is warranted.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

These steps instruct users to fetch remote databases via ANNOVAR, but the surrounding documentation does not explicitly disclose that the commands contact external services. For a markdown skill file, network-affecting behavior should be clearly warned about when it may affect privacy or system integrity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The command explicitly downloads a database, but the documentation does not include a user-facing warning that it will make outbound network connections. Under the markdown-specific warning rule, this should be disclosed because it affects privacy and environment policy expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.