ClawHub
Back to skill

Security audit

Phenosnap Phenotype Extractor

Security checks for vulnerabilities and agentic risk

Overview

The skill has a legitimate local clinical extraction purpose, but it automatically downloads and runs mutable third-party code and installs Python packages while handling sensitive clinical text.

Review before installing. Only run this in a dedicated virtual environment or container, with no unnecessary access to other files, and prefer a pinned, reviewed PhenoSnap release with verified dependency hashes. Do not use it on identifiable clinical records unless you are comfortable with the local machine and fetched code handling that data.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:95
Finding

Unpinned Remote PhenoSnap Code Is Downloaded and Executed

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 95–129
Vulnerability Type: Mutable remote code retrieval followed by local execution
Risk Level: High

Vulnerable Code

text
#### If `git` is available
Run:
- `git clone https://github.com/WGLab/PhenoSnap.git "{baseDir}/PhenoSnap"`

#### If `git` is NOT available
Download zip:
- URL: `https://github.com/WGLab/PhenoSnap/archive/refs/heads/main.zip`
- Destination: `{baseDir}/third_party/phenosnap_main.zip`

Download method (pick first available):
- If `curl` exists:
  - `curl -L "https://github.com/WGLab/PhenoSnap/archive/refs/heads/main.zip" -o "{baseDir}/third_party/phenosnap_main.zip"`
- Else on Windows PowerShell:
  - `Invoke-WebRequest -Uri "https://github.com/WGLab/PhenoSnap/archive/refs/heads/main.zip" -OutFile "{baseDir}/third_party/phenosnap_main.zip"`

Unzip (choose by OS/tools):
- Windows PowerShell:
  - `Expand-Archive -Path "{baseDir}/third_party/phenosnap_main.zip" -DestinationPath "{baseDir}/third_party/phenosnap_unzip" -Force`
- macOS/Linux with unzip:
  - `unzip -o "{baseDir}/third_party/phenosnap_main.zip" -d "{baseDir}/third_party/phenosnap_unzip"`

If neither unzip nor Expand-Archive is available, use Python:
- `python3 -c "import zipfile; z=zipfile.ZipFile(r'{baseDir}/third_party/phenosnap_main.zip'); z.extractall(r'{baseDir}/third_party/phenosnap_unzip')"`

Then rename/move the extracted folder to `{baseDir}/PhenoSnap/`:
- The extracted folder is typically `{baseDir}/third_party/phenosnap_unzip/PhenoSnap-main`
- Move/rename to `{baseDir}/PhenoSnap/`

Final check:
- Verify `{baseDir}/PhenoSnap/extract_phenotypes.py` exists.

The downloaded module is subsequently executed by the dependency smoke test:

text
- `python3 -c "import importlib.util; spec=importlib.util.spec_from_file_location('extract_phenotypes','extract_phenotypes.py'); m=importlib.util.module_from_spec(spec); spec.loader.exec_module
...[truncated 2512 chars]
Remediation
View remediation

Remediation Suggestions

  1. Vendor a reviewed PhenoSnap version inside the skill package where licensing permits, or obtain it from a controlled internal artifact repository.
  2. If remote retrieval is required, pin an immutable commit or versioned release rather than the default branch.
  3. Publish the expected SHA-256 digest in the reviewed skill and reject the artifact unless its digest matches.
  4. Where available, verify a release signature against a pinned, trusted maintainer key.
  5. Replace the executable import smoke test with static checks or a sandboxed subprocess. Importing a module is code execution.
  6. Execute the extractor in an isolated environment with outbound network access disabled after installation.
  7. Restrict filesystem access to the HPO file, redacted input, output directory, and dedicated application directory.
  8. Require explicit user or administrator approval before downloading and executing a new upstream version.

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:145
Finding

Unverified get-pip.py Bootstrap Script Is Downloaded and Executed

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 145–151
Vulnerability Type: Unverified remote bootstrap script execution
Risk Level: High

Vulnerable Code

text
If still failing, bootstrap pip via get-pip.py:
- Download `https://bootstrap.pypa.io/get-pip.py` to `{baseDir}/third_party/get-pip.py`
  - with curl:
    - `curl -L "https://bootstrap.pypa.io/get-pip.py" -o "{baseDir}/third_party/get-pip.py"`
  - or PowerShell:
    - `Invoke-WebRequest -Uri "https://bootstrap.pypa.io/get-pip.py" -OutFile "{baseDir}/third_party/get-pip.py"`
- Install:
  - `python3 "{baseDir}/third_party/get-pip.py"`

Technical Analysis

The skill downloads a Python bootstrap program from a remote URL and executes it directly. It does not verify a cryptographic digest, validate a digital signature, or pin the script to reviewed content.

HTTPS provides transport authentication and integrity for a connection to the selected endpoint, but it does not establish that the fetched content is identical to the version reviewed with this skill. The endpoint's content can change independently of the skill package.

Automatically provisioning pip is also not essential to phenotype extraction itself. Package-manager installation is an environment-management operation that should generally remain under administrator or user control.

Attack Path

  1. The normal pip check and ensurepip fallback fail.
  2. The skill downloads the current get-pip.py artifact from the configured endpoint.
  3. The remote source, served artifact, or trusted publishing infrastructure has been compromised or modified.
  4. The skill performs no independent integrity verification.
  5. python3 "{baseDir}/third_party/get-pip.py" executes the modified script.
  6. The script runs with all permissions inherited from the Agent process and can perform actions unrelated to pip installation.

Impact Assessment

Exploitation permits arbitrar ...[truncated 535 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove automatic get-pip.py retrieval and execution.
  2. Require Python and pip to be installed through an administrator-controlled package manager or approved base environment.
  3. Fail safely with clear setup instructions if neither pip nor ensurepip is available.
  4. If a bootstrap artifact is unavoidable, pin a reviewed version and verify its SHA-256 digest or trusted signature before execution.
  5. Run all Python tooling in a dedicated virtual environment rather than modifying a shared interpreter.
  6. Request explicit approval before making changes to the Python environment.
  7. Limit the installation process with sandboxing, restricted filesystem access, and only the network access required to reach approved package sources.

T08 · Insecure Dependencies

Error
Location
SKILL.md:157
Finding

Automatically Installs Dependencies Defined by an Unverified Remote Repository

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 157–160
Vulnerability Type: Unsafe automatic third-party dependency installation
Risk Level: High

Vulnerable Code

text
#### Step 2: Install PhenoSnap dependencies
From `{baseDir}/PhenoSnap/`, run:
- `python3 -m pip install -r requirements.txt`

Technical Analysis

The requirements.txt file is not included in the audited project. It is obtained from the mutable, unverified PhenoSnap repository downloaded earlier in the procedure. The audit therefore cannot establish which package names, versions, package indexes, direct URLs, local paths, build systems, or installation hooks will be processed.

The command does not require pinned versions or cryptographic hashes. Python package installation can execute code through source builds and build backends. A malicious upstream requirements change, dependency compromise, dependency confusion condition, or compromised transitive package could therefore introduce executable code into the Agent's environment.

The README recommends a virtual environment, but the procedure does not enforce one. Consequently, dependencies may be installed into the active user or system-associated Python environment, depending on its configuration and permissions.

Attack Path

  1. An attacker modifies the remote repository's requirements.txt, compromises a listed dependency, or publishes a malicious package that wins dependency resolution.
  2. The skill downloads the current repository state without validating its contents.
  3. A missing-module error activates the automatic dependency-installation branch.
  4. pip install -r requirements.txt resolves and downloads attacker-influenced package content.
  5. Package build or installation logic executes during installation, or malicious runtime code is imported later.
  6. The malicious dependency runs with the permissions of the Agent's Python process.

Impact Asse

...[truncated 824 chars]

Remediation
View remediation

Remediation Suggestions

  1. Include an audited dependency lock file in the reviewed skill package.
  2. Pin every direct and transitive dependency to an exact version.
  3. Record approved hashes and install with pip --require-hashes.
  4. Restrict package resolution to an approved index or internal artifact repository.
  5. Reject direct URLs, editable installs, unapproved indexes, and unexpected local paths in dependency definitions.
  6. Create and use a dedicated virtual environment automatically; do not install into a shared Python environment.
  7. Separate dependency installation from processing of clinical information and require explicit user or administrator approval.
  8. Scan and review dependency updates before changing the lock file.
  9. Run installation and extraction with restricted filesystem permissions and minimal network access.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill can bootstrap pip, download get-pip.py, and install whatever is listed in requirements.txt at execution time. This gives the skill broad code-execution and environment-modification capability far beyond simple phenotype extraction, exposing the host to supply-chain compromise, malicious dependency execution, and persistence through package installation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README explicitly states that the skill will automatically bootstrap software from the network and install Python dependencies, including installing pip if absent, but does not clearly warn users that running the skill may modify their system. In a security-sensitive context, undisclosed network retrieval and package installation increase supply-chain and environment-modification risk, especially when processing clinical text where users may assume a local-only, minimally invasive workflow.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill claims to be local-only and privacy-preserving for sensitive clinical text, but its procedure instructs the agent to fetch third-party code and tooling from the network. That creates a trust-boundary mismatch: even if the user data is not explicitly uploaded, executing newly downloaded code in the same workflow handling PHI materially increases supply-chain and unintended disclosure risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The documented use of curl/Invoke-WebRequest to fetch a ZIP from GitHub is an external network transmission and import of untrusted code into a workflow that processes sensitive clinical text. Even if the request itself does not send user text, downloading and later executing remote content expands the attack surface and can enable indirect exfiltration or compromise.

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

md
Download method (pick first available):
- If `curl` exists:
  - `curl -L "https://github.com/WGLab/PhenoSnap/archive/refs/heads/main.zip" -o "{baseDir}/third_party/phenosnap_main.zip"`
- Else on Windows PowerShell:
  - `Invoke-WebRequest -Uri "https://github.com/WGLab/PhenoSnap/archive/refs/heads/main.zip" -OutFile "{baseDir}/third_party/phenosnap_main.zip"`

Static analysis

No suspicious patterns detected.