ClawHub
Back to skill

Security audit

COMSOL Simulation

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its COMSOL automation purpose, but some diagnostic and repair scripts can rerun or overwrite simulation models without clear confirmation.

Review this skill before installing if your COMSOL models are valuable or costly to recompute. Use it only in a disposable workspace or on copied .mph files, approve dependency installation deliberately, and avoid running diagnostic or repair scripts unless you are comfortable with them rerunning studies and saving modified models.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
scripts/install_mph.py:42
Finding

Unpinned Third-Party Dependencies Installed from PyPI

Content
View full analysis

Vulnerability Details

File Location: scripts/install_mph.py, lines 42–47
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

python
command = [
    sys.executable, "-m", "pip", "install",
    "mph", "JPype1", "numpy", "scipy", "matplotlib",
    "--target", str(VENDOR_DIR),
    "--disable-pip-version-check",
    "--no-warn-script-location",
]

Technical Analysis

The installation script retrieves five packages from pip without version constraints, package hashes, a lock file, or an explicitly configured trusted package index. Consequently, the code installed by this command can change between executions even when the Skill itself remains unchanged.

The packages and their transitive dependencies are placed in vendor/site-packages. The Skill subsequently adds that directory to PYTHONPATH and imports packages from it. A compromised upstream release, dependency account takeover, malicious transitive dependency, or unexpected incompatible release could therefore introduce attacker-controlled code into the Skill's execution environment.

This finding does not establish that any named package is currently malicious. It identifies an avoidable supply-chain exposure caused by unconstrained dependency resolution.

Attack Path

  1. An attacker compromises a listed package, one of its transitive dependencies, or the package distribution channel.
  2. The attacker publishes a malicious release that still satisfies the unconstrained package request.
  3. A user approves and runs python scripts/install_mph.py.
  4. pip resolves and installs the malicious release into vendor/site-packages.
  5. Malicious package code may execute during installation or when the Skill later imports the installed module.
  6. The payload runs with the privileges of the user executing the Skill.

Impact Assessment

Successful exploitation could provide arbitrary ...[truncated 543 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin every direct dependency to a reviewed, exact version, for example package==x.y.z.
  2. Generate and commit a lock file containing all transitive dependencies.
  3. Record approved distribution hashes and install with pip's --require-hashes option.
  4. Use an explicitly configured, trusted package index or an internally controlled package mirror.
  5. Install from a reviewed requirements file rather than maintaining unconstrained package names directly in executable code.
  6. Add automated dependency vulnerability and provenance scanning to the release process.
  7. Test dependency updates in an isolated environment before updating approved versions and hashes.
  8. Preserve the existing requirement that dependency installation occurs only after explicit user approval.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (69)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The description presents a broad automation skill for COMSOL Multiphysics, including environment discovery, project setup, sweep automation, solver diagnostics, and post-processing across optical, semiconductor, thermal, and coupled optoelectronic domains. The supplied code does not automate simulations or configure/rerun COMSOL studies; it only starts mph, loads an existing model, inspects result datasets, extracts specific semiconductor/optoelectronic detector metrics, exports plots/data, and computes some derived quantities. Its primary purpose is much narrower: post-processing existing photodetector simulation outputs. While post-processing is part of the declared description, the declared scope materially overstates the implemented capabilities and domain breadth.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The declared description presents a general-purpose COMSOL automation skill for running and analyzing simulations. The supplied code does not automate simulations, configure projects, run parameter sweeps, provide solver diagnostics, or perform post-processing. Its primary function is to discover whether certain official COMSOL example models and their docs exist locally, and optionally export their Java representations for inspection. While COMSOL environment discovery is part of the declared scope, that is only a supporting piece here; the dominant behavior is example-library probing, which is materially different from the broader declared simulation automation purpose.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

md
python scripts/run_parameter_sweep.py --config <project_sweep_config.json>

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/install_mph.py (reported line 30)May include surrounding context.

python
def _verify_import() -> subprocess.CompletedProcess:
    env = os.environ.copy()
    env["PYTHONPATH"] = _pythonpath_with_vendor()
    return _run([
        sys.executable, "-c",

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/run_parameter_sweep.py (reported line 227)May include surrounding context.

python
def _verify_import() -> subprocess.CompletedProcess:
    env = os.environ.copy()
    env["PYTHONPATH"] = _pythonpath_with_vendor()
    return _run([
        sys.executable, "-c",

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/test_sweep_offline.py (reported line 179)May include surrounding context.

python
def _verify_import() -> subprocess.CompletedProcess:
    env = os.environ.copy()
    env["PYTHONPATH"] = _pythonpath_with_vendor()
    return _run([
        sys.executable, "-c",

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/comsol-api-patterns.md (reported line 1)May include surrounding context.

md
# Preset Simulation Templates

This directory contains topic-neutral JSON templates for common simulation patterns. They are intentionally not ready-to-run quantitative examples.

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/comsol-convergence-diagnostics.md (reported line 1)May include surrounding context.

md
# Preset Simulation Templates

This directory contains topic-neutral JSON templates for common simulation patterns. They are intentionally not ready-to-run quantitative examples.

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/comsol-docs-java-playbook.md (reported line 1)May include surrounding context.

md
# Preset Simulation Templates

This directory contains topic-neutral JSON templates for common simulation patterns. They are intentionally not ready-to-run quantitative examples.

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/comsol-official-learning-roadmap.md (reported line 1)May include surrounding context.

md
# Preset Simulation Templates

This directory contains topic-neutral JSON templates for common simulation patterns. They are intentionally not ready-to-run quantitative examples.

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/comsol-official-photogeneration-template.md (reported line 1)May include surrounding context.

md
# Preset Simulation Templates

This directory contains topic-neutral JSON templates for common simulation patterns. They are intentionally not ready-to-run quantitative examples.

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/input-schema.md (reported line 1)May include surrounding context.

md
# Preset Simulation Templates

This directory contains topic-neutral JSON templates for common simulation patterns. They are intentionally not ready-to-run quantitative examples.

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/parameter-sweep-guide.md (reported line 1)May include surrounding context.

md
# Preset Simulation Templates

This directory contains topic-neutral JSON templates for common simulation patterns. They are intentionally not ready-to-run quantitative examples.

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/thermal-coupling-guide.md (reported line 1)May include surrounding context.

md
# Preset Simulation Templates

This directory contains topic-neutral JSON templates for common simulation patterns. They are intentionally not ready-to-run quantitative examples.

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · templates/presets/README.md (reported line 1)May include surrounding context.

md
# Preset Simulation Templates

This directory contains topic-neutral JSON templates for common simulation patterns. They are intentionally not ready-to-run quantitative examples.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill advertises and instructs shell-based execution of Python scripts that can read environment details, inspect local installations, and write outputs, but it does not declare any tool scope or allowed-tools boundary. In an agent setting, this creates an authorization gap where the runtime may permit broader shell/file access than users expect, increasing the risk of unintended local inspection or file modification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill enables implicit invocation without any trigger constraints or exclusion criteria, allowing it to be auto-selected in contexts the user may not explicitly intend. Because this skill can configure and audit COMSOL simulations, unintended invocation could expose project context, alter simulation workflows, or cause the agent to perform costly or disruptive actions based on loosely related prompts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The helper methods section includes model.java.sol().clear(), model.clear(), and model.reset() with no accompanying warning that they remove solver results or reset model state. These are potentially irreversible or destructive operations affecting user work, so the skill description should disclose that risk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The docstring claims the script only forces equation compilation and checks DOF count, but the implementation goes on to rebuild, re-solve, clear, and save the model. This mismatch is dangerous because operators and higher-level agents may trust the script as a safe diagnostic and invoke it in contexts where destructive persistence is unacceptable.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script is presented as a diagnostic probe, but it performs state-changing operations including model.clear(), model.build(), model.solve(), and model.save() back to the original .mph file. In a simulation workflow, this can silently overwrite a user's model, alter solver state, or persist unintended changes, making the probe unsafe and violating least surprise for tooling that should be read-only.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script mutates the loaded COMSOL model and overwrites the same .mph file without confirmation, backup, or alternate destination. In this skill context, users are likely automating expensive and carefully tuned multiphysics simulations, so silent persistence of rebuilt or re-solved state can corrupt reproducibility, destroy intermediate setup, or invalidate analysis results.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The script unconditionally saves the COMSOL model back to the input path after making in-memory changes and attempting a study rerun, with no confirmation, dry-run mode, or separate output path. In this skill context, that can silently overwrite a user’s original simulation model, making accidental destructive changes more likely and potentially corrupting or altering valuable engineering work product.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The docstring presents the script as a simple 'direct diagnostic' with 'no config needed', but the implementation actively runs studies and writes the model file. That mismatch is dangerous because operators may trust it as a harmless inspection tool, increasing the chance of unintended model modification, expensive recomputation, or corruption of expected baseline results.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This diagnostic script is not read-only: it iterates through all discovered studies, executes them via jm.study(st).run(), and then saves the model back to the same .mph file. In a simulation skill, re-running solver jobs can consume significant compute, alter cached solutions/results, and overwrite the original artifact, so a user expecting passive inspection may suffer integrity and availability impact.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script saves the model in place after potentially executing studies, with no prompt, backup, or alternate destination. In this skill context, .mph files are primary simulation assets, so silent overwrite can destroy reproducibility, replace known-good results with failed/partial solver state, and make troubleshooting harder.

Content

No source excerpt is available for this finding.