Security audit

Target Novelty Scorer

Security checks for vulnerabilities and agentic risk

Overview

This skill presents itself as real biomedical literature mining, but the included implementation generates simulated results while also allowing loosely scoped report writes.

Review before installing. Treat any scores or reports from this version as synthetic demonstration output, not real PubMed/PMC evidence. Avoid using --output with arbitrary or absolute paths, do not open CSV exports from untrusted target inputs in a spreadsheet, and prefer a fixed, reviewed dependency set before running it in a research environment.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/main.py:444
Finding: Unrestricted Output Path Allows Arbitrary File Overwrite
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/main.py:350
Finding: CSV Formula Injection Through Attacker-Controlled Target Value
Content: View full analysis
str: """Format CSV output""" headers = [ "target", "novelty_score", "confidence", "research_heat", "uniqueness", "research_depth", "collaboration", "trend", "total_papers", "recent_papers", "clinical_trials", "interpretation" ] values = [ result.target, result.novelty_score, result.confidence, result.breakdown['research_heat'], result.breakdown['uniqueness'], result.breakdown['research_depth'], result.breakdown['collaboration'], result.breakdown['trend'], result.metadata['total_papers'], result.metadata['recent_papers'], result.metadata['clinical_trials'], f'"{result.interpretation}"' ] return ",".join(map(str, values)) ``` ### Technical Analysis `result.target` originates from the user-controlled `--target` argument and is inserted directly into a CSV record. Values beginning with spreadsheet formula indicators such as `=`, `+`, `-`, or `@` can be interpreted as formulas when the exported file is opened in spreadsheet software. The function also constructs CSV manually with `",".join(...)`. It does not correctly quote or escape commas, double quotes, carriage returns, or line feeds. Consequently, an attacker can alter the record structure, inject additional cells or rows, and place formula payloads into cells other than the original target field. The `headers` list is defined but is not included in the returned output, and the interpretation is manually surrounded with quotes without escaping embedded quote characters. ### Attack Path 1. An attacker provides a crafted target value, such as: ```bash python scripts/main.py \ --target '= ...[truncated 1397 chars]
Remediation: View remediation
object: if not isinstance(value, str): return value dangerous_prefixes = ("=", "+", "-", "@", "\t", "\r", "\n") if value.startswith(dangerous_prefixes): return "'" + value return value def format_csv_output(result: NoveltyScore) -> str: values = [ neutralize_spreadsheet_cell(result.target), result.novelty_score, result.confidence, result.breakdown["research_heat"], result.breakdown["uniqueness"], result.breakdown["research_depth"], result.breakdown["collaboration"], result.breakdown["trend"], result.metadata["total_papers"], result.metadata["recent_papers"], result.metadata["clinical_trials"], neutralize_spreadsheet_cell(result.interpretation), ] stream = io.StringIO(newline="") writer = csv.writer(stream, quoting=csv.QUOTE_ALL) writer.writerow(values) return stream.getvalue() ``` ]]>

T08 · Insecure Dependencies

Note

Location: requirements.txt:1
Finding: Unpinned and Unnecessary Third-Party Dependencies
Content: View full analysis
Remediation: View remediation
\ --hash=sha256: ``` ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented behavior claims real literature mining from PubMed/PMC and database-selectable analysis, while the implementation reportedly uses simulated data and ignores database settings. This is dangerous because users may make scientific, regulatory, or prioritization decisions based on fabricated or misleading outputs that appear evidence-based.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill advertises Python execution and file output but does not declare any explicit tool scope such as allowed tools or permissions. In an agent environment, that omission weakens policy enforcement and can let the skill write files without clear user-visible constraints, increasing the chance of unintended or abusive filesystem actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill documentation describes external API access and report generation but does not clearly warn that input targets and associated metadata may be transmitted to third-party services and written to disk. In biomedical workflows, even seemingly simple target lists can be sensitive research context, so the lack of disclosure can cause unintended data exposure and weakens informed consent by users.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The code and CLI present this tool as performing PubMed-based literature mining, but the implementation only generates pseudo-random simulated results seeded from the query string. In a bioinformatics or target-prioritization workflow, this can mislead users into treating fabricated evidence as real analysis, causing incorrect scientific, business, or research decisions.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: The dependency list is unpinned, so installations may resolve to different versions over time. This creates supply-chain and reproducibility risk because a future incompatible or vulnerable release could be pulled without review, even though dataclasses itself is generally low risk and is only needed on older Python versions.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
dataclasses numpy

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 98% confidence
Finding: numpy is unpinned, which means the environment may install any available version, including releases with known security defects or breaking behavior. Because this skill performs biological literature and trend analysis, it likely processes external data at scale, so dependency drift can increase the chance of vulnerable code being introduced into runtime environments.
Content: Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.
text
dataclasses numpy

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 90% confidence
Finding: The manifest does not specify a numpy version, so it is impossible to verify whether the deployed package is affected by one of the known advisories. This is dangerous because a resolver may select a vulnerable version in some environments, leaving the skill exposed to memory-safety, denial-of-service, or file-handling issues associated with affected NumPy releases.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The CLI offers a database-selection option suggesting the user can choose among PubMed, PMC, or all sources, but the argument is ignored entirely. This is deceptive interface behavior that can cause users to rely on an assumed data source or breadth of coverage that never actually affects execution.
Content: No source excerpt is available for this finding.