Security audit

GPA Genomic Phenotype Association

Security checks across malware telemetry and agentic risk

Overview

This genomics skill appears purpose-built, but it can send and cache sensitive genetic and phenotype data without clear consent and privacy controls.

Review this before installing in any real patient or regulated setting. Prefer offline mode for sensitive samples, avoid passing identifiable phenotype text unless you consent to external LLM processing, check HTTP_PROXY/HTTPS_PROXY settings, and clear or protect the cache/log/output directories after use. Treat reports as decision support requiring qualified clinical review, not as a standalone diagnosis.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill instructs the agent to run local Python scripts, read and write files, access network APIs, and use caching, yet no permissions are explicitly declared. In a medical/genomics context, this creates a serious trust and containment gap: the runtime may perform sensitive data access or exfiltration without transparent user/admin review, especially because genomic data is highly sensitive.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The trio-inference section claims to determine cis/trans from parental genotypes, but the shown implementation never actually resolves phase and always returns a placeholder status. In a genomic risk-analysis skill, this can mislead downstream logic or users into treating an unresolved result as meaningful evidence, potentially affecting clinical-style interpretation of compound heterozygosity and risk tiering.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The reads-analysis documentation says it verifies that each read covers all variant sites, but the shown check only compares variant positions against the fetched interval, not against the actual read alignment. This can count reads as informative when they do not span the relevant loci, producing false cis/trans evidence in a medically sensitive genomic interpretation workflow.

Intent-Code Divergence

Low

Confidence: 87% confidence
Finding: The main decision function promises consistent PhaseResult objects, but several branches treat helper returns like objects even though the helper examples return dictionaries. This type inconsistency can cause runtime failures or silent misprocessing, undermining reliability of phase calls and risk reports in a health-related analysis skill.

Intent-Code Divergence

Medium

Confidence: 80% confidence
Finding: The docstring claims the state file is stored under a user-specific directory, but the code actually writes to a repository-local path derived from __file__. This discrepancy can cause operators to misunderstand where persistent state is stored, increasing the risk of accidental exposure, improper cleanup, or unintended sharing of build metadata when the repository directory is shared, committed, or mounted across users or environments.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The helper persists data to a local SQLite cache and daily log files even though the skill is described as an analysis tool, creating undeclared stateful side effects. Persistent writes can expose sensitive analysis context, complicate consent/compliance expectations, and allow stale or tampered cached data to influence future genomic risk results.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The module automatically syncs gene lists from external sources (Orphanet/OMIM) that are not reflected in the manifest-described data sources, creating hidden supply-chain and privacy behavior. In a genomic analysis skill, undeclared upstream data dependencies are risky because they can silently alter medical-risk classifications and make results non-reproducible.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The design explicitly stores genomic/API query results in a local SQLite cache under the user's home directory without any documented consent, warning, retention control, or handling guidance. In a genomics skill, even cached gene/variant lookups can reveal highly sensitive health-related information, so silent persistence materially increases privacy and compliance risk if the host is shared, backed up, or later inspected.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The README explicitly promotes online queries to multiple external services using genomic variant inputs, but it does not warn that variant/genotype data may be highly sensitive personal health information. In a genomic analysis skill, this context makes the omission more dangerous because users may unknowingly transmit identifiable or re-identifiable patient data to third-party APIs, creating privacy, compliance, and consent risks.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger scope is overly broad, including essentially any mention of 'genomic', 'genetic', 'risk', 'mutation', or 'variant', which can cause unintended invocation during general educational or low-risk conversations. Because this skill can drive shell, network, and file operations and is positioned as mandatory for answers, over-triggering increases unnecessary processing of sensitive medical/genetic content and the chance of inappropriate workflow execution.

Natural-Language Policy Violations

Medium

Confidence: 72% confidence
Finding: The skill emphasizes Chinese-language behavior and bilingual terminology handling without stating that this is user-selectable, which can override user preference or organizational locale expectations. While not directly a security flaw by itself, forced locale behavior can contribute to misunderstanding in a medical workflow and may cause users to misread results or consent language.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The client enables `trust_env=True`, which causes aiohttp to honor `HTTP_PROXY`/`HTTPS_PROXY`, and also supports explicit per-API proxies. In a genomic analysis skill, outbound requests may contain highly sensitive gene symbols, variant coordinates, HGVS strings, and disease-related queries; silently routing them through environment-controlled proxies can expose regulated health/genomic data to unintended intermediaries and enable response tampering in hostile environments.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The code writes genomic variants and potentially phenotype-derived inputs to temporary TSV/JSON/Markdown files on disk. Even though TemporaryDirectory is used, genomic and phenotype data are highly sensitive, and the script provides no consent notice, retention guidance, or file-permission hardening beyond platform defaults.

Missing User Warnings

Medium

Confidence: 99% confidence
Finding: The script downloads the GENCODE annotation over plain HTTP, allowing a man-in-the-middle attacker to tamper with the gzip payload in transit. Because the downloaded file is parsed and used to generate a local reference database that can influence downstream genomic interpretation, this creates a supply-chain integrity risk and could silently poison analytical results.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The code sends user-supplied clinical phenotype text to an external LLM API, which may contain sensitive health or genetic information, without any consent gate, disclosure, minimization, or de-identification. In a genomic analysis skill, this materially increases privacy and compliance risk because phenotype data can be highly sensitive and potentially identifying when combined with gene context.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.