GPA Genomic Phenotype Association

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:52 AM UTC
• Version: 0.8.0

Overview

This genomics analysis skill is mostly purpose-built, but it needs review because it can send sensitive variant and phenotype data to external services and persist genomic caches without strong privacy controls.

Install only after reviewing the privacy implications. Use offline mode by default for patient or identifiable genomic data, avoid setting OPENAI_API_KEY unless external phenotype processing is explicitly acceptable, run in an isolated virtual environment or container, and treat reports as decision-support requiring qualified clinical review. Clear or protect the cache directory after sensitive analyses.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/gpa_phenotype_match.py:20

Finding

Automatic Disclosure of Clinical Phenotype Data to OpenAI

Content

View full analysis

str: known_str = json.dumps( known_phenotypes, ensure_ascii=False, indent=2 ) return ( f"You are a medical genetics expert. Evaluate the semantic association between " f"the known disease phenotypes of gene {gene} and the user's clinical phenotypes.\n\n" f"Gene: {gene}\n" f"Known phenotypes: {known_str}\n" f"User phenotypes: {user_phenotype ...[truncated 3033 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/dgra_cache.py:70

Finding

Genomic Query Data Is Persisted Without Enforced Restrictive File Permissions

Content

View full analysis

None: cache_key = self._make_key(api_name, **params) now = time.time() ttl = (ttl_days * 86400) if ttl_days else self.default_ttl expires = now + ttl with self._connection() as conn: conn.execute( """INSERT INTO api_cache (cache_key, api_name, query_params, response_data, created_at, expires_at, http_status, confidence) VALUES (?, ?, ?, ?, ?, ?, ?, ?) ON CONFLICT(cache_key) DO UPDATE SET response_data = excluded.response_data, created_at = excluded.created_at, expires_at = excluded.expires_at, http_status = excluded.http_status, confidence = excluded.confidence, hit_count = 0""", ( cache_key, api_name, json.dumps(params), json.dumps(response_data) ...[truncated 2704 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: scripts/dgra_pseudogene_sync.py:26

Finding

GENCODE Reference Data Is Downloaded over Plaintext HTTP Without Integrity Verification

Content

View full analysis

Path: import urllib.request existing_size = 0 headers = {} if output_path.exists(): existing_size = output_path.stat().st_size if existing_size > 0: headers["Range"] = f"bytes={existing_size}-" req = urllib.request.Request(url, headers=headers) downloaded = existing_size mode = "ab" if existing_size > 0 else "wb" with urllib.request.urlopen(req) as response: if response.status not in (200, 206): raise RuntimeError( f"HTTP {response.status}: download failed" ) with open(output_path, mode) as f: while True: chunk = response.read(chunk_size) if not chunk: break f.write(chunk) downloaded += len(chunk) return output_path ``` ```python GENCODE_GTF_URL = ( "http://ftp.ebi.ac.uk/pub/databases/gencode/" "Gencode_human/release_48/gencode.v48.annotation.gtf.gz" ) GENCODE_RELEASE = "48" PSEUDOGENE_TTL_DAYS = 30 ``` ```python _log( "DOWNLOAD_START", f"URL={GENCODE_GTF_URL}, output={gtf_gz_path}", ) try: _download_gtf_streaming( GENCODE_GTF_URL, gtf_gz_path, ) _log( "DOWNLOAD_OK", f"path={gtf_gz_path}, size={gtf_gz_path.stat().st_size}", ) ``` ### Technical Analysis The pseudogene synchronization process downloads a GENCODE GTF archive over plaintext HTTP. Plain HTTP does not authenticate the server and does not protect response integrity. The code accepts any response with status 200 or 206 and does not validate: - An official cryptogr ...[truncated 2340 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Dependencies Are Installed Without Exact Version or Hash Pinning

Content

View full analysis

=3.9.0 cyvcf2 openpyxl>=3.1.0 ``` ### Technical Analysis The dependency manifest permits mutable package resolution: - `aiohttp>=3.9.0` accepts any later release. - `openpyxl>=3.1.0` accepts any later release. - `cyvcf2` has no version constraint. - No artifact hashes are specified. As a result, two installations performed at different times may execute different dependency code even though the audited project files are unchanged. If a future package release is compromised, malicious, or incompatible, the installation process may retrieve it automatically. The documented `--break-system-packages` command also encourages users to bypass Python distribution safeguards and modify the system-managed Python environment. This broadens the possible effect of a compromised or incompatible package beyond an isolated virtual environment. No evidence was found that the named package identifiers are typosquatted or intentionally malicious. The confirmed issue is the absence of reproducible, integrity-checked dependency resolution. ### Attack Path 1. A user follows the documented installation command. 2. `pip` queries the configured package index and resolves the latest versions satisfying the broad constraints. 3. A future compromised, malicious, or otherwise unsafe compatible release is selected. 4. The package is downloaded without validation against a project-maintained expected hash. 5. Installation or later import executes the dependency's code. 6. If `--break-system-packages` is used, the package may modify or interfere w ...[truncated 721 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (82)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The document directs the system to send gene and variant inputs to multiple third-party APIs without any explicit privacy warning, consent model, de-identification guidance, or offline-default safeguard. In the context of genomic phenotype analysis, transmitting variant-level data off-system can expose uniquely identifying medical information to external providers, creating substantial privacy, compliance, and data-governance risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Infrastructure and retry/build-state testing exposed under a genomics-analysis skill can cause agents to invoke operational code paths unrelated to the user's request, while still trusting the skill as medically meaningful. The context amplifies risk because sensitive genomic data may be handled by ancillary tooling not intended for end-user interpretation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Infrastructure and retry/build-state testing exposed under a genomics-analysis skill can cause agents to invoke operational code paths unrelated to the user's request, while still trusting the skill as medically meaningful. The context amplifies risk because sensitive genomic data may be handled by ancillary tooling not intended for end-user interpretation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Infrastructure and retry/build-state testing exposed under a genomics-analysis skill can cause agents to invoke operational code paths unrelated to the user's request, while still trusting the skill as medically meaningful. The context amplifies risk because sensitive genomic data may be handled by ancillary tooling not intended for end-user interpretation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Infrastructure and retry/build-state testing exposed under a genomics-analysis skill can cause agents to invoke operational code paths unrelated to the user's request, while still trusting the skill as medically meaningful. The context amplifies risk because sensitive genomic data may be handled by ancillary tooling not intended for end-user interpretation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Infrastructure and retry/build-state testing exposed under a genomics-analysis skill can cause agents to invoke operational code paths unrelated to the user's request, while still trusting the skill as medically meaningful. The context amplifies risk because sensitive genomic data may be handled by ancillary tooling not intended for end-user interpretation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Infrastructure and retry/build-state testing exposed under a genomics-analysis skill can cause agents to invoke operational code paths unrelated to the user's request, while still trusting the skill as medically meaningful. The context amplifies risk because sensitive genomic data may be handled by ancillary tooling not intended for end-user interpretation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Infrastructure and retry/build-state testing exposed under a genomics-analysis skill can cause agents to invoke operational code paths unrelated to the user's request, while still trusting the skill as medically meaningful. The context amplifies risk because sensitive genomic data may be handled by ancillary tooling not intended for end-user interpretation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

Infrastructure and retry/build-state testing exposed under a genomics-analysis skill can cause agents to invoke operational code paths unrelated to the user's request, while still trusting the skill as medically meaningful. The context amplifies risk because sensitive genomic data may be handled by ancillary tooling not intended for end-user interpretation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Infrastructure and retry/build-state testing exposed under a genomics-analysis skill can cause agents to invoke operational code paths unrelated to the user's request, while still trusting the skill as medically meaningful. The context amplifies risk because sensitive genomic data may be handled by ancillary tooling not intended for end-user interpretation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Infrastructure and retry/build-state testing exposed under a genomics-analysis skill can cause agents to invoke operational code paths unrelated to the user's request, while still trusting the skill as medically meaningful. The context amplifies risk because sensitive genomic data may be handled by ancillary tooling not intended for end-user interpretation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Infrastructure and retry/build-state testing exposed under a genomics-analysis skill can cause agents to invoke operational code paths unrelated to the user's request, while still trusting the skill as medically meaningful. The context amplifies risk because sensitive genomic data may be handled by ancillary tooling not intended for end-user interpretation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Infrastructure and retry/build-state testing exposed under a genomics-analysis skill can cause agents to invoke operational code paths unrelated to the user's request, while still trusting the skill as medically meaningful. The context amplifies risk because sensitive genomic data may be handled by ancillary tooling not intended for end-user interpretation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The SETBP1 entry lists pseudogene "VWFP1", which is inconsistent with the gene name and also contradicts the note claiming a chr18 relationship that does not align with the referenced pseudogene. In a genomic risk analysis skill, corrupted pseudogene mappings can directly bias artifact detection logic, causing true variants to be filtered out or false artifacts to be accepted, which can misclassify medically significant findings.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · scripts/dgra_core.py (reported line 750)May include surrounding context.

python

# Unknown symbol - keep original, mark warning
            if offline_mode:
                # In offline mode, we can't validate. Only warn if symbol looks suspicious.
                # Known symbols from our common lists are accepted without warning.
                known_symbols = {
                    "VWF", "F8", "F9", "F7", "F10", "F11", "F12", "F13A1", "F13B",
                    "PROC", "PROS1", "SERPINC1", "SERPIND1", "PLG", "THBD",

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest explicitly advertises automatic gnomAD frequency querying, but the implementation performs client.query_gnomad_variant(...) after leaving async with DGRAAPIClient(...) as client:. This strongly suggests the advertised live gnomAD variant-frequency enrichment may not actually work reliably in practice, creating a direct description-versus-behavior mismatch.

Content

No source excerpt is available for this finding.

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · tests/test_a_layer.py (reported line 91)May include surrounding context.

python

self.assertEqual(get_step_status("fail_ctx"), "failed")

    def test_state_recovery_after_deletion(self):
        """Test 5: Delete state for a step, it should re-execute."""
        save_state("gtf_download", {"status": "complete", "size": 1000})
        self.assertTrue(is_step_complete("gtf_download"))

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file title and all changelog content are written in Chinese, and the document does not indicate that language selection is optional or that the skill is limited to a Chinese-speaking or region-specific audience. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest describes the skill as 'gpa-genomic-phenotype' with phenotype association, somatic/germline modes, phase analysis, bilingual term mapping, ClinVar conflict/review-star evaluation, and SpliceAI integration. This file instead specifies 'DGRA v0.4.1' architecture centered on API-first genomic risk analysis, with no mention of several manifest-promised GPA capabilities and with different module names and scope framing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The design specifies a persistent SQLite cache stored on disk for genomic query results, but provides no warning, minimization strategy, or protection guidance for sensitive data derived from variants and clinical interpretation lookups. In a genomics skill, even cached gene/variant queries can reveal highly sensitive health information and may persist beyond user expectations on shared systems or backups.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Module E states 'No hardcoded gene list' and describes API-driven tissue relevance rules, implying hardcoded lists are eliminated. Later, the offline-mode section explicitly says special_gene_lists checks remain available and even claims tiering for genes like VWF/FANCD2/ABCB1 depends on those local lists, which directly contradicts the earlier intent statement.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README explicitly states that genomic variant data is sent to multiple external APIs for annotation, but it does not provide a clear privacy warning, consent requirement, or data-handling guidance. Genomic data is highly sensitive and often identifiable; transmitting it to third-party services without explicit disclosure can create serious privacy, compliance, and confidentiality risks, especially in clinical or screening contexts.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence

Finding

The skill advertises executable behavior that can access shell, network, environment, and filesystem, but it does not declare any explicit tool scope or permission boundaries. In a medical/genomic workflow, this creates avoidable ambiguity about what the skill is allowed to do and increases the chance of over-privileged execution, unintended data access, or unsafe invocation by an agent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The description advertises '中英文术语映射', but the document is written as a mandatory Chinese-facing workflow and does not clearly offer the user a choice of output language. Per policy, forcing a specific language or locale without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger scope includes very generic words like 'risk', 'mutation', and 'variant', which can cause the skill to activate for broad conversations outside validated genomic use cases. Over-triggering is risky here because the skill then pushes mandatory script usage and may handle sensitive inputs or produce authoritative-seeming medical output when not appropriate.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.