Security audit

ClawBio Equity Scorer

Security checks for vulnerabilities and agentic risk

Overview

This local genomics reporting skill shows no exfiltration or persistence, but it needs Review because it can produce sensitive and potentially misleading ancestry/genetic reports without enough safeguards.

Install only if you are comfortable running a local genomics/ancestry analysis tool that writes persistent reports and tables. Use a private output directory, avoid shared machines for sensitive data, provide an explicit reviewed population map instead of relying on inferred labels, treat CSV-only HEIM scores as limited summaries, and avoid opening generated CSV/Markdown from untrusted labels with spreadsheet formulas or remote content enabled.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:15
Finding: Unpinned Third-Party Dependencies Permit Supply-Chain Drift
Content: View full analysis
Remediation: View remediation
`. 2. Generate and commit a lockfile that also fixes all transitive dependency versions. 3. Require cryptographic hashes for downloaded distributions and reject artifacts whose hashes do not match. 4. Prefer reviewed binary wheels from a trusted package index, and explicitly restrict the allowed package index. 5. Configure installation to reject unexpected source distributions where practical, reducing exposure to build-time code execution. 6. Use automated dependency vulnerability and provenance scanning in CI. 7. Periodically update dependencies through a controlled review process rather than resolving unrestricted current releases during installation. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: equity_scorer.py:657
Finding: Unescaped Population Labels Permit Markdown and Spreadsheet-Formula Injection
Content: View full analysis
0 else float("inf") o_het = obs_het.get(pop, 0) e_het = exp_het.get(pop, 0) pop_rows.append( "| %s | %d | %.1f%% | %.1f%% | %.2fx | %.4f | %.4f |" % (pop, count, pct, global_pct, ratio, o_het, e_het) ) ``` The resulting report is written without sanitization: ```python report_path = output_dir / "report.md" report_path.write_text(report) ``` Population labels are also written directly into CSV output in the VCF pipeline: ```python pd.DataFrame([ {"population": k, "count": v, "proportion": v / sum(pop_counts.values()), "obs_het": obs_het.get(k, 0), "exp_het": exp_het.get(k, 0)} for k, v in sorted(pop_counts.items()) ]).to_csv(tables_dir / "population_summary.csv", index=False) ``` The ancestry CSV pipeline has the same CSV output behavior: ```python pd.DataFrame([ {"population": k, "count": v, "proportion": v / sum(pop_counts.values())} for k, v in sorted(pop_counts.items()) ]).to_csv(tables_dir / "population_summary.csv", index=False) ``` ### Technical Analysis Population labels originate from user-supplied ancestry CSV data, population-map CSV data, or VCF sample-derived values. These labels are treated as trusted display values when constructing Markdown and CSV outputs. For Markdown reports, characters such as pipes, brackets, parentheses, newlines, and image syntax are not escaped. A crafted label can break the expected table structure and inject arbitrary Markd ...[truncated 2558 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill describes generating reports, figures, tables, and reproducibility artifacts on disk, which implies file-write behavior, but it does not declare any explicit tool scope or permissions restricting where writes may occur. In an agent framework, undeclared write capability increases the risk of unintended or overbroad filesystem modification, especially if output paths are influenced by user input or runtime context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: When no population map is provided, the tool infers ancestry labels from sample ID prefixes and then uses those inferred labels in scoring, plots, and persisted reports without warning users that the labels are guesses. In a genomics setting, this can propagate incorrect or stigmatizing ancestry assignments into durable artifacts and contaminate downstream analyses.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The implementation computes a Nei's GST-style estimator, but the generated report labels the result as Hudson FST. In this domain, metric mislabeling can mislead users about methodological validity, comparability to published work, and the meaning of reported population differentiation values.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The pipeline writes ancestry/genotype-derived summaries, plots, tables, and a markdown report to disk by default without an explicit privacy notice, consent checkpoint, or data-minimization controls. Because the skill processes sensitive human genetic and ancestry information, these outputs can create confidentiality and re-identification risks if stored in shared locations or retained longer than intended.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: In CSV ancestry mode, the tool assigns hard-coded heterozygosity estimates and still produces a HEIM score and report that can be interpreted as if they were derived from real genetic variation data. In a genomics/equity-analysis context, this is dangerous because downstream users may make scientific, clinical, or policy decisions based on fabricated diversity metrics and an incomplete analysis lacking real FST/PCA computation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.