ClawHub
Back to skill

Security audit

NutriGx Advisor

Security checks for vulnerabilities and agentic risk

Overview

The skill is a local genetic-nutrition reporter, but it needs review because it stores exact genotype data despite saying it will not and generates an unsafe reproducibility shell script.

Review before installing. Only use it with your own DNA data or data you have clear consent to analyze, keep the output directory private, and assume the report and images contain sensitive genetic information. Do not run the generated commands.sh for analyses involving untrusted or unusual file paths until the shell quoting issue is fixed. Treat the nutrition and supplement recommendations as educational and discuss significant changes with a qualified clinician.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
repro_bundle.py:44
Finding

Shell Command Injection in Generated Reproducibility Script

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
generate_report.py:173
Finding

Sensitive Genotype Data Is Written to Reports Contrary to the Privacy Guarantee

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (14)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The introductory description explains functionality but does not prominently warn users that the skill handles extremely sensitive genetic and health-adjacent data, which can lead to uninformed use and unsafe sharing of raw genome files. This omission is more serious here because the skill invites uploads of consumer DNA files and produces personalized health-related outputs, so users need clear upfront notice before engaging.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrases are broad enough to activate this skill for generic nutrition or genetics requests, which can cause the orchestrator to route users into a workflow that processes highly sensitive genetic data or provides genotype-based recommendations when the user did not clearly request that. In this context, misrouting is more dangerous than usual because the skill deals with health-related interpretation of DNA data, so an overly permissive trigger surface increases privacy and safety risk.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · examples/generate_patient.py (reported line 277)May include surrounding context.

python
if args.no_figures:
                cmd.append("--no-figures")
            print(f"[generate_patient] Running: {' '.join(cmd)}")
            subprocess.run(cmd, check=True)


if __name__ == "__main__":

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The document says it is not medical advice, but then gives individualized, genotype-based recommendations such as target vitamin D levels, supplement preferences, dosage-like intake caps, and nutrient interventions. In a genetics context, this can cause users to act on quasi-clinical guidance without appropriate review, creating health and liability risk despite the disclaimer.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The report provides actionable supplement and dietary guidance based on genetic data without nearby warnings about the sensitivity of genomic information or a strong clinician-review checkpoint at the recommendation site. Because genomic data is highly sensitive and health recommendations may be misunderstood as prescriptive, the context makes this more dangerous than generic nutrition content.

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · examples/output/nutrigx_report.md (reported line 270)May include surrounding context.

md
"## References",
        "",
        "SNP-nutrient associations sourced from GWAS Catalog, ClinVar, and CPIC guidelines.",
        "Full citations available in `skills/nutrigx-advisor/SKILL.md`.",
        "",
    ]

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · generate_report.py (reported line 219)May include surrounding context.

python
"## References",
        "",
        "SNP-nutrient associations sourced from GWAS Catalog, ClinVar, and CPIC guidelines.",
        "Full citations available in `skills/nutrigx-advisor/SKILL.md`.",
        "",
    ]

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This function writes a detailed personalized genetic nutrition report to disk, including sensitive health/genetic risk interpretations and the input filename, without any explicit consent gate, warning, or privacy-preserving controls in this code path. If the output directory is shared, backed up, synced, or readable by other users/processes, this can expose highly sensitive personal data and create compliance/privacy risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The code saves radar and heatmap image files that encode genetic risk information to disk without an explicit warning or consent step in this file. These images may be easier to casually view, copy, index, or share than the main report, increasing the chance of unintended disclosure of sensitive genetic/health inferences.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This CLI skill processes highly sensitive genetic data and creates output artifacts, including a reproducibility bundle, without any explicit privacy notice, consent prompt, or description of how input data will be stored and copied. In the context of genomic data, silent handling and duplication of files materially increases the risk of unintended retention, disclosure, or insecure downstream use by operators who may not realize the sensitivity of the data.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The module docstring states that using --run produces output in "nutrigx_results_/", but the implementation writes results to "examples/output/results_". This is an active contradiction between the documented behavior and the actual file location, not just an omitted detail.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

This code writes several files to disk, including commands.sh, environment.yml, checksums.txt, and provenance.json, but the function contains no confirmation prompt, print/log message, or inline warning to inform the user at execution time. For code files, file writes are safety-relevant operations when there is no visible disclosure in code or comments explaining the action to the user.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.