T09 · Insecure Skill Coding Practices
Error
- Location
main.py:28- Finding
Fabricated BLAST identification results are presented as genuine
- Content
View full analysis
- Remediation
View remediation
Security audit
strain identification
Security checks for vulnerabilities and agentic risk
Overview
The skill uploads sequence data to NCBI and writes reports, but its strain-identification output appears hard-coded rather than based on completed BLAST results.
Do not rely on this skill for real strain identification as written. Before installing, require actual BLAST result polling and parsing, explicit consent before uploading sequences to NCBI, input path and file-size limits, user-controlled report output, and pinned reviewed dependencies.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
main.py:13- Finding
Unrestricted file paths and unbounded input processing permit local-file disclosure and denial of service
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
requirements.txt:1- Finding
Open-ended dependency constraints make installations non-reproducible
- Content
View full analysis
=1.81 python-docx>=0.8.11 requests>=2.31.0 ``` ### Technical Analysis All dependencies use open-ended minimum-version constraints. A future installation can therefore resolve to package versions that were not available or reviewed when the skill was audited. The project also contains no lock file or package hashes that would verify the exact artifacts installed. The package names correspond to established dependencies, and the reviewed files contain no evidence that the currently named packages are malicious. The risk arises from unconstrained future resolution, compromised distribution infrastructure, account compromise, or incompatible releases rather than from a confirmed malicious package in the current manifest. Because Python packages may execute code during installation and are imported into the skill process at runtime, dependency substitution or compromise can affect the confidentiality, integrity, and availability of the host environment. ### Attack Path 1. The skill is installed or rebuilt at a later date. 2. The package resolver selects any version satisfying the open-ended `>=` constraints. 3. A newly released, compromised, or otherwise unreviewed permitted version is downloaded. 4. Installation or import executes package-controlled code within the skill environment. 5. That code receives the privileges available to the installer or runtime process. Exploitation requires compromise or unsafe resolution of a dependency or package index; the manifest alone does not prove that such a compromise has occurred. ### Impact Assessment A compromised dependency could execute code with the privileges of the environment installing or running the skill. Depending on deployment permissions, this could expose accessible files ...[truncated 251 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (13)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The code sends raw biological sequence data to the external NCBI BLAST service via an HTTP request without any consent prompt, warning, configuration gate, or redaction option. Even though NCBI uses HTTPS, sequence data may still be sensitive, proprietary, or regulated, so undisclosed transmission to a third party creates a real confidentiality and compliance risk.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill uses a generic "text" trigger with no visible scope restrictions, invocation constraints, or authorization context. That increases the chance the skill can be invoked unexpectedly or by overly broad inputs, which is risky because the described workflow performs file handling, external BLAST lookups, DingTalk table updates, and document generation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly states it will perform online NCBI BLAST comparisons on user-provided sequencing files, which implies local file contents are transmitted to an external service. Because the description does not clearly warn users about this outbound data transfer, users may unknowingly disclose potentially sensitive biological or customer-associated sample data, making this a real privacy and data-handling issue.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 72% confidence
- Finding
User-visible messages such as return values and report labels are hardcoded in Chinese, and there is no indication that the skill supports user language selection or is intentionally limited to a Chinese-speaking context. This can violate language/locale policy when a skill forces a specific language without user opt-in.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The skill writes a Word report to disk automatically using a default filename, without warning the user or allowing control over storage location and retention. This can expose sample identifiers and identification results to other local users, backups, shared directories, or later unintended disclosure on multi-user or managed systems.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
The dependency is specified with a lower-bound constraint instead of an exact pinned version, which makes builds non-reproducible and can cause different environments to install different releases. This increases supply-chain risk and makes it harder to verify whether a known-vulnerable or unexpectedly breaking version is being pulled in.
- Content
text biopython>=1.81 python-docx>=0.8.11 requests>=2.31.0
Unverifiable Dependency: biopython has 2 known advisory(ies) (CVE-2025-68463 (Biopython is vulnerable to doctype XML external entity (XXE) injection through B); CVE-2025-68463 (Biopython is vulnerable to doctype XML external entity (XXE) injection through B)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 86% confidence
- Finding
Biopython has known advisories, and because the manifest does not pin an exact version, it is impossible to determine from this file alone whether deployment will install an affected release. This uncertainty is dangerous because vulnerable versions may be selected silently depending on resolver behavior and environment state.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
Using an unpinned minimum version for python-docx allows dependency resolution to drift over time, reducing reproducibility and weakening assurance about what code is actually installed. That uncertainty can expose deployments to newly introduced vulnerable or malicious releases in the dependency chain.
- Content
text biopython>=1.81 python-docx>=0.8.11 requests>=2.31.0
Unverifiable Dependency: python-docx has 2 known advisory(ies) (CVE-2016-5851 (Improper Restriction of XML External Entity Reference in python-docx); CVE-2016-5851 (python-docx before 0.8.6 allows context-dependent attackers to conduct XML Exter)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 91% confidence
- Finding
Python-docx has known XXE-related advisories, and the unpinned requirement makes it unverifiable whether a safe or vulnerable version will be installed. If this package is used to process attacker-controlled documents, a vulnerable version could enable XML external entity attacks and related file disclosure or SSRF-style behavior.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
Requests is declared with only a minimum version, so future installs may resolve to different versions with different security properties. Because requests is network-facing and has a history of advisories, leaving it unpinned increases the chance of pulling an affected release or creating inconsistent security behavior across environments.
- Content
text biopython>=1.81 python-docx>=0.8.11 requests>=2.31.0
Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
Requests has many known advisories, and without exact version pinning there is no reliable way to verify that installations avoid affected releases. Since this library handles outbound HTTP behavior and credentials-related functionality, installing a vulnerable version can create meaningful exposure such as information leakage or unsafe request handling.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The natural-language description is entirely in Chinese and describes a fixed workflow using Chinese-language systems and outputs, but it does not indicate that the user can choose another language or locale. This can violate language or locale policy when a skill implicitly enforces one language without explicit opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The user-facing instructions, parameters, and notes are presented in Chinese without any indication of language selection or opt-in. This can violate language or locale policy where skills should not force a specific language without user choice or explicit documentation.
- Content
Static analysis
No suspicious patterns detected.