pancreatic-lipase-pro-docking

• Outcome: Review
• Latest audit: Sep 7, 2026 · 10:35 AM UTC
• Version: 101.0.7

Overview

This appears to be a real molecular docking skill, but it needs Review because optional install/cloud paths can run unpinned downloaded tooling and the Kaggle path can expose ligand data in logs.

Install only if you are comfortable reviewing and controlling the optional setup and cloud paths. Prefer a fresh project-local or containerized environment, avoid the optional pip --user bootstrap, do not run setup_mamba.sh unless you accept downloading and executing unpinned micromamba, and do not use Kaggle or PubChem for confidential compound names, SMILES, or proprietary screening libraries. Run the validation and drift checks before relying on results.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: docking_professional_stack/setup_mamba.sh:9
• Finding: Unverified Remote Micromamba Retrieval and Execution<![CDATA[ ## Vulnerability Details **File Locations**: - `docking_professional_stack/setup_mamba.sh:9-15` - `docking_professional_stack/setup_full_stack.sh:14-19` - `scripts/kaggle_dock.py:197-205` **Vulnerability Type**: Remote payload retrieval and execution without artifact verification **Risk Level**: High ### Vulnerable Code ```bash if ! command -v micromamba >/dev/null 2>&1 && ! command -v mamba >/dev/null 2>&1 && ! command -v conda >/dev/null 2>&1; then echo "No conda/mamba found. Installing micromamba locally into $HOME/micromamba ..." mkdir -p "$HOME/micromamba" curl -Ls https://micro.mamba.pm/api/micromamba/linux-64/latest | tar -xvj -C "$HOME/micromamba" bin/micromamba export PATH="$HOME/micromamba/bin:$PATH" eval "$(micromamba shell hook -s bash)" micromamba create -y -n base -c conda-forge ``` ```bash if ! command -v micromamba >/dev/null 2>&1 && ! command -v mamba >/dev/null 2>&1 && ! command -v conda >/dev/null 2>&1; then echo "No conda/mamba found. Installing micromamba locally into $HOME/micromamba ..." mkdir -p "$HOME/micromamba" curl -Ls https://micro.mamba.pm/api/micromamba/linux-64/latest | tar -xvj -C "$HOME/micromamba" bin/micromamba export PATH="$HOME/micromamba/bin:$PATH" eval "$(micromamba shell hook -s bash)" fi ``` ```python print("== installing toolchain (micromamba) ==", flush=True) r = sh("curl -Ls https://micro.mamba.pm/api/micromamba/linux-64/latest " "| tar -xvj -C /kaggle/working bin/micromamba") MM = "/kaggle/working/bin/micromamba" if not Path(MM).exists(): print("FATAL: micromamba download failed — is internet enabled on this kernel?") print(r.stdout[-2000:], r.stderr[-2000:]) sys.exit(4) ``` ### Technical Analysis These installation paths download a mutable `latest` Micromamba archive and immediately extract the included executable. No cryptographic checksum, signature, release version, or expected archive size is verified. The local installers subsequently execute the download ...[truncated 1860 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin a specific Micromamba release instead of using the mutable `latest` endpoint. 2. Download the archive to a temporary file before extraction. 3. Verify a project-maintained SHA-256 or SHA-512 digest and abort on any mismatch. 4. Where supported, verify the upstream release signature using a pinned trusted public key. 5. Validate the archive member list before extraction and reject absolute paths, symbolic-link escapes, and traversal components. 6. Execute the verified binary directly and avoid `eval` where possible. If the shell hook is necessary, document why and only evaluate output from a cryptographically verified binary. 7. Apply the same verification controls to the generated Kaggle kernel. 8. Prefer an already installed, trusted package manager or a prebuilt image with a locked environment. ]]>

T08 · Insecure Dependencies

Warning

• Location: docking_professional_stack/arena_auto_run.py:78
• Finding: Unpinned and Account-Wide Third-Party Dependency Installation<![CDATA[ ## Vulnerability Details **File Locations**: - `docking_professional_stack/arena_auto_run.py:78-96` - `docking_professional_stack/environment.yml:1-41` - `SKILL.md:38-41` **Vulnerability Type**: Insecure dependency resolution and persistent account-wide package modification **Risk Level**: Medium ### Vulnerable Code ```python pkgs = ['rdkit', 'meeko', 'vina', 'gemmi', 'pandas', 'numpy', 'scipy', 'scikit-learn'] # v101.0.5: this used to run unconditionally. `pip install --user --upgrade` # mutates the user's account-wide site-packages and can UPGRADE unrelated # existing installs — a persistent environment change the skill's own # documentation said it would not make. It is now strictly opt-in. if os.environ.get('HPL_ALLOW_PIP_BOOTSTRAP') != '1': print('Missing dependencies: ' + ', '.join(missing_mods + missing_cmds), file=sys.stderr) print('Refusing to auto-install: `pip install --user --upgrade` would modify your\n' 'account-wide Python environment and may upgrade unrelated packages.\n' 'Recommended (isolated, nothing global):\n' ' micromamba create -p plenv -c conda-forge python=3.11 rdkit meeko vina gemmi openbabel pytest\n' ' export PATH="$PWD/plenv/bin:$PATH"\n' 'To opt in to the old behaviour anyway: HPL_ALLOW_PIP_BOOTSTRAP=1', file=sys.stderr) return print('HPL_ALLOW_PIP_BOOTSTRAP=1 set — running pip --user bootstrap...') cmd = [sys.executable, '-m', 'pip', 'install', '--user', '--upgrade'] + pkgs ``` ```yaml name: pro-docking channels: - conda-forge - bioconda - defaults channel_priority: strict dependencies: - python=3.11 - pip - numpy - scipy - pandas - scikit-learn - matplotlib - seaborn - jupyterlab - rdkit - openbabel - pdbfixer - openmm - mdtraj - mdanalysis - ambertools - autodock-vina - gemmi - biopython - requests - beautifulsoup4 - tqdm - pyyaml - networkx - pip: - meeko - prolif - pubch ...[truncated 2292 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Produce platform-specific Conda lock files containing exact versions and build identifiers. 2. For pip packages, use exact versions and require hashes through a locked requirements file. 3. Replace `pip install --user --upgrade` with installation into a dedicated virtual environment or project-local prefix. 4. Remove `--upgrade` unless an explicitly requested migration requires it. 5. Minimize the dependency set to packages required by the selected docking route. 6. Separate optional reporting, simulation, notebook, and cloud dependencies from the core docking environment. 7. Use trusted package indexes explicitly and document their trust assumptions. 8. Add automated vulnerability and provenance scanning for each locked release. 9. Rebuild and review lock files through a controlled release process rather than resolving packages during every run. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/kaggle_dock.py:189
• Finding: Confidential Ligand Data Exposed in Kaggle Kernel Logs<![CDATA[ ## Vulnerability Details **File Location**: `scripts/kaggle_dock.py:189-194` **Vulnerability Type**: Unnecessary plaintext logging of uploaded molecular data **Risk Level**: Medium ### Vulnerable Code ```python # 1) unpack the stack shipped inside this script (no external dataset needed) print("== unpacking docking stack ==", flush=True) zipfile.ZipFile(io.BytesIO(base64.b64decode(STACK_B64))).extractall(WORK) assert (STACK / "multi_site_docking.py").exists(), "stack unpack failed" # 2) ligands shipped inline too (WORK / "ligands.csv").write_text(base64.b64decode(LIGANDS_B64).decode()) print((WORK / "ligands.csv").read_text()[:500], flush=True) ``` ### Technical Analysis The Kaggle workflow necessarily uploads the ligand CSV to the selected cloud kernel, and this transfer is disclosed in `SKILL.md`. However, the generated kernel additionally prints the first 500 characters of the decoded CSV to standard output. Kernel output is retained as run logs. Molecule names, SMILES strings, annotations, and other CSV columns can consequently appear in plaintext in those logs. Printing raw molecular records is not required to verify input validity or perform docking. The default kernel setting is private, which reduces exposure, but users can select `--public`. Logs may also be available to collaborators, account administrators, or anyone who later receives access to the kernel. ### Attack Path 1. A user supplies a ligand CSV containing confidential compound names, SMILES strings, or project annotations. 2. The user invokes `kaggle_dock.py push` or `kaggle_dock.py run`. 3. The script embeds the CSV into the generated Kaggle kernel and uploads it. 4. The kernel decodes the CSV and prints its first 500 characters. 5. Kaggle retains that output in the kernel logs. 6. A collaborator, account intruder, public viewer, or other party with log access reads the exposed molecular data. ### Impact Assessment Up to the first 500 characters of the ligand CSV can be ...[truncated 404 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the raw-content logging statement: ```python print((WORK / "ligands.csv").read_text()[:500], flush=True) ``` 2. Log only non-sensitive validation metadata, such as: - File byte length - Number of rows - Normalized column names - A non-reversible SHA-256 digest 3. Avoid logging molecule names, SMILES strings, free-text notes, or experimental annotations. 4. Emit an explicit warning and request confirmation before allowing `--public` for a kernel containing uploaded ligand data. 5. Consider rejecting `--public` by default unless a separate high-friction acknowledgment flag is supplied. 6. Document the retention and access implications of Kaggle kernel logs. 7. Add a regression test that asserts the generated kernel template never prints or previews `ligands.csv`. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (138)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

or str(Path(python).parent / "vina") if Path(python).parent.joinpath("vina").exists()
                else _sh.which("vina"))
    try:
        v = subprocess.run([vina_bin or "vina", "--version"],
                           capture_output=True, text=True, timeout=30)
        line = (v.stdout or v.stderr).strip().splitlines()
        fp["vina"] = line[0][:80] if line else "unknown"

• Confidence: 84% confidence
• Finding: The code resolves and executes `vina` from PATH or from a path adjacent to a user-supplied `--python` interpreter, then records its output as trusted environment metadata. In a hostile workspace or manipulated environment, an attacker could place a malicious `vina` binary earlier in PATH and obtain arbitrary code execution when selfcheck runs.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

fp["vina"] = "unavailable"
    for mod in ("rdkit", "meeko", "numpy"):
        try:
            r = subprocess.run(
                [python, "-c", f"import {mod},sys; "
                               f"print(getattr({mod},'__version__','?'))"],
                capture_output=True, text=True, timeout=60)

• Confidence: 78% confidence
• Finding: The script executes whatever interpreter is provided via `--python` to import modules and print versions. If an attacker can influence that argument, the tool will run an arbitrary executable under the guise of version probing, which is direct command execution.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill declares substantial capabilities in prose—package installation, shell execution, file writes, archive extraction, optional network calls, and Kaggle uploads—while lacking explicit declared permissions. This creates a trust and review gap: users and enforcement layers may underestimate what the skill can do, increasing the chance of unintended execution of networked or system-modifying actions.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence
• Finding: The documented purpose presents a tightly validated local docking workflow, but the skill also exposes broader behaviors such as PubChem network resolution, Kaggle upload paths, bootstrap/install helpers, and batch orchestration. More importantly, critical safety/quality gates like native re-dock RMSD and calibration drift checks are described as trust anchors but are not enforced in the main run path, which can lead users to publish or act on unvalidated results under a false sense of assurance.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The added name-resolution flow expands the skill from operating on user-supplied molecular inputs to fetching or resolving external identifiers, which increases scope and may trigger unreviewed network access, third-party dependency behavior, or ingestion of unexpected data. In a constrained agent environment, this broadening matters because it enables actions beyond the manifest’s stated docking workflow and can surprise users who expected purely local processing.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: Automatically installing packages into the user environment is an environment-modification capability that exceeds the core purpose of ranking ligands and can alter system state without explicit approval. This is dangerous because package installation can introduce supply-chain risk, break reproducibility, and persist changes that affect other workflows or data in the same environment.

Intent-Code Divergence

High

• Confidence: 91% confidence
• Finding: The README states that native-ligand redocking RMSD and related validation layers still require project-specific extension, while the skill metadata claims native re-dock RMSD gating and calibration drift detection are already included. In a scientific workflow skill, this mismatch can cause users to rely on validation and quality-control safeguards that may not actually exist, leading to untrusted docking outputs being treated as vetted results.

Context-Inappropriate Capability

Medium

• Confidence: 76% confidence
• Finding: The documentation recommends sharding molecule data and sending it to multiple external AI providers via a user-chosen router/orchestrator. Even without embedded API keys, this creates a real data-governance and confidentiality risk because sensitive compound lists, screening priorities, or proprietary research context may be disclosed to third parties outside the core local docking workflow. In this skill context, the danger is moderated because the feature is explicitly optional and documented, but it still expands the data exposure surface beyond the stated docking function.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The module docstring states thiophenol should remain neutral at pH 7.4, but the implemented SMARTS rule deprotonates thiophenol to a thiolate. In a docking-preparation pipeline, this can systematically assign the wrong ligand charge state, materially changing electrostatics, poses, and rankings, which undermines scientific validity and can mislead downstream decisions.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The docstring says phosphonic/phosphoric acids are kept at -1, but the implementation includes an `alkyl_phosphonate->dianion` rule that can assign a -2 state for matching motifs. This discrepancy can cause inconsistent and overly charged ligand preparation, which is especially dangerous in docking because charge state strongly affects binding scores, interaction patterns, and screening conclusions.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The skill is marketed as a pancreatic-lipase-specific docking workflow, but the code accepts any user-supplied PDB ID and proceeds to fetch, prepare, and dock against that structure. This creates a security/integrity issue at the workflow level: users can be misled into believing results are validated for the declared target and calibrated assumptions, while the pipeline silently operates on arbitrary proteins outside the claimed scope.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The header and skill description imply a professionally validated stack with calibration and quality gates, yet this runner appears to omit some of those claimed validation behaviors while still presenting itself as part of the validated workflow. In a scientific decision-support skill, that discrepancy can cause overtrust in outputs, leading users to act on results that lack the advertised safeguards.

Description-Behavior Mismatch

High

• Confidence: 93% confidence
• Finding: The implementation materially underdelivers on the manifest's security- and science-relevant claims: it performs a simple single-site workflow and lacks the advertised 5-site validation, consensus, re-dock RMSD gate, and calibration drift checks. This can mislead users into trusting results as more robust than they are, creating integrity risk for downstream decisions in screening or prioritization.

Intent-Code Divergence

Medium

• Confidence: 82% confidence
• Finding: The top-level documentation presents the module as a reusable screening pipeline with broader capability, while the actual implementation is intentionally narrower and one-by-one for docking. This discrepancy is primarily an integrity/documentation security issue: operators may deploy or rely on it under false assumptions about protocol breadth, reproducibility, or validation rigor.

Intent-Code Divergence

Medium

• Confidence: 99% confidence
• Finding: In the single-worker execution path, the code calls `run(job)` even though only `worker(job)` is defined. This causes a deterministic runtime failure whenever `--workers <= 1`, preventing docking runs from completing and potentially leaving partially written output files that downstream consumers may misinterpret as valid results.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The script builds a variant-based ligand preparation workflow, then later reinitializes `prepped` and replaces it with single prepared ligand files. Downstream code iterates `prepped[n]` as if it were a list of variants, so the intended consensus redocking logic is silently broken and can produce incorrect or inconsistent screening results. In a drug-docking skill, this undermines result integrity and reproducibility rather than causing direct code execution.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: This helper makes outbound requests to PubChem to resolve compound names, which contradicts the skill description's emphasis on local/free-kernel docking and introduces an undeclared external data flow. In a scientific workflow, queried molecule names can reveal proprietary screening libraries, research priorities, or sensitive targets, so the network behavior creates a real confidentiality and supply-chain boundary issue even if it is not overtly malicious.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file is an opaque self-extracting embedded archive rather than auditable source, so reviewers cannot verify what code will be restored and executed. In an agent-skill context, this creates a substantial supply-chain and hidden-functionality risk because arbitrary scripts, binaries, or prompts can be concealed inside the payload.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The header markets the file as a simple extractor for a docking stack, but the visible content only provides opaque payload bytes and does not substantiate the claims. This mismatch increases the chance that operators will trust and run hidden code they have not inspected.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The script goes beyond local docking by discovering Kaggle credentials from multiple sources and orchestrating remote kernel execution. That broadens the trust boundary: local credentials and input data may be used to launch third-party jobs, making accidental exfiltration or unintended remote execution possible if invoked by an agent without explicit user approval.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The generated Kaggle kernel enables internet access and downloads executable tooling at runtime via curl/conda, creating a software supply-chain risk and a larger remote attack surface. If the fetched content is tampered with or the network path is compromised, arbitrary code could execute inside the remote kernel with access to uploaded inputs and produced outputs.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The instructions direct automatic package installation without an explicit user-facing warning that the environment will be modified. Even if intended to improve usability, silent installation reduces informed consent and increases the chance of executing unreviewed package retrieval and setup in a shared or sensitive workspace.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The wrapper command for uploaded molecules appears convenience-oriented, but it obscures that it may install dependencies and proceed into real docking automatically. Wrapper scripts that hide side effects are risky in agent settings because they reduce transparency, making it easier to trigger network access, package installation, and substantial computation without the user fully understanding what will happen.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The quickstart directs users to execute setup scripts on a 'real Linux machine/server' without explaining that these scripts may install packages, modify environments, download code, and change system state. In a security-sensitive context, encouraging direct execution of shell scripts without previewing their actions increases the risk of unintended system modification or abuse if the scripts are altered or compromised.

Missing User Warnings

Low

• Confidence: 81% confidence
• Finding: The quickstart recommends a large-scale screening helper script for 10,000+ molecules without warning about substantial CPU time, memory, storage consumption, and large output generation. While not inherently malicious, this can cause resource exhaustion, unexpected costs, or degraded performance on shared or limited systems.

Static analysis

No suspicious patterns detected.