Security audit

pancreatic-lipase-pro-docking

Security checks across malware telemetry and agentic risk

Overview

The skill appears aligned with pancreatic-lipase docking, but its one-command path unpacks embedded code and can modify the user environment with limited upfront scoping.

Review this skill before installing or running it. Use a disposable virtual environment, container, or non-shared machine, and do not run the zero-instruction path on shared HPC resources. Expect it to install or upgrade scientific packages, download public receptor data, run external docking tools, and write result/log directories. No credential theft or destructive behavior was found in the inspected artifact, but the install and execution scope should be made explicit.

SkillSpector

By NVIDIA

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 86% confidence
Finding: The archive contents clearly extend beyond a narrow pancreatic-lipase docking workflow into generic orchestration and scaling assets, including SLURM templates, Docker/environment files, dashboard/demo artifacts, chunking/parallel strategies, and broad pipeline runners. This increases attack surface and makes it harder for a user to understand what will be installed or executed, which is risky in a 'universal upload' package that encourages one-command operation.

Description-Behavior Mismatch

Low

Confidence: 81% confidence
Finding: The payload includes provisioning artifacts such as a Dockerfile, environment YAMLs, shell setup scripts, and pip requirement files that are not obvious from the short skill description. Hidden or under-disclosed installation machinery is dangerous because it can change the runtime environment, install broad dependencies, and execute setup logic the user did not knowingly approve.

Context-Inappropriate Capability

Medium

Confidence: 79% confidence
Finding: Cluster job template support and parallel chunking infrastructure are not inherently malicious, but they are broader than what a single-target docking skill strictly needs and can enable large-scale unattended execution. In the context of a payload marketed for simple docking, undisclosed distributed execution capability raises operational and security concerns because it can consume shared compute resources or run at a much larger scope than the user expects.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The top-level instructions promote a generic 'restore then run' pattern against an opaque embedded archive, with little specificity about what will be unpacked or what preconditions and side effects exist. Ambiguous execution instructions are dangerous because they encourage users or agents to execute packaged code without review, which is especially risky when the payload is compressed and not human-inspectable inline.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The phrase 'ZERO-INSTRUCTION RUN COMMAND' is an explicit prompt to execute the package immediately without audit or informed consent. In a skill context, this is especially dangerous because it nudges automated agents and users to bypass normal review of embedded code, dependencies, setup actions, and outbound operations.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The script decodes a base64 ZIP embedded in a companion text file and extracts it with zipfile.extractall('.') into the skill directory without validating archive member paths, contents, or presenting a meaningful user warning/confirmation before writing files. If the payload file is modified or replaced, this can overwrite files in or outside the intended directory via malicious ZIP entries, making the bootstrapper a risky self-extracting installer.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.