ClawHub
Back to skill

Security audit

mrmrmr

Security checks across malware telemetry and agentic risk

Overview

This biomedical analysis skill has a coherent purpose, but it automatically runs generated R code and Python eval on model/API/CSV-derived data with weak scoping and validation.

Review before installing. Use this only in a constrained workspace with trusted inputs, non-sensitive API keys, and an isolated output directory. Avoid exposing the Streamlit demo to untrusted users, and prefer a version that replaces eval with safe parsing, validates GWAS IDs and paths, and invokes R through fixed scripts with argument lists.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (9)

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Content
with open('test.R', 'w', encoding='utf-8') as f:
        f.write(r_script_run)

    os.system('R --slave --no-save --no-restore --no-site-file --no-environ -f  test.R --args')


@timer
Confidence
96% confidence
Finding
os.system('R --slave --no-save --no-restore --no-site-file --no-environ -f test.R --args')

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Content
with open('test.R', 'w', encoding='utf-8') as f:
        f.write(r_script_run)

    os.system('R --slave --no-save --no-restore --no-site-file --no-environ -f  test.R --args')


@timer
Confidence
96% confidence
Finding
os.system('R --slave --no-save --no-restore --no-site-file --no-environ -f test.R --args')

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Content
with open('test.R', 'w', encoding='utf-8') as f:
        f.write(r_script_run)

    os.system('R --slave --no-save --no-restore --no-site-file --no-environ -f  test.R --args')


def get_synonyms(term, api_key):
Confidence
97% confidence
Finding
os.system('R --slave --no-save --no-restore --no-site-file --no-environ -f test.R --args')

eval() call detected

High
Category
Dangerous Code Execution
Content
Outcome_id = Outcome_id.to_numpy()[0]
                Exposure_id = Exposure_id.to_numpy()[0]
                print(Outcome_id, Exposure_id)
                Outcome_id_list = eval(Outcome_id)
                Exposure_id_list = eval(Exposure_id)
                print(Outcome_id_list, Exposure_id_list)
Confidence
98% confidence
Finding
Outcome_id_list = eval(Outcome_id)

eval() call detected

High
Category
Dangerous Code Execution
Content
Exposure_id = Exposure_id.to_numpy()[0]
                print(Outcome_id, Exposure_id)
                Outcome_id_list = eval(Outcome_id)
                Exposure_id_list = eval(Exposure_id)
                print(Outcome_id_list, Exposure_id_list)

                # 创建文件夹
Confidence
98% confidence
Finding
Exposure_id_list = eval(Exposure_id)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
def patched_os_system(command):
    if 'R ' in command:
        # 使用subprocess代替os.system来捕获输出
        process = subprocess.Popen(
            command,
            shell=True,
            stdout=subprocess.PIPE,
Confidence
94% confidence
Finding
process = subprocess.Popen( command, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True )

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill advertises and instructs use of powerful capabilities including environment variable access, network access, shell execution, and file read/write, yet no permissions are explicitly declared beyond runtime requirements in metadata. This creates a transparency and policy-enforcement gap: users or hosting platforms may authorize or run the skill without realizing it can access secrets such as OPENAI_API_KEY and OPENGWAS_JWT, invoke Python/R scripts, fetch remote data, and write arbitrary output files.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
def patched_os_system(command):
    if 'R ' in command:
        # 使用subprocess代替os.system来捕获输出
        process = subprocess.Popen(
            command,
            shell=True,
            stdout=subprocess.PIPE,
Confidence
96% confidence
Finding
subprocess.Popen( command, shell=True

Tool Parameter Abuse

High
Category
Tool Misuse
Content
def patched_os_system(command):
    if 'R ' in command:
        # 使用subprocess代替os.system来捕获输出
        process = subprocess.Popen(
            command,
            shell=True,
            stdout=subprocess.PIPE,
Confidence
96% confidence
Finding
Popen( command, shell=True

VirusTotal

VirusTotal engine telemetry is currently stale for this artifact.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
mrmrmr/mragent/agent_workflow.py:1041