ADMET PK/PD Predict

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:38 AM UTC
• Version: 1.0.4

Overview

The skill has a coherent SciMiner prediction purpose, but it lets live remote documentation determine executable API behavior while using an API key and uploading user files.

Install only if you are comfortable giving the agent access to a SciMiner API key and sending molecule data to SciMiner. Use a dedicated, revocable key, avoid proprietary files unless approved, and verify the remote docs and request destination before allowing uploads or generated code to run.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: SKILL.md:49

Finding

Remotely Mutable Documentation Can Control Generated and Executed Invocation Code

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 49-90
Vulnerability Type: Remote payload retrieval and execution through unpinned external documentation
Risk Level: Medium

Vulnerable Code

markdown

## Authoritative tool-doc source (required)

The published Markdown files under `https://sciminer.tech/tool_api_files/` are
the single source of truth for `provider_name`, `tool_name`, allowed
`parameters`, file-upload behavior, request encoding, and the example
submission flow for this skill's included tools.

Use these SciMiner Markdown docs:

- `ADMET Predictor` -> `ADMET Predictor_api_doc.md`
- `AOMP` -> `AOMP_api_doc.md`
- `OBA` -> `OBA_api_doc.md`
- `Graph-pKa` -> `Graph-pKa_api_doc.md`
- `DeepEsol` -> `DeepEsol_api_doc.md`
- `Molecular Descriptors` -> `Molecular Descriptors_api_doc.md`

The agent MUST:

1. Resolve the selected tool's Markdown file and read it before every
   invocation.
2. Never invent `provider_name`, `tool_name`, parameter names, enum values,
   upload-field names, content type, or submission flow from memory.
3. Extract and follow the selected doc section's exact:
   - Base URL
   - API endpoint
   - Content-Type
   - Authentication header
   - Tool Name
   - Method
   - Parameter table, including required fields and enum values
   - File-upload instructions and example code
4. Choose the correct section if the selected doc contains multiple tool
   variants, such as SMILES input vs file upload.
5. Cite the selected Markdown doc as the payload source in summaries.

If a user-provided parameter is not present in the selected Markdown doc
section, ask for correction or drop it with an explanation.

## Required workflow

1. Determine which included tool matches the user's request.
2. Read the corresponding Markdown file from
   `https://sciminer.tech/tool_api_files/`.
3. Choose the doc section that matches the user's input shape.
4.
...[truncated 3647 chars]

Remediation

View remediation

Remediation Suggestions

1. Bundle reviewed API schemas and invocation templates with the Skill instead of generating executable behavior from live documentation.
2. If remote documents are operationally required, pin them to immutable versions and verify a publisher-controlled cryptographic signature or expected SHA-256 digest before parsing them.
3. Treat remote Markdown strictly as untrusted data. Do not execute example code or follow instructions embedded in it.
4. Implement a local, validated request builder with an explicit schema for permitted methods, parameter names, content types, upload fields, and response fields.
5. Enforce an HTTPS destination allowlist for expected SciMiner hosts. Reject redirects, alternate hosts, IP-address endpoints, and documentation-supplied destinations that are not locally approved.
6. Attach X-Auth-Token only after the final request destination has been validated against the allowlist, and ensure that authentication headers are removed on redirects.
7. Require explicit user confirmation before uploading local files, identifying the destination and the files that will leave the local system.
8. Run unavoidable generated code in a restricted sandbox without shell access, unrelated filesystem access, or unrestricted network connectivity.
9. Apply least-privilege permissions to the credential file, such as owner-only read/write access, and use a narrowly scoped, revocable API token where supported.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md

name: admet-pkpd
description: ADMET and pharmacokinetic/pharmacodynamic property prediction workflows using ADMET Predictor, AOMP, OBA, Graph-pKa, DeepEsol, and Molecular Descriptors through SciMiner.
credential_files:
   - ~/.config/sciminer/credentials.json
---

# ADMET & PKPD Skill

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md

name: admet-pkpd
description: ADMET and pharmacokinetic/pharmacodynamic property prediction workflows using ADMET Predictor, AOMP, OBA, Graph-pKa, DeepEsol, and Molecular Descriptors through SciMiner.
credential_files:
   - ~/.config/sciminer/credentials.json
---

# ADMET & PKPD Skill

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md

name: admet-pkpd
description: ADMET and pharmacokinetic/pharmacodynamic property prediction workflows using ADMET Predictor, AOMP, OBA, Graph-pKa, DeepEsol, and Molecular Descriptors through SciMiner.
credential_files:
   - ~/.config/sciminer/credentials.json
---

# ADMET & PKPD Skill

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 138)May include surrounding context.

md

name: admet-pkpd
description: ADMET and pharmacokinetic/pharmacodynamic property prediction workflows using ADMET Predictor, AOMP, OBA, Graph-pKa, DeepEsol, and Molecular Descriptors through SciMiner.
credential_files:
   - ~/.config/sciminer/credentials.json
---

# ADMET & PKPD Skill

Credential Access

High

• Category: Privilege Escalation
• Confidence: 78% confidence

Finding

The skill instructs the agent to read a local credential file and use its contents in outbound authentication headers to an external service. While this is expected for legitimate API use, it is still a credential-access capability that increases blast radius if the skill or downstream prompt flow is ever subverted, because the agent is authorized to handle a secret and make network requests.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md

1. Obtain a free SciMiner API key from `https://sciminer.tech/utility`.
2. Store it outside this repository at `~/.config/sciminer/credentials.json` with JSON shaped as `{"api_key":"your_api_key_here"}`.
3. For SciMiner calls, read the API key from `~/.config/sciminer/credentials.json` and send it as the `X-Auth-Token` header.
4. Never print, persist, or store the API key in prompts, logs, or repository files. Agents should remember only the credential file path.

If `~/.config/sciminer/credentials.json` is not available or does not contain an `api_key` field, stop and tell the user to obtain a free SciMiner API key from `https://sciminer.tech/utility` and store it in that file. Do not try to complete the task by switching to other tools or services.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 78% confidence

Finding

Like line 42, this line grants the skill the operational capability to retrieve a local API key and attach it to outbound requests. In context this is legitimate, but from a security perspective it is still sensitive because any prompt injection, tool misuse, or logging mistake in the execution environment could expose or misuse the credential.

Content

Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.

md

- Use the selected Markdown doc under
   `https://sciminer.tech/tool_api_files/` as the authoritative source for
   payload construction and invoke-method details.
- Read the SciMiner API key from `~/.config/sciminer/credentials.json` and send it as the `X-Auth-Token` header. Do not print or persist the API key in prompts, logs, or repository files.
- If `~/.config/sciminer/credentials.json` is missing or does not contain an `api_key` field, stop and tell the user to obtain a free SciMiner API key from `https://sciminer.tech/utility` and store it in that file.
- `provider_name` must exactly match the selected Markdown doc.
- The `features` parameter for ADMET Predictor is optional; omitting it returns all endpoints. Passing category letters (`A`, `D`, `M`, `E`, `T`) returns all endpoints within that category.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly directs the agent to upload user-provided files to the external SciMiner service but does not require a user-facing warning or confirmation about data leaving the local environment. In a scientific workflow, uploaded molecule libraries or proprietary structures may be sensitive IP, so silent transmission creates privacy and confidentiality risk.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The instruction to write or run invocation code directly from remote Markdown documentation, and to avoid a fixed local abstraction, creates a supply-chain/prompt-injection risk. If the remote docs are compromised or contain unsafe example code, the agent is being told to treat untrusted content as executable guidance, which can lead to unauthorized actions, unsafe network behavior, or accidental secret exposure.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

md

4. Collect any missing required parameters from the user.
5. Upload required file inputs exactly as described by the selected Markdown
   doc and replace local paths with returned `file_id` values.
6. Write or run the invocation code directly from the selected Markdown doc's
   base-information block, parameter table, file-upload instructions, and
   example code. Do not apply a shared invocation template or local registry
   abstraction in this skill.

Static analysis

No suspicious patterns detected.