Antibody Engineering

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:15 AM UTC
• Version: 1.0.6

Overview

This skill has a coherent SciMiner antibody-engineering purpose, but it gives mutable remote Markdown documents too much control over authenticated requests and code execution.

Install only if you are comfortable with the agent reading a local SciMiner API key and uploading selected antibody sequence or structure data. Prefer a revised version that pins or locally stores reviewed API schemas, enforces the exact SciMiner endpoint, strips credentials on redirects, and treats remote docs as reference text rather than executable instructions.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:90

Finding

Mutable Remote Documentation Is Used to Generate and Execute Invocation Code

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 90–125
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code Snippet

markdown

## Authoritative tool-doc source (required)

The published Markdown files under `https://sciminer.tech/tool_api_files/` are
the single source of truth for `provider_name`, `tool_name`, allowed
`parameters`, file-upload behavior, request encoding, and the example
submission flow for this skill's included tools.

Use these SciMiner Markdown docs:

- `ANARCI` -> `ANARCI_api_doc.md`
- `BioPhi` -> `BioPhi_api_doc.md`
- `IgFold` -> `IgFold_api_doc.md`
- `FoldX` -> `FoldX_api_doc.md`
- `Rosetta FastRelax` -> `Rosetta FastRelax_api_doc.md`
- `Rosetta SAP Score` -> `Rosetta SAP Score_api_doc.md`
- `Rosetta FastDesign` -> `Rosetta FastDesign_api_doc.md`
- `Rosetta InterfaceAnalyzer` -> `Rosetta InterfaceAnalyzer_api_doc.md`

The agent MUST:

1. Resolve the selected tool's Markdown file and read it before every
   invocation.
2. Never invent `provider_name`, `tool_name`, parameter names, enum values,
   upload-field names, content type, or submission flow from memory.
3. Extract and follow the selected doc section's exact:
   - Base URL
   - API endpoint
   - Content-Type
   - Authentication header
   - Tool Name
   - Method
   - Parameter table, including required fields and enum values
   - File-upload instructions and example code
4. Choose the correct section if the selected doc contains multiple tool
   variants, such as sequence input vs structure upload.
5. Cite the selected Markdown doc as the payload source in summaries.

If a user-provided parameter is not present in the selected Markdown doc
section, ask for correction or drop it with an explanation.

## Required workflow

1. Determine which included tool or tool sequence matches the user's request.
2. Read the corresponding Markdown file or files from
   `https://sciminer.tech/tool_api_files/`.
3. Choose the doc sectio
...[truncated 3210 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace remote-generated invocation code with locally stored, reviewed implementation code.
2. Treat remote documentation strictly as untrusted reference data and never execute or reproduce code from its examples automatically.
3. Pin each document to an immutable version and verify a cryptographic hash before using it.
4. Hard-code and validate the permitted HTTPS origin, API endpoints, authentication-header name, upload fields, and request schemas in audited local code.
5. Reject redirects, especially cross-origin redirects, and never forward authentication headers across origins.
6. Parse remote content through a strict data schema that cannot express executable instructions, shell commands, arbitrary imports, or alternate destinations.
7. Run invocation logic in a restricted sandbox with minimal filesystem access, no shell access, and outbound network access limited to approved SciMiner endpoints.
8. Require explicit user confirmation before uploading sequence, structure, or other potentially proprietary scientific data.
9. Add integrity monitoring and security review requirements for any future changes to the pinned API specifications.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:82

Finding

Remote Endpoint Selection Can Expose a Locally Stored API Credential

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 82–108
Vulnerability Type: Insecure credential destination control
Risk Level: High

Vulnerable Code Snippet

markdown

## Prerequisites

1. Obtain a free SciMiner API key from `https://sciminer.tech/utility`.
2. Store it outside this repository at `~/.config/sciminer/credentials.json` with JSON shaped as `{"api_key":"your_api_key_here"}`.
3. For SciMiner calls, read the API key from `~/.config/sciminer/credentials.json` and send it as the `X-Auth-Token` header.
4. Never print, persist, or store the API key in prompts, logs, or repository files. Agents should remember only the credential file path.

If `~/.config/sciminer/credentials.json` is not available or does not contain an `api_key` field, stop and tell the user to obtain a free SciMiner API key from `https://sciminer.tech/utility` and store it in that file. Do not try to complete the task by switching to other tools or services.

## Authoritative tool-doc source (required)

The published Markdown files under `https://sciminer.tech/tool_api_files/` are
the single source of truth for `provider_name`, `tool_name`, allowed
`parameters`, file-upload behavior, request encoding, and the example
submission flow for this skill's included tools.

Use these SciMiner Markdown docs:

- `ANARCI` -> `ANARCI_api_doc.md`
- `BioPhi` -> `BioPhi_api_doc.md`
- `IgFold` -> `IgFold_api_doc.md`
- `FoldX` -> `FoldX_api_doc.md`
- `Rosetta FastRelax` -> `Rosetta FastRelax_api_doc.md`
- `Rosetta SAP Score` -> `Rosetta SAP Score_api_doc.md`
- `Rosetta FastDesign` -> `Rosetta FastDesign_api_doc.md`
- `Rosetta InterfaceAnalyzer` -> `Rosetta InterfaceAnalyzer_api_doc.md`

The agent MUST:

1. Resolve the selected tool's Markdown file and read it before every
   invocation.
2. Never invent `provider_name`, `tool_name`, parameter names, enum values,
   upload-field names, content type, or submission flow from memory.
3. Extract and follow the selected doc section'
...[truncated 2537 chars]

Remediation

View remediation

Remediation Suggestions

1. Enforce the exact allowed origin https://sciminer.tech in local, audited invocation code rather than accepting a base URL from remote documentation.
2. Reject all non-HTTPS destinations, userinfo in URLs, alternate ports, subdomain substitutions, and cross-origin redirects.
3. Strip X-Auth-Token on every redirect and preferably disable redirects entirely for authenticated requests.
4. Validate the resolved hostname after DNS and connection establishment where supported, and apply outbound network allowlisting.
5. Use narrowly scoped, revocable, and short-lived tokens if SciMiner supports them; rotate any token suspected of exposure.
6. Read only the api_key property from the dedicated credential file and validate that the file is owned by the current user with restrictive permissions such as mode 0600.
7. Keep secrets out of prompts, generated source, command-line arguments, exception messages, telemetry, and logs.
8. Separate file-upload authorization from general task submission where possible, and require explicit confirmation before transmitting sensitive research data.
9. Add tests proving that malicious documentation cannot alter the credential destination or authentication-header behavior.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md

name: antibody-engineering
description: Antibody engineering workflow combining ANARCI, BioPhi, IgFold, FoldX, and Rosetta tools through SciMiner.
credential_files:
   - ~/.config/sciminer/credentials.json
---

# Antibody Engineering Skill

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

md

name: antibody-engineering
description: Antibody engineering workflow combining ANARCI, BioPhi, IgFold, FoldX, and Rosetta tools through SciMiner.
credential_files:
   - ~/.config/sciminer/credentials.json
---

# Antibody Engineering Skill

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

md

name: antibody-engineering
description: Antibody engineering workflow combining ANARCI, BioPhi, IgFold, FoldX, and Rosetta tools through SciMiner.
credential_files:
   - ~/.config/sciminer/credentials.json
---

# Antibody Engineering Skill

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

md

name: antibody-engineering
description: Antibody engineering workflow combining ANARCI, BioPhi, IgFold, FoldX, and Rosetta tools through SciMiner.
credential_files:
   - ~/.config/sciminer/credentials.json
---

# Antibody Engineering Skill

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 168)May include surrounding context.

md

name: antibody-engineering
description: Antibody engineering workflow combining ANARCI, BioPhi, IgFold, FoldX, and Rosetta tools through SciMiner.
credential_files:
   - ~/.config/sciminer/credentials.json
---

# Antibody Engineering Skill

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 169)May include surrounding context.

md

name: antibody-engineering
description: Antibody engineering workflow combining ANARCI, BioPhi, IgFold, FoldX, and Rosetta tools through SciMiner.
credential_files:
   - ~/.config/sciminer/credentials.json
---

# Antibody Engineering Skill

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 82% confidence

Finding

The skill instructs the agent to write or run invocation code directly from remotely hosted Markdown documentation on every use. That creates a supply-chain and prompt-injection risk: if the external docs are compromised or contain malicious example code, the agent may execute attacker-controlled instructions, potentially causing arbitrary outbound requests, data disclosure, or unsafe file handling.

Content

Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.

md

4. Collect any missing required parameters from the user.
5. Upload required file inputs exactly as described by the selected Markdown
   doc and replace local paths with returned `file_id` values.
6. Write or run the invocation code directly from the selected Markdown doc's
   base-information block, parameter table, file-upload instructions, and
   example code. Do not apply a shared invocation template or local registry
   abstraction in this skill.

Static analysis

No suspicious patterns detected.