Binding site prediction

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:15 AM UTC
• Version: 1.0.4

Overview

The skill has a legitimate SciMiner workflow, but it lets mutable remote Markdown control credential-bearing API code and file uploads.

Review this skill carefully before installing. It should only be used if you trust SciMiner's hosted documentation and infrastructure, because that remote content can change how the agent sends your API key and uploaded protein files. Prefer a version that pins reviewed API schemas and validates destinations before attaching credentials.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:51

Finding

Mutable Remote Documentation Controls Credential-Bearing Code Execution

Content

View full analysis

`p2rank_api_doc.md` - `AF2BIND` -> `af2bind_api_doc.md` - `fpocket` -> `fpocket_api_doc.md` The agent MUST: 1. Resolve the selected tool's Markdown file and read it before every invocation. 2. Never invent `provider_name`, `tool_name`, parameter names, enum values, upload-field names, content type, or submission flow from memory. 3. Extract and follow the selected doc section's exact: - Base URL - API endpoint - Content-Type - Authentication header - Tool Name - Method - Parameter table, including required fields and enum values - File-upload instructions and example code 4. Choose the correct section if the s ...[truncated 4483 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md

name: binding-site-prediction
description: Binding-site and pocket prediction workflows using P2Rank, AF2BIND, and fpocket through SciMiner.
credential_files:
   - ~/.config/sciminer/credentials.json
---

# Binding-Site Prediction Skill

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md

name: binding-site-prediction
description: Binding-site and pocket prediction workflows using P2Rank, AF2BIND, and fpocket through SciMiner.
credential_files:
   - ~/.config/sciminer/credentials.json
---

# Binding-Site Prediction Skill

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md

name: binding-site-prediction
description: Binding-site and pocket prediction workflows using P2Rank, AF2BIND, and fpocket through SciMiner.
credential_files:
   - ~/.config/sciminer/credentials.json
---

# Binding-Site Prediction Skill

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md

name: binding-site-prediction
description: Binding-site and pocket prediction workflows using P2Rank, AF2BIND, and fpocket through SciMiner.
credential_files:
   - ~/.config/sciminer/credentials.json
---

# Binding-Site Prediction Skill

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.

md

name: binding-site-prediction
description: Binding-site and pocket prediction workflows using P2Rank, AF2BIND, and fpocket through SciMiner.
credential_files:
   - ~/.config/sciminer/credentials.json
---

# Binding-Site Prediction Skill

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.

md

name: binding-site-prediction
description: Binding-site and pocket prediction workflows using P2Rank, AF2BIND, and fpocket through SciMiner.
credential_files:
   - ~/.config/sciminer/credentials.json
---

# Binding-Site Prediction Skill

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

The skill instructs the agent to write or run invocation code directly from remotely hosted Markdown documentation before every invocation. Because that documentation is outside the repository and treated as authoritative, a compromised or malicious doc source could inject unsafe request logic, alter endpoints, or cause the agent to handle secrets or files in unintended ways.

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

md

4. Collect any missing required parameters from the user.
5. Upload required file inputs exactly as described by the selected Markdown
   doc and replace local paths with returned `file_id` values.
6. Write or run the invocation code directly from the selected Markdown doc's
   base-information block, parameter table, file-upload instructions, and
   example code. Do not apply a shared invocation template or local registry
   abstraction in this skill.

Static analysis

No suspicious patterns detected.