Peptide Design

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:03 AM UTC
• Version: 1.0.7

Overview

The skill has a coherent SciMiner peptide-design purpose, but it tells agents to run invocation logic directly from mutable remote Markdown while using an API key and uploading user files.

Review before installing. Use only with a SciMiner API key you are comfortable scoping to this service, and avoid submitting sensitive unpublished structures or files unless remote documentation and endpoints are independently trusted. A safer version would bundle reviewed schemas or enforce a local allowlist for hosts, endpoints, headers, upload fields, and parameters.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:45

Finding

Execution of Invocation Code Derived from Mutable Remote Documentation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 45–80
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code Snippet

markdown

## Authoritative tool-doc source (required)

The published Markdown files under `https://sciminer.tech/tool_api_files/` are the single source of truth for the selected peptide-design tool's `provider_name`, `tool_name`, allowed `parameters`, file-upload behavior, request encoding, and submission flow.

The agent MUST:

1. Resolve the selected tool's Markdown file and read it before every invocation.
2. Never invent `provider_name`, `tool_name`, parameter names, enum values, upload-field names, content type, or submission flow from memory.
3. Extract and follow the selected doc section's exact:
   - Base URL
   - API endpoint
   - Content-Type
   - Authentication header
   - Tool Name
   - Method
   - Parameter table, including required fields and enum values
   - File-upload instructions and example code
4. Choose the correct section if the selected doc contains multiple tool variants, such as design vs analysis, sequence input vs structure input, or single-item vs batch workflows.
5. Cite the selected Markdown doc as the payload source in summaries.

If a user-provided parameter is not present in the selected Markdown doc
section, ask for correction or drop it with an explanation.

## Required workflow

1. Determine which peptide-design tool or tool sequence matches the user's
   request.
2. Read the corresponding Markdown file or files from
   `https://sciminer.tech/tool_api_files/`.
3. Choose the doc section that matches the user's input shape.
4. Collect any missing required parameters from the user.
5. Upload required file inputs exactly as described by the selected Markdown
   doc and replace local paths with returned `file_id` values.
6. Write or run the invocation code directly from the selected Ma
...[truncated 3355 chars]

Remediation

View remediation

Remediation Suggestions

1. Bundle reviewed API schemas, endpoint definitions, and invocation implementations inside the Skill package rather than generating executable behavior from remote examples.
2. If remote documentation must be used, pin it to an immutable version and verify a cryptographic digest or trusted digital signature before processing it.
3. Treat downloaded Markdown solely as untrusted documentation. Never execute its code examples or translate unrestricted instructions into shell commands or runtime code.
4. Parse remote metadata through a strict schema that permits only expected fields, types, enum values, and request methods.
5. Maintain a local allowlist of approved HTTPS origins, hostnames, endpoint paths, upload destinations, and authentication-header behavior. Reject redirects or instructions that leave the approved origin.
6. Ensure the X-Auth-Token header is attached only to explicitly approved SciMiner endpoints and is removed during cross-origin redirects.
7. Restrict file uploads to explicit user-selected inputs and require confirmation before sending sensitive files.
8. Run network operations and invocation logic in a sandbox with minimal filesystem access, no shell access, restricted outbound networking, and a narrowly scoped credential.
9. Separate documentation retrieval from execution and require review or approval when remotely supplied API metadata changes.
10. Add tests that verify modified remote content cannot alter executable commands, credential destinations, or permitted upload hosts.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md

name: peptide-design
description: Peptide design, docking, and peptide property analysis tools exposed through SciMiner.
credential_files:
   - ~/.config/sciminer/credentials.json
---

# Peptide Design Skill

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md

name: peptide-design
description: Peptide design, docking, and peptide property analysis tools exposed through SciMiner.
credential_files:
   - ~/.config/sciminer/credentials.json
---

# Peptide Design Skill

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

md

name: peptide-design
description: Peptide design, docking, and peptide property analysis tools exposed through SciMiner.
credential_files:
   - ~/.config/sciminer/credentials.json
---

# Peptide Design Skill

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md

name: peptide-design
description: Peptide design, docking, and peptide property analysis tools exposed through SciMiner.
credential_files:
   - ~/.config/sciminer/credentials.json
---

# Peptide Design Skill

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

md

name: peptide-design
description: Peptide design, docking, and peptide property analysis tools exposed through SciMiner.
credential_files:
   - ~/.config/sciminer/credentials.json
---

# Peptide Design Skill

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

md

name: peptide-design
description: Peptide design, docking, and peptide property analysis tools exposed through SciMiner.
credential_files:
   - ~/.config/sciminer/credentials.json
---

# Peptide Design Skill

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

The skill instructs the agent to fetch and then 'write or run' invocation code directly from remote Markdown documentation before every use. Treating externally hosted documentation as executable guidance creates a supply-chain/prompt-injection risk: if the remote docs are modified maliciously, the agent may be induced to send secrets to attacker-controlled endpoints, change auth headers, or perform unintended actions.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

md

4. Collect any missing required parameters from the user.
5. Upload required file inputs exactly as described by the selected Markdown
   doc and replace local paths with returned `file_id` values.
6. Write or run the invocation code directly from the selected Markdown doc's
   base-information block, parameter table, file-upload instructions, and
   example code. Do not apply a shared invocation template or local registry
   abstraction in this skill.

Static analysis

No suspicious patterns detected.