ClawHub
Back to skill

Security audit

Protein Design

Security checks for vulnerabilities and agentic risk

Overview

This skill supports a real SciMiner protein-design workflow, but it lets mutable online documentation control authenticated request and code execution behavior.

Review this before installing. Use it only if you trust the SciMiner documentation host and are comfortable sending a dedicated SciMiner API key plus protein structures, sequences, and design constraints through workflows derived from live remote docs. Prefer running it in a restricted environment with a revocable API key, and verify upload destinations before using sensitive or unpublished data.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:45
Finding

Remotely Mutable Documentation Controls Code Execution and Credential-Bearing Requests

Content
View full analysis
`Boltzgen_api_doc.md` - `RFdiffusion` -> `RFdiffusion_api_doc.md` - `RFdiffusion2` -> `RFdiffusion2_api_doc.md` - `RFdiffusion3` -> `RFdiffusion3_api_doc.md` - `ProteinMPNN` -> `ProteinMPNN_api_doc.md` - `LigandMPNN` -> `LigandMPNN_api_doc.md` - `BindCraft` -> `BindCraft_api_doc.md` - `FreeBindCraft` -> `FreeBindCraft_api_doc.md` The agent MUST: 1. Resolve the selected tool's Markdown file and read it before every invocation. 2. Never invent `provider_name`, `tool_name`, parameter names, enum values, upload-field names, content type, or submission flow from memory. 3. Extract and follow the selected doc section's exact: - Base URL - API endpoint - Content-Type - Authentication header - Tool Name - Method - Parameter table, including required fields and enum values - File-upload instructions and example code 4. Choose the correct section if the selected doc contains multiple tool variants, such as backbone generation vs binder design, enzyme design vs small-molecule binder design, protein binder vs DNA binder design, or ProteinMPNN vs LigandMPNN model variants. 5. Cite the selected Markdown doc as the payload source in summaries. If a user-provided parameter is not present in the selected Markdown doc section, ask for correction or drop it with an explanation. ## Required workflow 1. Determine which protein-design tool or tool sequence matches the user's request. 2. Read the corresponding Markdown file o ...[truncated 3667 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md
name: protein-design
description: Protein, peptide, antibody, nanobody, binder, enzyme, and sequence design workflows using Boltzgen, RFdiffusion, RFdiffusion2, RFdiffusion3, ProteinMPNN, LigandMPNN, and BindCraft through SciMiner APIs.
credential_files:
    - ~/.config/sciminer/credentials.json
---

# Protein Design Skill

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md
name: protein-design
description: Protein, peptide, antibody, nanobody, binder, enzyme, and sequence design workflows using Boltzgen, RFdiffusion, RFdiffusion2, RFdiffusion3, ProteinMPNN, LigandMPNN, and BindCraft through SciMiner APIs.
credential_files:
    - ~/.config/sciminer/credentials.json
---

# Protein Design Skill

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md
name: protein-design
description: Protein, peptide, antibody, nanobody, binder, enzyme, and sequence design workflows using Boltzgen, RFdiffusion, RFdiffusion2, RFdiffusion3, ProteinMPNN, LigandMPNN, and BindCraft through SciMiner APIs.
credential_files:
    - ~/.config/sciminer/credentials.json
---

# Protein Design Skill

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md
name: protein-design
description: Protein, peptide, antibody, nanobody, binder, enzyme, and sequence design workflows using Boltzgen, RFdiffusion, RFdiffusion2, RFdiffusion3, ProteinMPNN, LigandMPNN, and BindCraft through SciMiner APIs.
credential_files:
    - ~/.config/sciminer/credentials.json
---

# Protein Design Skill

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.

md
name: protein-design
description: Protein, peptide, antibody, nanobody, binder, enzyme, and sequence design workflows using Boltzgen, RFdiffusion, RFdiffusion2, RFdiffusion3, ProteinMPNN, LigandMPNN, and BindCraft through SciMiner APIs.
credential_files:
    - ~/.config/sciminer/credentials.json
---

# Protein Design Skill

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 189)May include surrounding context.

md
name: protein-design
description: Protein, peptide, antibody, nanobody, binder, enzyme, and sequence design workflows using Boltzgen, RFdiffusion, RFdiffusion2, RFdiffusion3, ProteinMPNN, LigandMPNN, and BindCraft through SciMiner APIs.
credential_files:
    - ~/.config/sciminer/credentials.json
---

# Protein Design Skill

Session Persistence

Medium
Category
Rogue Agent
Confidence
86% confidence
Finding

The skill requires the agent to fetch remote Markdown from sciminer.tech and then 'write or run' invocation code directly from that external documentation before every invocation. Treating mutable remote docs and example code as executable instructions creates a prompt/code-supply-chain risk: if the docs are compromised or maliciously altered, the agent could be induced to execute unsafe logic, exfiltrate local data, or handle secrets improperly.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

md
4. Collect any missing required parameters from the user.
5. Upload required file inputs exactly as described by the selected Markdown
   doc and replace local paths with returned `file_id` values.
6. Write or run the invocation code directly from the selected Markdown doc's
   base-information block, parameter table, file-upload instructions, and
   example code. Do not apply a shared invocation template or local registry
   abstraction in this skill.

Static analysis

No suspicious patterns detected.