ClawHub
Back to skill

Security audit

Synthesis Evaluation

Security checks for vulnerabilities and agentic risk

Overview

The skill’s SciMiner workflow is coherent, but it asks agents to run request code derived from mutable remote documentation while using a local API credential.

Review this skill carefully before installing. It is not proven malicious, but it should only be used if you trust SciMiner’s documentation host and are comfortable with a local API key and user-provided files being handled according to instructions fetched from that host at runtime. A safer version would pin reviewed endpoints and schemas locally and treat remote docs as reference-only text.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:39
Finding

Mutable Remote Documentation Is Used to Generate and Execute Invocation Code

Content
View full analysis
`Synformer_api_doc.md` - `Retrosynthesis Planner` -> `Retrosynthesis Planner_api_doc.md` - `SAScore` -> `SAScore_api_doc.md` The agent MUST: 1. Resolve the selected tool's Markdown file and read it before every invocation. 2. Never invent `provider_name`, `tool_name`, parameter names, enum values, upload-field names, content type, or submission flow from memory. 3. Extract and follow the selected doc section's exact: - Base URL - API endpoint - Content-Type - Authentication header - Tool Name - Method - Parameter table, including required fields and enum values - File-upload instructions and example code 4. Choose the correct section if the selected doc contains multiple tool variants, such as SMILES input vs file upload. 5. Cite the selected Markdown doc as the payload source in summaries. If a user-provided parameter is not present in the selected Markdown doc section, ask for correction or drop it with an explanation. ## Required workflow 1. Determine whether the request matches `Synformer`, `Retrosynthesis Planner`, or `SAScore`. 2. Read the corresponding Markdown file or files from `https://sciminer.tech/tool_api_files/`. 3. Choose the doc section that matches the user's input shape. 4. Collect any missing required parameters from the user. 5. Upload required file inputs exactly as described by the selected Markdown doc and replace loca ...[truncated 3465 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md
name: synthesis-evaluation
description: Synthesis evaluation workflows combining SynFormer-ED, Retrosynthesis Planner, and SAScore through SciMiner.
credential_files:
   - ~/.config/sciminer/credentials.json
---

# Retrosynthesis Skill

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md
name: synthesis-evaluation
description: Synthesis evaluation workflows combining SynFormer-ED, Retrosynthesis Planner, and SAScore through SciMiner.
credential_files:
   - ~/.config/sciminer/credentials.json
---

# Retrosynthesis Skill

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md
name: synthesis-evaluation
description: Synthesis evaluation workflows combining SynFormer-ED, Retrosynthesis Planner, and SAScore through SciMiner.
credential_files:
   - ~/.config/sciminer/credentials.json
---

# Retrosynthesis Skill

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md
name: synthesis-evaluation
description: Synthesis evaluation workflows combining SynFormer-ED, Retrosynthesis Planner, and SAScore through SciMiner.
credential_files:
   - ~/.config/sciminer/credentials.json
---

# Retrosynthesis Skill

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

md
name: synthesis-evaluation
description: Synthesis evaluation workflows combining SynFormer-ED, Retrosynthesis Planner, and SAScore through SciMiner.
credential_files:
   - ~/.config/sciminer/credentials.json
---

# Retrosynthesis Skill

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.

md
name: synthesis-evaluation
description: Synthesis evaluation workflows combining SynFormer-ED, Retrosynthesis Planner, and SAScore through SciMiner.
credential_files:
   - ~/.config/sciminer/credentials.json
---

# Retrosynthesis Skill

Session Persistence

Medium
Category
Rogue Agent
Confidence
88% confidence
Finding

The skill instructs the agent to read and execute invocation code directly from remote Markdown documentation before every run. That creates a prompt/code supply-chain risk: if the external docs are compromised or contain unsafe example code, the agent may follow attacker-controlled instructions, potentially causing data exfiltration, unintended network access, or unsafe file handling. In this skill context, the risk is elevated because the same workflow also handles a live API credential and uploads user-provided files.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

md
4. Collect any missing required parameters from the user.
5. Upload required file inputs exactly as described by the selected Markdown
   doc and replace local paths with returned `file_id` values.
6. Write or run the invocation code directly from the selected Markdown doc's
   base-information block, parameter table, file-upload instructions, and
   example code. Do not apply a shared invocation template or local registry
   abstraction in this skill.

Static analysis

No suspicious patterns detected.