Molecular Docking AutoDock

• Outcome: Review
• Latest audit: May 28, 2026 · 2:06 PM UTC
• Version: 1.0.0

Overview

This skill has a legitimate molecular-docking purpose, but its script can run unintended local shell commands if given crafted file or output paths.

Review before installing or running. Use only with trusted paths and preferably inside an isolated environment until the script replaces shell=True string commands with argument-list subprocess calls, validates paths, scopes output directories, and verifies downloaded tooling.

SkillSpector

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# Step 2: Convert to PDBQT with AutoDock Tools script or obabel
        cmd = f"obabel {temp_pdb} -O {self.prepared_pdbqt} -xr -h --partialcharge gasteiger"
        subprocess.run(cmd, shell=True, check=True, capture_output=True)
        os.remove(temp_pdb)
        return self.prepared_pdbqt

• Confidence: 98% confidence
• Finding: This constructs a shell command with file paths derived from user-controlled output_dir and then executes it with shell=True. If the output path contains shell metacharacters, an attacker can trigger OS command injection and execute arbitrary commands under the agent's privileges.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

p2rank_output = os.path.join(self.output_dir, "p2rank_output")
        os.makedirs(p2rank_output, exist_ok=True)
        cmd = f"prank predict -f {self.protein_pdb} -o {p2rank_output}"
        subprocess.run(cmd, shell=True, check=True, capture_output=True)
        
        # Read top pocket result
        predict_file = os.path.join(p2rank_output, os.path.basename(self.protein_pdb).replace(".pdb", "_predictions.csv"))

• Confidence: 99% confidence
• Finding: The command string embeds self.protein_pdb and p2rank_output, both influenced by user input, and is executed through the shell. A crafted protein path or output directory can inject additional shell tokens, leading to arbitrary command execution.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# Run VINA
        cmd = f"vina --config {config_file}"
        result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
        if result.returncode != 0:
            raise RuntimeError(f"VINA docking failed: {result.stderr}")

• Confidence: 73% confidence
• Finding: This use of shell=True is less directly exposed because config_file is generated internally, but it still relies on output_dir-derived paths and needlessly invokes a shell. If an attacker controls output_dir, the config file path may become a shell injection vector.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

for i in range(self.num_modes):
            ligand_pdb = os.path.join(self.output_dir, f"ligand_mode_{i+1}.pdb")
            cmd = f"obabel {self.docking_pdbqt} -O {ligand_pdb} -m -f {i+1} -l {i+1}"
            subprocess.run(cmd, shell=True, check=True, capture_output=True)
            ligand_pdbs.append(ligand_pdb)
        
        # Combine protein and top ligand into complex PDB

• Confidence: 97% confidence
• Finding: The obabel command is built with shell=True using self.docking_pdbqt and ligand_pdb paths that are derived from user-influenced output_dir. A malicious path can break out of the intended command and execute arbitrary shell commands.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill explicitly instructs use of local files and shell commands (`conda`, `pip`, `wget`, `tar`, running a Python script) but does not declare any permissions for file read, file write, or shell execution. This creates a permission-model mismatch: an agent or reviewer may treat the skill as lower risk than it really is, while the skill can still drive filesystem access and command execution in practice.

Static analysis

No suspicious patterns detected.