Chemical Storage Sorter

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:33 AM UTC
• Version: 0.1.0

Overview

This skill is not malicious, but it gives safety-critical chemical storage advice with under-scoped warnings and demonstrably unsafe classification behavior.

Install only for rough demonstration or non-operational triage. Do not use it to make real lab storage, inspection, relocation, or training decisions unless its output is independently checked against SDS data, institutional SOPs, and qualified EHS review; also treat inventory files as local data that may be read or transformed by the skill.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/main.py:15
• Finding: Unsafe First-Match Chemical Classification Produces False Compatibility Results## Vulnerability Details **File Location**: `scripts/main.py:15-94` **Vulnerability Type**: Unsafe classification and fail-open compatibility logic **Risk Level**: High ### Vulnerable Code ```python COMPATIBILITY_GROUPS = { "acids": { "compatible": ["acids"], "incompatible": ["bases", "oxidizers", "cyanides", "sulfides"], "examples": ["HCl", "H2SO4", "HNO3", "acetic acid"] }, "bases": { "compatible": ["bases"], "incompatible": ["acids", "oxidizers", "halogenated"], "examples": ["NaOH", "KOH", "ammonia", "Trizma"] }, "flammables": { "compatible": ["flammables"], "incompatible": ["oxidizers", "acids"], "examples": ["ethanol", "methanol", "acetone", "hexane"] }, "oxidizers": { "compatible": ["oxidizers"], "incompatible": ["flammables", "acids", "bases", "reducing"], "examples": ["H2O2", "KMnO4", "sodium hypochlorite", "nitric acid"] }, "toxics": { "compatible": ["toxics"], "incompatible": ["acids", "oxidizers"], "examples": ["cyanide salts", "arsenic compounds", "mercury"] }, "general": { "compatible": ["general", "salts", "buffers"], "incompatible": [], "examples": ["NaCl", "PBS", "sucrose", "glycerol"] } } def classify_chemical(self, name): """Classify chemical into storage group.""" name_lower = name.lower() for group, data in self.COMPATIBILITY_GROUPS.items(): for example in data["examples"]: if example.lower() in name_lower: return group # Check keywords acid_keywords = ["acid", "hcl", "sulfuric", "nitric", "acetic"] base_keywords = ["hydroxide", "naoh", "koh", "ammonia", "amine"] flammable_keywords = ["ethanol", "methanol", "acetone", "ether", "hexane"] oxidizer_keywords = ["peroxide", "permanganate", " ...[truncated 4085 chars]
• Remediation: ## Remediation Suggestions 1. Replace the single-value classifier with a model that returns every applicable hazard class, such as `{"acids", "oxidizers"}`. 2. Evaluate compatibility across all hazard-class combinations. Any incompatible combination should make the overall result incompatible. 3. Remove the assumption that equal broad groups are automatically compatible. Require explicit chemical-specific or reviewed compatibility data. 4. Return an `unknown` or `review_required` status for unrecognized chemicals instead of silently assigning them to `general`. 5. Require manual SDS or EHS verification for unknown names, mixtures, proprietary products, ambiguous matches, and multi-hazard chemicals. 6. Use normalized identifiers such as CAS numbers or a curated chemical database instead of unrestricted substring matching. 7. Add explicit precedence and multi-hazard rules for oxidizing acids and other overlapping categories. 8. Distinguish definitive compatibility results from advisory results and display a prominent warning that automated classification is not a substitute for SDS review. 9. Add regression tests covering: - Nitric acid as both an acid and an oxidizer. - Chemicals with multiple hazard classes. - Two chemicals in the same broad group that are not automatically compatible. - Unsupported hazardous names. - Ambiguous substrings and mixtures. - Empty and malformed input. 10. Prevent storage-plan generation from placing `unknown` or `review_required` substances into ordinary storage groups until a qualified reviewer approves them.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Harmful Content Injection

Critical

• Category: Prompt Injection

Content

demo_inventory = [
    "HCl (concentrated)",
    "NaOH pellets",
    "Ethanol",
    "Hydrogen peroxide",
    "Sodium cyanide",
    "PBS",
    "Acetone"
]

groups = sorter.sort_chemicals(demo_inventory)

• Confidence: 70% confidence
• Finding: This content may contain harmful instructions that could cause physical harm if followed. CRITICAL: Review carefully before use.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: This skill produces laboratory chemical storage recommendations in a safety-critical domain using simple substring heuristics and compatibility groupings, but it does not explicitly warn users that the output is only an aid and must not be relied on as the sole basis for storage decisions. Misclassification or over-trust could cause incompatible chemicals to be co-stored, creating risks of fire, toxic gas release, or violent reaction.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The skill’s Security Checklist and Risk Assessment claim there is no file system access, but earlier examples explicitly open and read inventory files and describe generating output files. This mismatch can mislead operators, reviewers, or policy engines into granting broader trust than warranted and may cause unintended local data exposure when users run file-based workflows.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill description and security section understate operational side effects by omitting that example workflows may read inventory files and create output files. In an agent setting, incomplete disclosure reduces informed consent and can lead users to expose local inventory data or allow writes they would otherwise deny.

Natural-Language Policy Violations

Low

• Confidence: 86% confidence
• Finding: The document uses Chinese labels `上游` and `下游` alongside English in an otherwise English-language skill description, without offering a language choice or explaining a locale-specific requirement. This can conflict with a language/locale policy that requires user opt-in before forcing or introducing a different language context.

Static analysis

No suspicious patterns detected.