Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

SYRI 共线性分析

v1.0.0

执行基因组间 SYRI 共线性分析,包含染色体处理、minimap2 比对、结构变异检测及 plotsr 可视化流程。

0· 125·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The SKILL.md clearly requires minimap2, SYRI, plotsr, Biopython and use of conda/pip or building from source, but the registry metadata lists no required binaries/env vars. That omission is an inconsistency — the skill needs several external tools to function.
Instruction Scope
Instructions stay within the stated analysis workflow (FASTA manipulation, minimap2 alignment, SYRI analysis, plotsr visualization). Items to watch: examples redirect stderr into the SAM file (they later show how to clean it), they suggest running minimap2 in background and printing PID, and they recommend very high thread counts (64–120) which can exhaust CPU/memory. These are operational choices rather than malicious behavior, but they can cause resource exhaustion or corrupted output if followed without care.
Install Mechanism
This is instruction-only (no install spec). The installation guidance uses conda/pip and optionally git clone + make from GitHub — standard for bioinformatics tools. No high-risk arbitrary download URLs are present.
Credentials
No credentials or special environment variables are requested. The script uses local file paths and standard package managers only; no unexplained secrets or external endpoints are required.
Persistence & Privilege
Skill is not always-enabled and does not request persistent or elevated privileges. It is instruction-only and does not modify other skills or global agent config.
What to consider before installing
The skill appears to implement a legitimate SYRI analysis pipeline, but before installing/running it: 1) ensure the required tools (minimap2, syri, plotsr, Biopython) are actually installed — the registry metadata omits these requirements; 2) run inside a controlled conda environment to avoid polluting system Python; 3) avoid redirecting stderr into the SAM file (minimap2 stdout should be captured to the SAM file and stderr to logs); if you do capture both, be prepared to clean the SAM as shown; 4) be cautious with the recommended 64–120 threads — verify you have the CPU, memory, and I/O capacity, otherwise reduce thread count; 5) monitor backgrounded processes (they recommend using & and echo PID) to avoid orphaned jobs; 6) verify and test the chromosome renaming/mapping script on a small example before running on full genomes to avoid irreversible data mistakes; and 7) consider asking the skill author or maintainer to update the skill metadata to list required binaries and any recommended compute resources so the registry entry and SKILL.md are consistent.

Like a lobster shell, security has layers — review code before you run it.

latestvk971nj4n5cxsfm1fjcjk3w8r9h836724

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Comments