Security audit

Personal Genomics

Security checks across malware telemetry and agentic risk

Overview

This genomics skill appears privacy-focused and local-only, but it handles extremely sensitive DNA and health information while saving rich reports to disk and making some high-impact medical or identity inferences without enough guardrails.

Install only if you are comfortable having local plaintext DNA-derived reports created on your machine. Use a dedicated output folder, avoid cloud-synced or shared directories, delete reports when done, and treat health, cancer, carrier, medication, ancestry, and sex-related results as informational screening only, not medical advice or diagnosis.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (84)

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The docstring asserts strong privacy expectations ('all analysis runs locally' and 'no network requests'), but the script also writes highly sensitive genomic analysis outputs to a predictable directory under the user's home folder. While local-only processing is true in a narrow sense, the claim is misleading because it omits persistent storage of derived health and trait reports, which can expose sensitive data to other local users, backups, sync tools, or later compromise of the host.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The module claims analysis runs locally with no network requests, which is true, but it omits that highly sensitive genetic analysis results are automatically persisted to disk in the user's home directory. For DNA data, undisclosed local persistence materially increases privacy risk because other local users, backups, sync tools, or malware could access the saved reports even when the user expects ephemeral processing.

Intent-Code Divergence

Low

Confidence: 83% confidence
Finding: The UI promises that analysis runs locally and no data is uploaded, but the page also includes external links to third-party domains opened in a new tab. Even if no automatic upload occurs, this claim is overly broad and can mislead users handling highly sensitive genetic data into assuming there is zero external interaction or privacy risk. In a genomics dashboard, privacy assurances must be precise because users are making trust decisions about unusually sensitive information.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The module performs biological sex inference from X/Y chromosome coverage even though it is presented as a data quality utility. Inferring a sensitive biological attribute without an explicit, user-visible disclosure or opt-in expands processing beyond the apparent purpose of the module and can surprise downstream users or developers integrating it.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The module-level privacy claim says analysis is local-only, which can mislead users into believing no privacy-relevant side effects occur beyond in-memory processing. In reality, the script persists DNA-derived ancestry and haplogroup results to a predictable directory under the user's home folder, creating sensitive genetic data at rest without making that storage behavior explicit.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The module is framed as ancestry composition analysis, but it embeds and surfaces marker metadata tied to phenotype and identity-linked traits such as skin pigmentation, eye color, earwax type, lactase persistence, and subgroup labels like Ashkenazi Jewish. This expands the skill beyond ancestry estimation into sensitive inference territory, increasing privacy, discrimination, and misuse risk while potentially misleading integrators about the data being processed and exposed.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The embedded marker set and population descriptions enable inference of highly sensitive attributes, including ancestry, ethnic or religious subgroup proxies, and phenotype-associated information from genetic inputs. In an unknown-purpose skill, this is dangerous because it creates a ready-made capability for profiling users from DNA data without clear necessity, governance, or access controls.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The module is presented as athletic-performance profiling, but the implementation extends into injury susceptibility, inflammation, osteoarthritis, methylation, and brain-health style inferences. That mismatch can mislead downstream users or agents about the scope and safety of the skill, increasing the chance that sensitive health-related outputs are used without appropriate review or safeguards.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: This section derives medical-style traits from genetic data, including inflammation, neuro-recovery/brain health, methylation, and injury or osteoarthritis risk, then packages them as actionable interpretations. Inferring sensitive health information from consumer genotypes without strong guardrails can cause overconfident, misleading, or harmful decisions about training, supplements, recovery, or medical concerns.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The function labels any genotyped marker with a pathogenic classification as a detected pathogenic variant, without verifying that the user's genotype actually contains the pathogenic allele. In a hereditary cancer context, this can generate false positive BRCA/Lynch/TP53-style results and trigger alarming, clinically consequential recommendations such as urgent counseling, surgery discussions, or intensive surveillance.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The code explicitly infers sex from the presence or absence of Y-chromosome markers and returns that inference in the result structure. Sex inference from genotype data is sensitive biological profiling beyond simple haplogroup classification, and doing it implicitly increases privacy risk and the chance of collecting or exposing protected attributes without clear necessity or consent.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The function advertises support for an arbitrary condition code but, for unknown conditions, it silently computes against an empty SNP set and returns a plausible-looking 'average' result with percentile 50. In a medical-risk context, this fail-open behavior can mislead downstream systems or users into believing a condition was evaluated when no calculation occurred, causing incorrect reassurance or missed follow-up.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The module docstring states the markers are 'validated against consumer arrays,' but several entries are not standard consumer-array-friendly SNP markers and include values like repeat expansions or deletions that generally require specialized testing. In a genetics context, this can mislead downstream systems or users into overtrusting incomplete or technically invalid results, causing false reassurance or inappropriate alarm.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The module docstring frames these markers as 'generally not medically actionable,' but the dataset includes explicit medical-risk and quasi-treatment guidance such as cancer-risk statements, opioid dosing implications, and alcohol avoidance recommendations. That mismatch can cause downstream systems or users to treat sensitive health-related outputs as low-risk recreational content, reducing safeguards around consent, warnings, and clinical review.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The script promises privacy and says analysis runs locally, but it also silently persists highly sensitive genetic analysis results to a fixed directory in the user's home folder. Local-only processing does not eliminate privacy risk when outputs are stored without clear disclosure, because other local users, backups, sync tools, or later compromise of the machine could expose this data.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The docstring asserts that analysis runs locally, which is true in the narrow sense of no network exfiltration, but it omits that highly sensitive genetic results are persisted to a predictable directory in the user's home folder. For DNA/ancestry data, unexpected local retention materially increases privacy risk because other local users, backups, sync tools, or later compromise of the machine can expose the reports.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The changelog indicates that a dashboard containing personal genomics analysis is auto-generated on every run, which can cause sensitive health and ancestry information to be written to disk without explicit user awareness or consent. In a genomics skill, this is especially risky because the output may include highly sensitive personal data that persists in files, backups, shared directories, or browser caches.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The OpenClaw invocation example is broad enough that an agent could be prompted to analyze any file path supplied by a user without clear scope, confirmation, or file-type restrictions. In the context of a genetics skill, this increases the chance of unintended processing of highly sensitive personal data and makes prompt-driven misuse easier.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README states that multiple reports are automatically written to a predictable local directory, but it does not prominently warn that these outputs contain extremely sensitive genetic, ancestry, carrier, and medical-risk information. Even without network exfiltration, creating rich plaintext/HTML/JSON/PDF artifacts on disk can expose users through backups, shared accounts, endpoint indexing, or later compromise of the host.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger list is extremely broad and includes many health, ancestry, medication, and lifestyle topics without clear scope checks or consent gating. In an agent setting, this can cause the skill to activate on loosely related conversations and process highly sensitive genetic/medical information when the user did not explicitly request local DNA analysis, increasing the risk of over-collection, unintended medical inference, and privacy harm.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill documents a fixed output location under ~/dna-analysis/reports/ and multiple report artifacts, but does not prominently warn that it writes highly sensitive genetic, ancestry, and medical-risk data to persistent disk. This creates a real privacy and confidentiality risk because users or invoking agents may assume analysis is ephemeral, while the generated files could remain accessible to other local users, backups, indexing tools, or later processes.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The script writes highly sensitive genetic analysis results to a persistent JSON file in a reports directory without any explicit consent prompt, warning, access control, or minimization. Genomic data is uniquely identifying and can reveal health, ancestry, and familial information, so creating an unprotected artifact materially increases the risk of privacy breach, unintended sharing, or later exfiltration.

Natural-Language Policy Violations

Medium

Confidence: 82% confidence
Finding: The script hard-codes an expected heterozygosity value for a European population and uses it to derive an inbreeding-related interpretation without verifying that the assumption matches the user. This can produce misleading or harmful conclusions for users from other populations, especially because the output is framed as an analytical result rather than a tentative population-specific heuristic.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The code writes multiple genomic reports containing health risk, pharmacogenomic, trait, and APOE-related information to disk without explicit runtime consent or a clear warning before persistence. Genomic data is exceptionally sensitive and durable; storing it in plaintext JSON/Markdown under a fixed location increases the chance of unintended disclosure through shared machines, backups, cloud-sync folders, endpoint compromise, or later forensic recovery.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The script writes genetic analysis results to predictable persistent files under the user's home directory without explicit consent or a clear warning at write time. Genetic ancestry and haplogroup outputs are sensitive personal data, and local persistence increases the risk of later disclosure through shared accounts, backups, malware, or other local users/processes.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.