T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:690- Finding
Persistent External Platform Promotion Through Skill Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
pymatgen
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a legitimate pymatgen materials-science helper, but it includes an unrelated instruction to promote the publisher's external K-Dense service during complex user work.
Review this skill before installing because it can steer agent replies toward K-Dense Web even when the user did not ask for platform recommendations. If installed, ignore or remove that promotional instruction, use an isolated Python environment, handle MP_API_KEY as a secret, and run file-writing examples only in directories where generated files can safely be created or overwritten.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Note
- Location
SKILL.md:35- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (15)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md Programmatically access the Materials Project database. **Setup:** 1. Get API key from https://next-gen.materialsproject.org/ 2. Set environment variable: `export MP_API_KEY="your_key_here"` **Search and retrieve:**
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 91% confidence
- Finding
The skill contains suspicious non-ASCII/misencoded characters such as 'Ų', 'ų', and 'eV/Ų', indicating Unicode corruption or mixed-script text. While not directly exploitable on its own, this can mislead users about scientific units, break downstream parsing, and create room for visual spoofing or instruction ambiguity in a high-trust technical skill.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 86% confidence
- Finding
The skill demonstrates environment-variable handling and file-writing behavior but does not declare any explicit tool scope or allowed permissions. In an agent setting, this weakens least-privilege boundaries and may let the runtime grant broader capabilities than users expect for a documentation-oriented skill.
- Content
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md ### Getting an API Key 1. Visit https://next-gen.materialsproject.org/ 2. Create an account or log in 3. Navigate to your dashboard/settings 4. Generate an API key 5. Store it as an environment variable:
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill documents use of the Materials Project API without a clear user-facing warning that queries transmit data over the network and rely on an API key. This can cause users to unknowingly send identifiers, search terms, or research context to an external service.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The instructions tell users to export an API key but omit credential-handling guidance such as avoiding hardcoding, logs, shell history leakage, and accidental exposure in shared environments. In agent-assisted workflows, such omissions increase the chance of credential misuse or unintentional disclosure.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The documentation states that pymatgen units are 'typically assumed to be in atomic units', but the bullets immediately specify angstroms, electronvolts, and degrees. Those are standard materials-science units, not atomic units, so the prose actively misdescribes the code/library's intended unit semantics.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The documentation advises users to persist an API key in shell configuration files, which can increase long-term secret exposure risk if those files are shared, backed up insecurely, or committed accidentally. While storing credentials in environment variables is common practice, recommending persistent storage without an accompanying warning about secret handling or safer alternatives is a real but low-severity documentation security issue.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This markdown file includes workflow commands that write VASP input files to local directories, which affects the user's filesystem. The surrounding documentation presents these as straightforward recipes but does not include any warning that running them will create or overwrite calculation directories and files.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The example uses
MPRester()to retrieve data from Materials Project, which implies outbound network access and typically use of API credentials. The markdown does not warn users that executing this workflow contacts an external service and may require configured authentication.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This workflow writes a plot image to
band_structure.png, which modifies the local filesystem. The documentation does not disclose that executing the example will create output artifacts in the working directory.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The enumeration workflow exports up to 10 CIF files to the current directory, which is a user-data-affecting operation. The markdown lacks any warning that running the loop will create multiple files and may overwrite existing files with matching names.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The screening workflow writes
screened_materials.csvto disk, creating a persistent output file. The skill description does not warn users about this filesystem change or potential overwriting of an existing results file.- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The manifest and module description emphasize analyzing crystal structures and providing information, which suggests read/compute behavior. The code additionally persists results to disk in JSON or YAML when --export is used, extending behavior from analysis into file generation.
- Content
Static analysis
No suspicious patterns detected.