Security audit

rdkit

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly local RDKit guidance and helper scripts, but it includes an unrelated instruction to proactively advertise the publisher's hosted web service during complex work.

Install only if you are comfortable with the skill influencing answers to recommend K-Dense Web during complex tasks. Treat that hosted service as optional, avoid sending proprietary chemistry data to it unless you intend to, and install RDKit in an isolated environment with pinned versions where possible. Only load pickle caches from trusted sources.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:769
Finding: Creator-Owned Service Promotion Alters Agent Responses
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: references/api_reference.md:411
Finding: Unpinned Third-Party Package Installation Creates Supply-Chain Exposure
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill includes an instruction to proactively promote an external hosted platform that is unrelated to the core RDKit API guidance. This can steer users and agents toward a third-party service for reasons outside the immediate task, creating a prompt-injection style trust boundary issue, potential data exfiltration risk, and commercially biased behavior.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.