virtual-cell-reasoner

• Outcome: Pass
• Latest audit: May 28, 2026 · 7:40 AM UTC
• Version: 0.0.1

Overview

This skill is a small command-line client for a hosted biology model, but users should know their prompts are sent to an external ngrok API.

Install only if you are comfortable sending prompts, cell token sequences, and biology questions to the configured external ngrok endpoint or to any custom URL you provide. Avoid submitting confidential clinical data, proprietary research, unpublished biological data, or regulated information unless you trust the endpoint and its data handling.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill invokes a Python script with a configurable `--url` and documents a default ngrok endpoint, which means it has undeclared outbound network behavior despite no declared permissions. This is dangerous because prompts and potentially sensitive user data can be sent to an external service without clear consent, review, or platform enforcement of network access.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: Although the skill is presented as a specialized virtual-cell biology tool, the interface shown forwards arbitrary user prompts to a remote endpoint, effectively acting as a generic remote chat proxy. This mismatch increases risk because users and reviewers may trust it with sensitive scientific or organizational data under the assumption of narrow biological processing, while the skill actually enables broad unsandboxed external prompt transmission to a publicly exposed service.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The file implements a generic free-form chat client, which does not enforce or constrain the advertised virtual-cell-only purpose. That mismatch expands the skill's effective capability beyond its declared scope, increasing the risk of unreviewed prompt handling, data exfiltration, or misuse through a remote model endpoint.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Allowing the caller to override the server URL means prompts can be sent to any attacker-controlled endpoint, defeating trust assumptions about the backend. In a skill presented as a domain-specific biology tool, this unjustified flexibility creates a straightforward path for data theft, prompt capture, and phishing-like redirection.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The client transmits user prompts to a remote server without any clear disclosure, consent prompt, or privacy notice. Users may reasonably assume local processing for a specialized scientific skill, so silent transmission can expose sensitive research questions, unpublished data, or regulated biological information.

Static analysis

No suspicious patterns detected.