Back to skill

Security audit

Biochemistry and Molecular Biology-PMPH-10edition

Security checks for vulnerabilities and agentic risk

Overview

This is a markdown-only biochemistry skill collection, but several medical and gene-engineering subskills provide under-scoped treatment, emergency-care, and wet-lab guidance that users should review carefully before installing.

Install only if you want an always-available biomedical textbook reference. Do not use it as a source of patient-specific diagnosis, prescribing, emergency management, gene therapy planning, CRISPR work, or recombinant DNA protocols without qualified clinical, institutional, regulatory, and biosafety review.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (199)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill explicitly includes designing stage-specific targeted treatment strategies and using molecular staging for diagnostic or intervention decisions, but it does not state that outputs are educational only, not medical advice, and must not be used directly for patient care. In a medical oncology context, an agent could produce overly authoritative treatment guidance based on an oversimplified progression model, creating risk of misdiagnosis, inappropriate therapy selection, or delayed specialist care.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The front matter and description present the skill as one that can '制定并实施' a gene therapy plan, which frames the model as directing or enabling medical treatment actions rather than providing general educational information. Because the content concerns invasive, experimental, and clinically sensitive interventions, the lack of restriction to qualified professionals or controlled clinical contexts materially increases the risk of harmful misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill gives operational guidance for high-risk gene therapy interventions, including gene interference, tumor suppressor delivery, cytokine gene transfer, and suicide gene therapy, without any warning about medical risk, investigational status, or the need for licensed clinical oversight. In context, this could encourage unsafe real-world medical action or overconfident use of experimental interventions outside regulated research and treatment settings.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill provides emergency medical intervention guidance for suspected hypo- and hyperglycemia, including glucose administration advice, but does not clearly instruct the user to seek immediate professional or emergency medical help. In a medical triage context, omission of escalation guidance can delay definitive care, especially for unconscious patients or those at risk of diabetic ketoacidosis, hyperosmolar crisis, or recurrent hypoglycemia.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill provides a concise end-to-end workflow for recombinant DNA construction, including vector selection, ligation, transformation/transfection, selection markers, and induced expression, but does not warn about biosafety, legal, institutional, or dual-use constraints. In this context, omission of risk warnings makes the skill more dangerous because recombinant-DNA methods can be repurposed for unsafe manipulation of biological systems, especially when viral vectors and gene expression are mentioned.

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 172)May include surrounding context.

md
<a href="https://www.star-history.com/?repos=xllgreen%2FBiochemistry-MolecularBiology-PMPH-10edition&type=date&legend=top-left">
 <picture>
   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=xllgreen/Biochemistry-MolecularBiology-PMPH-10edition&type=date&theme=dark&legend=top-left" />
   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/chart?repos=xllgreen/Biochemistry-MolecularBiology-PMPH-10edition&type=date&legend=top-left" />
   <img alt="Star History Chart" src="https://api.star-history.com/chart?repos=xllgreen/Biochemistry-MolecularBiology-PMPH-10edition&type=date&legend=top-left" />
 </picture>

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 173)May include surrounding context.

md
<a href="https://www.star-history.com/?repos=xllgreen%2FBiochemistry-MolecularBiology-PMPH-10edition&type=date&legend=top-left">
 <picture>
   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=xllgreen/Biochemistry-MolecularBiology-PMPH-10edition&type=date&theme=dark&legend=top-left" />
   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/chart?repos=xllgreen/Biochemistry-MolecularBiology-PMPH-10edition&type=date&legend=top-left" />
   <img alt="Star History Chart" src="https://api.star-history.com/chart?repos=xllgreen/Biochemistry-MolecularBiology-PMPH-10edition&type=date&legend=top-left" />
 </picture>

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 174)May include surrounding context.

md
<a href="https://www.star-history.com/?repos=xllgreen%2FBiochemistry-MolecularBiology-PMPH-10edition&type=date&legend=top-left">
 <picture>
   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=xllgreen/Biochemistry-MolecularBiology-PMPH-10edition&type=date&theme=dark&legend=top-left" />
   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/chart?repos=xllgreen/Biochemistry-MolecularBiology-PMPH-10edition&type=date&legend=top-left" />
   <img alt="Star History Chart" src="https://api.star-history.com/chart?repos=xllgreen/Biochemistry-MolecularBiology-PMPH-10edition&type=date&legend=top-left" />
 </picture>

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README_EN.md (reported line 138)May include surrounding context.

md
<a href="https://www.star-history.com/?repos=xllgreen%2FBiochemistry-MolecularBiology-PMPH-10edition&type=date&legend=top-left">
 <picture>
   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=xllgreen/Biochemistry-MolecularBiology-PMPH-10edition&type=date&theme=dark&legend=top-left" />
   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/chart?repos=xllgreen/Biochemistry-MolecularBiology-PMPH-10edition&type=date&legend=top-left" />
   <img alt="Star History Chart" src="https://api.star-history.com/chart?repos=xllgreen/Biochemistry-MolecularBiology-PMPH-10edition&type=date&legend=top-left" />
 </picture>

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README_EN.md (reported line 139)May include surrounding context.

md
<a href="https://www.star-history.com/?repos=xllgreen%2FBiochemistry-MolecularBiology-PMPH-10edition&type=date&legend=top-left">
 <picture>
   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=xllgreen/Biochemistry-MolecularBiology-PMPH-10edition&type=date&theme=dark&legend=top-left" />
   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/chart?repos=xllgreen/Biochemistry-MolecularBiology-PMPH-10edition&type=date&legend=top-left" />
   <img alt="Star History Chart" src="https://api.star-history.com/chart?repos=xllgreen/Biochemistry-MolecularBiology-PMPH-10edition&type=date&legend=top-left" />
 </picture>

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README_EN.md (reported line 140)May include surrounding context.

md
<a href="https://www.star-history.com/?repos=xllgreen%2FBiochemistry-MolecularBiology-PMPH-10edition&type=date&legend=top-left">
 <picture>
   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/chart?repos=xllgreen/Biochemistry-MolecularBiology-PMPH-10edition&type=date&theme=dark&legend=top-left" />
   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/chart?repos=xllgreen/Biochemistry-MolecularBiology-PMPH-10edition&type=date&legend=top-left" />
   <img alt="Star History Chart" src="https://api.star-history.com/chart?repos=xllgreen/Biochemistry-MolecularBiology-PMPH-10edition&type=date&legend=top-left" />
 </picture>

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

This markdown file contains user-facing instructions exclusively in Chinese, which can impose a language/locale requirement without user opt-in. The policy allows locale constraints only when explicitly offered as a choice or clearly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The file presents all user-facing instructions in Chinese, including the description and procedural steps, with no opt-in or alternative language path. This can violate a language/locale policy when a skill forces a specific language without user choice or documented justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file’s natural-language description and all user-facing instructional content are written exclusively in Chinese, with no indication that the skill can adapt to the user's preferred language or locale. Under the policy for natural-language violations, forcing a specific language without user opt-in is a reportable issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The file’s name, description, headings, and operational guidance are entirely in Chinese, and there is no indication that the skill supports other languages or asks for user preference. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest description and all user-facing instructions are written exclusively in Chinese, which imposes a specific language on users. The file does not mention that Chinese is optional, nor does it justify a region-specific or language-specific requirement for this protein-structure analysis skill.

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill explicitly states it should be used to select appropriate antibiotics for bacterial infections, but it does not include any warning that this is educational information rather than patient-specific medical advice. In a medical context, omission of clinician oversight can encourage unsafe self-diagnosis or inappropriate antibiotic selection, which may lead to treatment failure, adverse effects, or antimicrobial resistance.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.