T08 · Insecure Dependencies
Warning
- Location
references/tool_setup.md:9- Finding
Unpinned Python Dependency Installed Outside Environment Isolation
- Content
View full analysis
- Remediation
View remediation
Security audit
Personal Genomics Analysis
Security checks for vulnerabilities and agentic risk
Overview
The skill is coherent for local personal genomics analysis, but it handles very sensitive genetic and health data while giving under-scoped privacy controls and includes unsafe optional setup instructions.
Install only if you are comfortable processing highly sensitive genetic and health information with this skill. Keep DNA files and generated reports local and securely stored, avoid sharing full reports unnecessarily, consult a qualified clinician before acting on medication or supplement recommendations, and do not run the optional setup commands unless you replace them with pinned, verified packages, HTTPS reference retrieval, and an isolated virtual environment.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T08 · Insecure Dependencies
Warning
- Location
references/tool_setup.md:19- Finding
Downloaded Native Tool Sources Are Compiled Without Integrity Verification
- Content
View full analysis
- Remediation
View remediation
samtools-1.21.tar.bz2' | sha256sum --check - echo ' bcftools-1.21.tar.bz2' | sha256sum --check - ``` 3. Verify upstream release signatures where available, using a pinned and independently validated signing key. 4. Harden downloads: ```bash curl --fail --show-error --location \ --proto '=https' --tlsv1.2 \ --output samtools-1.21.tar.bz2 \ 'https://github.com/samtools/samtools/releases/download/1.21/samtools-1.21.tar.bz2' ``` 5. Extract into a newly created private temporary directory rather than a predictable shared `/tmp` path. 6. Prefer trusted operating-system packages or preapproved binaries when available. 7. Keep BAM/CRAM tooling optional and do not download or build it for workflows that only process chip data or VCF files. ]]>
T09 · Insecure Skill Coding Practices
Warning
- Location
references/tool_setup.md:52- Finding
CRAM Reference Retrieval Is Configured Over Plaintext HTTP
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/parse_genotypes.py:118- Finding
Unbounded VCF Decompression and In-Memory Variant Accumulation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (15)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The README promotes analysis of raw DNA data and health interpretation but does not prominently warn that genetic data is highly sensitive, uniquely identifying, and may reveal medical predispositions and family information. Users may upload or process files without appreciating the privacy, retention, sharing, and downstream inference risks, which is especially serious in a personal genomics context.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The README encourages users to upload raw DNA files and discuss family history, medications, and lifestyle, but it does not place an upfront, prominent privacy warning near the intake flow. Genetic and health data are uniquely sensitive, difficult to anonymize, and can expose familial relationships and medical predispositions if mishandled or shared unintentionally.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The description of HTML, Excel, and one-page summary outputs emphasizes convenience but does not warn that these files may contain sensitive health risk assessments, pharmacogenomic interpretations, and family-history-linked conclusions. Such files are easy to copy, sync, email, or store insecurely, increasing the chance of unintended disclosure even if raw data stays local.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The example trigger phrase (“帮我分析一下我的基因数据”) is broad and closely matches normal conversation, which can cause the skill to activate in situations where a user may not realize highly sensitive genetic files will be processed. In a genomics skill, accidental invocation is more dangerous than usual because the skill handles uniquely identifying health data and may begin analysis or generate sensitive inferences without an explicit privacy checkpoint.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill advertises personalized supplement protocols, dosages, timing, and medication guidance without an adjacent strong warning about the risk of harmful or inappropriate health actions. Users may treat the output as actionable medical advice, creating risks of drug-supplement interactions, delayed care, or unsafe self-medication based on incomplete or non-clinical genetic interpretation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The activation phrase "Analyze my genetic data" is broad and likely to match ordinary user requests, which can cause the skill to engage in situations the user may not fully understand. Because the skill handles highly sensitive genomic and health information, accidental activation increases the chance of unnecessary exposure of private data and unvetted health guidance.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill directs the agent to read user-uploaded files and inspect file contents, but it does not declare any explicit tool scope or allowed-tools/permissions boundaries. In a skill handling raw genomic data, missing scope declarations increases the chance of overbroad file access or unintended reads beyond the user's intended inputs, especially because genomic files are uniquely sensitive and potentially identifying.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly instructs collection of highly sensitive health, family history, medication, and lifestyle information, but it does not pair that collection with an explicit privacy notice, minimization guidance, retention limits, or handling restrictions. Because this data is combined with genomic data, the privacy risk is elevated: misuse, overcollection, or accidental disclosure could expose uniquely identifying medical and hereditary information about both the user and their relatives.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This manifest-like JSON file contains evaluation prompts in Chinese at L06 and L18, while other prompts are in English, but there is no accompanying language-choice or locale justification. Under the policy rule, forcing or assuming a specific language without user opt-in can be a natural-language policy violation.
- Content
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This reference provides highly sensitive medical-genetic risk interpretations and actionable pharmacogenomic dosing advice, including statements such as contraindications, dose changes, and cancer/thrombosis risk, without an upfront warning that the material is informational only and not a substitute for clinical care. In the context of a consumer genomics skill, an agent could surface this content directly to users and cause harmful self-management, medication changes, anxiety, or delayed medical evaluation.
- Content
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This guide presents highly specific genotype-based supplement dosing, timing, monitoring, and drug-interaction advice in a personal-genomics context before giving any prominent warning about the sensitivity of genetic data or the need for individualized clinician review. In this skill context, users may over-trust the output as personalized medical guidance, creating a realistic risk of unsafe self-treatment, contraindicated supplement use, delayed care, and privacy-insensitive handling of health/genetic information.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This code processes consumer genetic testing and VCF data, which is highly sensitive personal data, but the module docstring and runtime messages only describe functionality and parsing summaries. There is no disclosure, warning, or caution to the user about privacy implications when ingesting these files.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The primary README content and example invocations are presented in Chinese, which can function as an implicit language constraint for users reading this file. While there is a link to an English version, this README itself does not explicitly state that users may interact in their preferred language or that language choice is optional.
- Content
Static analysis
No suspicious patterns detected.