Protein-Ligand Docking

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:23 AM UTC
• Version: 2.3.0

Overview

The skill has a coherent scientific docking purpose, but its helper scripts allow an untrusted executable path and an output-name path escape that users should review before installing.

Install only if you trust the user inputs and execution environment. Run the scripts in a dedicated least-privilege workspace, use a trusted absolute AutoDock Vina path, avoid attacker-controlled --vina_path and --output_name values, and do not run the report generator where unintended .md or .docx overwrites would be harmful.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/step7_summary_report.py:182

Finding

Workspace Escape and Arbitrary File Overwrite Through Unvalidated Output Name

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/step6_vina_docking.py:57

Finding

Caller-Controlled AutoDock Vina Executable Allows Executable Substitution

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill instructs use of local scripts, saving files, and running docking tooling, which implies shell execution and file writes, yet it declares no explicit tool scope or permission boundaries. Without an allowlist, an agent may execute broader-than-intended commands or write files in unexpected locations, increasing the risk of misuse if the skill or downstream inputs are adversarial or malformed.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/step6_vina_docking.py (reported line 39)May include surrounding context.

python

'obabel', '-ipdb', pdb_file,
        '-opdbqt', '-O', output_path, '-xr'
    ]
    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        raise RuntimeError(f"obabel failed: {result.stderr}")
    print(f"  Receptor prepared: {output_path}")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/step6_vina_docking.py (reported line 52)May include surrounding context.

python

'obabel', '-ipdb', pdb_file,
        '-opdbqt', '-O', output_path, '-xr'
    ]
    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        raise RuntimeError(f"obabel failed: {result.stderr}")
    print(f"  Receptor prepared: {output_path}")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 90% confidence

Finding

The script executes a user-controllable binary path via --vina_path, so an attacker who can influence that argument can cause arbitrary local program execution under the script's privileges. In a research workflow skill that may be run on shared compute or automation infrastructure, this is more dangerous than a normal CLI helper because the script explicitly treats the executable path as data from the caller and runs it without trust checks.

Content

Scanner excerpt · scripts/step6_vina_docking.py (reported line 83)May include surrounding context.

python

]

    print(f"\nRunning Vina...")
    result = subprocess.run(cmd, capture_output=True, text=True, cwd=output_dir)
    output = result.stdout + result.stderr
    print(output[-2000:])

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring lists two outputs, including alignment_visualization.txt, implying the script generates both numerical results and a text visualization. In implementation, only alignment_results.json is written at L66-L68, and the alignment text is merely embedded inside the JSON object rather than saved as a separate text file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The script creates an output directory and writes generated files including receptor.pdbqt, ligand.pdbqt, and docking_summary.json. While it prints status messages after some actions, there is no upfront warning in the module docstring or CLI help that running the skill will create or overwrite artifacts in the specified output directory.

Content

No source excerpt is available for this finding.