ClawHub
Back to skill

Security audit

Synomega

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent local retrosynthesis helper, with disclosed first-use downloads that users should understand before installing.

Install only if you are comfortable with pip installing synomega and allowing a first-use download of large model and stock files from configured mirrors. For controlled or air-gapped environments, prefetch assets with synomega download or set SYNOMEGA_MODEL and SYNOMEGA_STOCK to reviewed local files, and consider pinning package versions and cache location.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Intent-Code Divergence

Medium
Confidence
92% confidence
Finding
The README states the skill runs locally and does not depend on any hosted service, but the documented behavior includes automatic first-run downloads of model and stock files from remote mirrors. This is a security-relevant discrepancy because users and agents may assume no network access or remote supply-chain exposure, when in fact execution can trigger remote fetches from mirror infrastructure outside the local environment.

Intent-Code Divergence

Medium
Confidence
94% confidence
Finding
The docstring states that SYNOMEGA_MODEL and SYNOMEGA_STOCK are required, but the implementation silently falls back to TemplateGNN.default() and InMemoryStock.default() when they are unset. In an agent environment, this can trigger unannounced network access and use of unpinned remote artifacts, undermining expectations of fully local execution and introducing supply-chain and reproducibility risk.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
Although the skill is presented as running synomega locally, _load() will download default pretrained model and stock artifacts when environment variables are absent. In a security-sensitive agent context, hidden remote fetches can violate sandbox assumptions, leak usage metadata, and expose execution to tampered or changed upstream artifacts.

Missing User Warnings

Low
Confidence
84% confidence
Finding
The README notes automatic downloads, but it does not clearly frame them as a security warning or emphasize that first use causes outbound network access and retrieval of executable model assets/data. In agent and sandboxed environments, undocumented or underemphasized remote fetching can violate operator expectations, bypass review of dependencies, and increase supply-chain risk.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.