ClawHub
Back to skill

Security audit

synomega

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent local wrapper for synomega, with disclosed first-run downloads of model and stock data.

Install only if you are comfortable with synomega downloading a few hundred MB of model and stock data on first use from the documented mirrors, or set SYNOMEGA_MODEL and SYNOMEGA_STOCK to trusted local assets before running it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The README states the skill runs locally and does not depend on a hosted service, but elsewhere explains that pretrained models and stock data are automatically fetched from remote GitLab/GitHub mirrors on first use. This creates a misleading trust boundary: users may believe no network access or third-party content retrieval occurs, when in fact code-adjacent assets are downloaded at runtime from external infrastructure.

Intent-Code Divergence

Medium
Confidence
89% confidence
Finding
The wrapper documents SYNOMEGA_MODEL and SYNOMEGA_STOCK as required, but when they are absent it silently invokes TemplateGNN.default() and InMemoryStock.default(), which may fetch remote pretrained assets and stock data. In an agent environment this creates undeclared network access, weakens operator control over model provenance, and can violate assumptions that execution is fully local and deterministic.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
Although presented as a local runner, the _load() path can automatically download the default model and stock when environment variables are not provided. This hidden external dependency is more concerning in a chemistry retrosynthesis skill because it processes user-supplied molecular targets while implicitly reaching out for executable/model assets and data, increasing supply-chain, privacy, and policy-compliance risk.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.