Security audit

rt-qpcr-primer-designer

Security checks for vulnerabilities and agentic risk

Overview

The skill is not malicious, but it materially overstates BLAST/transcriptome specificity validation that the included script does not actually perform.

Review before installing. The skill may be useful for generating draft RT-qPCR primers and formatted reports, but do not treat its specificity results as BLAST-validated or transcriptome-validated. Confirm network use before NCBI lookups, choose explicit output paths, and independently validate primer specificity with a trusted BLAST/transcriptome workflow before using results in experiments.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Agent Config Directory Access

High

Category: Agent Snooping
Confidence: 90% confidence
Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Content: Scanner excerpt · README.md (reported line 40)May include surrounding context.
md
### Installation #### Global Install (Antigravity / Gemini Agent): Place this folder into `~/.gemini/config/skills/rt-qpcr-primer-designer/`. #### Local Install: Place this folder into `.agents/skills/rt-qpcr-primer-designer/` in your workspace root.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill claims strong specificity validation, BLAST support, transcriptome off-target analysis, and gene name lookup, but the described implementation materially underdelivers. This is dangerous because users may trust the generated primers as experimentally validated when off-target screening is incomplete, leading to false scientific results, wasted experiments, and potentially unsafe downstream decisions based on incorrect assay specificity.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill describes capabilities that require network access and file read/write operations, but it does not declare an explicit tool scope or permissions boundary. This is dangerous because users and orchestrators cannot clearly determine what external access the skill may perform, increasing the risk of unintended data exfiltration, uncontrolled file output, or over-privileged execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill indicates use of NCBI fetching and BLAST-related network operations but does not clearly warn users that provided sequences, identifiers, or metadata may be transmitted to external services. This is dangerous in research and regulated environments because biological sequences or project context may be confidential, and silent transmission can violate privacy, policy, or data handling requirements.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The workflow guide says 'When the user asks to design qPCR primers' and then prescribes running the pipeline, but it does not define any narrower trigger phrases, scope limits, or exclusion conditions. This is broad enough to overlap with general discussion or advisory requests about qPCR primer design, increasing the risk of unintended invocation.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill description promises BLAST and transcript off-target specificity checking, but the implementation only counts exact 10-mer seed matches within the provided sequence and its reverse complement. This can create false confidence in primer specificity, causing users to rely on incomplete validation for experimental design and potentially produce misleading or failed biological results.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code sets user-facing output strings to Chinese only (for example, specificity descriptions), which forces a specific language/locale without user opt-in. The policy applies to all file types and is violated when a skill does not offer a language choice or document a justified locale restriction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Multiple worksheet titles, headers, and guidance texts are emitted only in Chinese, creating a fixed locale experience for all users. There is no indication that the tool is region-specific or that users can opt into this language choice.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The CLI help text states that specificity checking is against sequence/BLAST, but the code path only performs local sequence scanning. This mismatch is dangerous because operators may invoke the tool believing they have obtained external specificity validation when they have not, leading to unsafe scientific overtrust in the results.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The README advertises automatic NCBI fetching and Excel output generation without clearly warning users that the skill may perform external network access and write local files. In an agent context, undisclosed side effects can undermine user consent and operational expectations, especially in restricted or sensitive environments.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.