Bio-chat: Hardcore Primer Designer

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 6:27 PM UTC
• Version: 5.1.0

Overview

This skill is a coherent RT-qPCR primer design helper with a minor dependency hygiene issue, not evidence of hidden or harmful behavior.

Before installing, consider pinning requests to a reviewed version or using a lockfile. Expect the script to make NCBI web requests for the accession IDs you provide; no local credential or persistent system access was observed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned Third-Party Dependency Allows Uncontrolled Package Resolution

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Complete Code Snippet:

text

requests

Technical Analysis

The project declares requests without an exact version or integrity hash. Consequently, each installation may resolve to a different package release based on the mutable state of the configured package index. This prevents reproducible dependency verification and increases exposure to supply-chain compromise, malicious package-index behavior, or an unexpectedly incompatible future release.

Although the dependency name is not an apparent typosquat and no malicious package behavior was identified in the reviewed project, the installation process does not ensure that users receive the same reviewed artifact.

Attack Path

1. An attacker compromises the configured package index, a dependency distribution channel, or a future eligible release.
2. A user installs the project dependencies using pip install -r requirements.txt.
3. The package resolver selects the attacker-controlled or otherwise unreviewed release because no exact version or hash is required.
4. Package installation logic or imported runtime code executes in the user's Python environment.
5. The malicious dependency acts with the permissions of the user or automation account performing installation or running the assay script.

Impact Assessment

Successful exploitation could permit arbitrary Python code execution with the privileges of the installing or executing account. Depending on that account's permissions, the affected scope could include project data, accessible files, environment variables, network resources, and credentials available to the Python process. This finding does not itself provide privilege escalation beyond the invoking account.

Remediation

View remediation

Remediation Suggestions

• Pin requests to an exact, reviewed version, such as requests==X.Y.Z.
• Generate and commit a lock file that captures all transitive dependency versions.
• Require cryptographic hashes during installation, for example by using a hash-locked requirements file with pip install --require-hashes.
• Configure installations to use trusted package indexes over TLS and restrict unapproved additional indexes.
• Add automated dependency vulnerability and provenance scanning to the release process.
• Regularly update pins through a controlled review and testing workflow rather than allowing unconstrained resolution at installation time.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The dependency is specified as just requests with no version pin, which makes builds non-reproducible and can cause different environments to install different releases, including vulnerable or breaking ones. In a security-sensitive agent skill, this increases supply-chain risk because the exact package version cannot be audited or consistently controlled.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The manifest references requests without a pinned version even though multiple advisories exist for that package, so there is no way to verify whether installation will resolve to a safe release. This is more dangerous than a generic unpinned dependency because known flaws in some requests versions could be introduced silently depending on when and where the skill is installed.

Content

No source excerpt is available for this finding.