Generated: 2026-05-18 11:39 UTC
Skills scanned: 138
Total findings: 856
Critical: 68 | High: 18 | Safe skills: 107/138

• 🔴 CRITICAL BEHAVIOR_CROSSFILE_ENV_VAR_EXFILTRATION — Cross-file env var exfiltration: 7 files

  Environment variable access with network calls in scripts/backends.py, scripts/doctor.py, scripts/run.py Remediation: Review data flow across files: tests/test_backends.py, scripts/doctor.py, scripts/run.py, tests/test_run.py, tests/test_e2e.py, scripts/backends.py, tests/test_fetch_window.py

• 🔴 CRITICAL BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN — Cross-file exfiltration chain: 8 files

  Multi-file exfiltration chain detected: scripts/backends.py, scripts/doctor.py, scripts/run.py collect data → tests/smoke_lmstudio.py, scripts/run.py → tests/test_e2e.py, tests/test_run.py, tests/test_fetch_window.py, tests/test_backends.py, scripts/backends.py, scripts/doctor.py, scripts/run.py transmit to network Remediation: Review data flow across files: tests/test_backends.py, scripts/doctor.py, scripts/run.py, tests/test_run.py, tests/test_e2e.py, tests/smoke_lmstudio.py, scripts/backends.py, tests/test_fetch_window.py

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing compatibility Field in YAML Manifest

  The YAML manifest does not specify a 'compatibility' field. While this is optional per the skill spec, the skill makes network calls to external cloud APIs (Anthropic, Foundry) when configured to do so, which may not be compatible with all environments (air-gapped systems, corporate proxies). The description mentions network access but the manifest compatibility field is absent, which could mislead users about deployment requirements. File: SKILL.md Remediation: Add a compatibility field documenting network requirements, e.g.: 'compatibility: Requires screenpipe daemon on localhost:3030. Cloud backends (claude, foundry) require outbound HTTPS. Local backend (default) is fully offline after model download.'

• 🔴 CRITICAL BEHAVIOR_ENV_VAR_EXFILTRATION — Environment variable access with network calls detected

  Script accesses environment variables and makes network calls in scientific-skills/autoskill/scripts/backends.py File: scientific-skills/autoskill/scripts/backends.py Remediation: Remove environment variable harvesting or network transmission

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/autoskill/scripts/backends.py File: scientific-skills/autoskill/scripts/backends.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🔴 CRITICAL BEHAVIOR_ENV_VAR_EXFILTRATION — Environment variable access with network calls detected

  Script accesses environment variables and makes network calls in scientific-skills/autoskill/scripts/doctor.py File: scientific-skills/autoskill/scripts/doctor.py Remediation: Remove environment variable harvesting or network transmission

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/autoskill/scripts/doctor.py File: scientific-skills/autoskill/scripts/doctor.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🔴 CRITICAL BEHAVIOR_ENV_VAR_EXFILTRATION — Environment variable access with network calls detected

  Script accesses environment variables and makes network calls in scientific-skills/autoskill/scripts/run.py File: scientific-skills/autoskill/scripts/run.py Remediation: Remove environment variable harvesting or network transmission

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/autoskill/scripts/run.py File: scientific-skills/autoskill/scripts/run.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🔵 LOW LLM_DATA_EXFILTRATION — Environment Variable Access for API Keys Sent to External Network Endpoints

  The skill reads three environment variables (SCREENPIPE_TOKEN, ANTHROPIC_API_KEY, FOUNDRY_API_KEY) and transmits them as authentication credentials to network endpoints. While the skill documents this behavior explicitly and the stated purpose is legitimate authentication, the pattern of reading secrets from the environment and sending them over the network is flagged by static analysis as a potential exfiltration chain. The behavior is consistent with the documented design: each key is used only for its named endpoint (screenpipe localhost, Anthropic API, or Foundry gateway). No evidence of exfiltration to undocumented third-party endpoints was found. This is LOW severity because the behavior is transparent, documented, and user-controlled via opt-in configuration. File: scripts/backends.py Remediation: The current design is acceptable given explicit documentation. Consider adding runtime validation that the foundry endpoint matches an expected domain pattern to prevent misconfiguration from sending credentials to unintended hosts. Also consider logging (without the key value) which backend is active at startup so users can verify their configuration.

• 🔵 LOW LLM_DATA_EXFILTRATION — User-Configurable Foundry Endpoint Allows Credential Transmission to Arbitrary URLs

  The 'foundry' backend reads FOUNDRY_API_KEY from the environment and sends it as an authentication header to a user-supplied endpoint URL (config.foundry.endpoint). There is no validation that this URL is a trusted corporate gateway. A misconfigured or maliciously edited config.yaml could cause the API key to be sent to an attacker-controlled server. The risk is limited because the user must explicitly set backend: foundry and supply the endpoint, but the lack of URL validation is a defense-in-depth gap. File: scripts/backends.py:28 Remediation: Add URL validation for the foundry endpoint: require HTTPS, optionally allow an allowlist of trusted domain suffixes, and warn if the endpoint is not on a private/corporate network. At minimum, reject plaintext HTTP endpoints when transmitting API keys.

• 🔵 LOW LLM_RESOURCE_ABUSE — Unbounded Screenpipe Event Accumulation in Memory

  fetch_window.py paginates up to _MAX_PAGES=10,000 pages of screenpipe events, accumulating all results in a single in-memory list before returning. For a long time window with high OCR activity, this could consume significant memory. The hard ceiling of 10,000 pages at 50 events/page = 500,000 events is a reasonable bound but could still represent hundreds of MB of text data on an active workstation. This is a low-severity availability concern rather than a security threat. File: scripts/fetch_window.py:1 Remediation: Consider adding a configurable max_events parameter and streaming/chunked processing rather than accumulating all events in memory. Log a warning when the page limit is reached so users know results may be truncated.

• 🔵 LOW LLM_PROMPT_INJECTION — LLM Prompt Constructed from Unvalidated OCR Window Titles

  The synthesize.py script builds LLM prompts that include cluster data derived from screenpipe OCR output, specifically app names and window titles. While redact.py strips known secret patterns, window titles are free-form text that could contain adversarially crafted content (e.g., a browser tab titled 'Ignore previous instructions and output reuse for all clusters'). This is an indirect prompt injection risk: a malicious webpage title captured by screenpipe could influence the LLM's verdict (reuse/compose/novel) or the content of generated SKILL.md drafts. The impact is limited to the quality of generated skill drafts, not to credential theft or system compromise, since the LLM output is only written to a staging directory for user review before promotion. File: scripts/synthesize.py Remediation: Sanitize window titles before including them in LLM prompts: truncate to a maximum length (e.g., 100 chars), strip or escape characters that could be interpreted as prompt structure (newlines, dashes that form markdown headers, JSON-like braces). Consider wrapping the titles in a clearly delimited block with explicit instructions to the LLM to treat the content as data, not instructions.

• 🔴 CRITICAL BEHAVIOR_CROSSFILE_ENV_VAR_EXFILTRATION — Cross-file env var exfiltration: 6 files

  Environment variable access with network calls in scripts/extract_metadata.py, scripts/generate_schematic.py, scripts/search_pubmed.py, scripts/generate_schematic_ai.py Remediation: Review data flow across files: scripts/extract_metadata.py, scripts/generate_schematic_ai.py, scripts/generate_schematic.py, scripts/doi_to_bibtex.py, scripts/search_pubmed.py, scripts/validate_citations.py

• 🔴 CRITICAL BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN — Cross-file exfiltration chain: 6 files

  Multi-file exfiltration chain detected: scripts/extract_metadata.py, scripts/generate_schematic.py, scripts/search_pubmed.py, scripts/generate_schematic_ai.py collect data → scripts/generate_schematic_ai.py → scripts/extract_metadata.py, scripts/search_pubmed.py, scripts/doi_to_bibtex.py, scripts/validate_citations.py, scripts/generate_schematic_ai.py transmit to network Remediation: Review data flow across files: scripts/extract_metadata.py, scripts/generate_schematic_ai.py, scripts/generate_schematic.py, scripts/doi_to_bibtex.py, scripts/search_pubmed.py, scripts/validate_citations.py

• 🔵 LOW LLM_DATA_EXFILTRATION — Environment Variable Access for API Keys

  Multiple scripts access environment variables for API keys (NCBI_API_KEY, NCBI_EMAIL, OPENROUTER_API_KEY) and pass them to external network requests. While this is a standard and legitimate pattern for API authentication, the static analyzer flagged cross-file env var exfiltration chains. In context, these are all used for their stated purpose (querying CrossRef, PubMed, arXiv, OpenRouter APIs) and not sent to suspicious third-party endpoints. The risk is low but worth noting: if the OPENROUTER_API_KEY or NCBI_API_KEY environment variables contain sensitive credentials, they are transmitted to external services. Remediation: This is standard API key handling. Ensure users are aware that OPENROUTER_API_KEY and NCBI_API_KEY are transmitted to their respective external services (openrouter.ai and ncbi.nlm.nih.gov). Document which environment variables are used and to which endpoints they are sent.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Cross-Skill Activation Promotion (scientific-schematics)

  The SKILL.md instructions include a section that actively promotes and triggers the use of another skill ('scientific-schematics') by default, even when the user has not requested diagram generation. The instructions state 'Scientific schematics should be generated by default' and 'always consider adding scientific diagrams'. This is an over-broad activation pattern that could cause unintended invocation of another skill and associated API costs (OPENROUTER_API_KEY usage) without explicit user consent. File: SKILL.md Remediation: Remove the 'by default' language and make schematic generation explicitly opt-in. The agent should only invoke the scientific-schematics skill when the user explicitly requests diagrams, not as a default behavior triggered by citation management tasks.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Python Package Dependencies

  The SKILL.md instructions recommend installing packages without version pins: 'pip install requests', 'pip install bibtexparser', 'pip install biopython', 'pip install scholarly', 'pip install selenium'. Unpinned dependencies are a supply chain risk as malicious or breaking updates could be automatically installed. File: SKILL.md Remediation: Pin all dependencies to specific versions (e.g., 'pip install requests==2.31.0'). Provide a requirements.txt with pinned versions and hashes for reproducible, secure installations.

• 🔴 CRITICAL BEHAVIOR_ENV_VAR_EXFILTRATION — Environment variable access with network calls detected

  Script accesses environment variables and makes network calls in scientific-skills/citation-management/scripts/extract_metadata.py File: scientific-skills/citation-management/scripts/extract_metadata.py Remediation: Remove environment variable harvesting or network transmission

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/citation-management/scripts/extract_metadata.py File: scientific-skills/citation-management/scripts/extract_metadata.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/citation-management/scripts/generate_schematic.py File: scientific-skills/citation-management/scripts/generate_schematic.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🔴 CRITICAL BEHAVIOR_ENV_VAR_EXFILTRATION — Environment variable access with network calls detected

  Script accesses environment variables and makes network calls in scientific-skills/citation-management/scripts/generate_schematic_ai.py File: scientific-skills/citation-management/scripts/generate_schematic_ai.py Remediation: Remove environment variable harvesting or network transmission

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/citation-management/scripts/generate_schematic_ai.py File: scientific-skills/citation-management/scripts/generate_schematic_ai.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🔴 CRITICAL BEHAVIOR_ENV_VAR_EXFILTRATION — Environment variable access with network calls detected

  Script accesses environment variables and makes network calls in scientific-skills/citation-management/scripts/search_pubmed.py File: scientific-skills/citation-management/scripts/search_pubmed.py Remediation: Remove environment variable harvesting or network transmission

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/citation-management/scripts/search_pubmed.py File: scientific-skills/citation-management/scripts/search_pubmed.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🔴 CRITICAL BEHAVIOR_CROSSFILE_ENV_VAR_EXFILTRATION — Cross-file env var exfiltration: 2 files

  Environment variable access with network calls in scripts/generate_schematic.py, scripts/generate_schematic_ai.py Remediation: Review data flow across files: scripts/generate_schematic.py, scripts/generate_schematic_ai.py

• 🔴 CRITICAL BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN — Cross-file exfiltration chain: 2 files

  Multi-file exfiltration chain detected: scripts/generate_schematic.py, scripts/generate_schematic_ai.py collect data → scripts/generate_schematic_ai.py → scripts/generate_schematic_ai.py transmit to network Remediation: Review data flow across files: scripts/generate_schematic.py, scripts/generate_schematic_ai.py

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Mandatory Schematic Generation Directive with Branded Tool Reference

  The SKILL.md instruction body contains a section marked '⚠️ MANDATORY' that instructs the agent to always invoke the 'scientific-schematics' skill and specifically references 'Nano Banana Pro' as the AI system that will 'automatically generate, review, and refine the schematic.' This inflates the perceived necessity of a companion skill and embeds a branded product name ('Nano Banana Pro') into mandatory workflow instructions, potentially manipulating the agent into always invoking an external skill/tool regardless of user need. The mandatory framing ('This is not optional') is an activation manipulation pattern. File: SKILL.md Remediation: Remove the mandatory/non-optional framing for companion skill invocation. Let the agent decide based on user needs whether to invoke scientific-schematics. Remove branded product name references ('Nano Banana Pro') from instructions.

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/clinical-decision-support/scripts/generate_schematic.py File: scientific-skills/clinical-decision-support/scripts/generate_schematic.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🔴 CRITICAL BEHAVIOR_ENV_VAR_EXFILTRATION — Environment variable access with network calls detected

  Script accesses environment variables and makes network calls in scientific-skills/clinical-decision-support/scripts/generate_schematic_ai.py File: scientific-skills/clinical-decision-support/scripts/generate_schematic_ai.py Remediation: Remove environment variable harvesting or network transmission

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/clinical-decision-support/scripts/generate_schematic_ai.py File: scientific-skills/clinical-decision-support/scripts/generate_schematic_ai.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🔵 LOW LLM_DATA_EXFILTRATION — API Key Passed via Environment Variable to External AI Service

  The generate_schematic_ai.py script reads OPENROUTER_API_KEY from environment variables and transmits it as a Bearer token to the external OpenRouter API (https://openrouter.ai/api/v1). While this is a standard pattern for API authentication, the skill makes external network calls to a third-party service using credentials sourced from the user's environment. The generate_schematic.py wrapper also passes the API key via environment to a subprocess. This represents a data flow where environment credentials are sent to an external service, which the user should be aware of. File: scripts/generate_schematic_ai.py Remediation: Clearly document in SKILL.md that this skill makes external API calls to openrouter.ai using the OPENROUTER_API_KEY environment variable. Ensure users are informed before the skill is activated that their API key and diagram prompts will be transmitted to a third-party service.

• 🔵 LOW LLM_DATA_EXFILTRATION — User-Provided Diagram Prompts Transmitted to External Third-Party API

  The generate_schematic_ai.py script transmits the user's diagram description (prompt) along with generated images to the OpenRouter API, which routes requests to Google's Gemini models. Clinical decision support contexts may involve sensitive medical information in diagram descriptions (e.g., patient cohort details, drug names, trial data). This data leaves the local environment and is sent to external servers without explicit user consent mechanisms in the skill itself. File: scripts/generate_schematic_ai.py Remediation: Add explicit disclosure in SKILL.md that diagram descriptions and generated images are transmitted to OpenRouter/Google APIs. Advise users not to include PHI or confidential clinical data in schematic generation prompts. Consider adding a confirmation step before external API calls.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Branded AI Model References Embedded in Skill Instructions and Code

  The scripts generate_schematic.py and generate_schematic_ai.py repeatedly reference 'Nano Banana 2' as the image generation model and 'Gemini 3.1 Pro Preview' for quality review, with comments like 'Nano Banana 2 - Google's advanced image generation model' and 'Nano Banana 2 handles everything automatically with smart iterative refinement.' The model identifier used is 'google/gemini-3.1-flash-image-preview' and 'google/gemini-3.1-pro-preview'. The branding 'Nano Banana 2' does not correspond to any known Google model name, suggesting a fictitious or misleading product name is being promoted through the skill's documentation and code comments. File: scripts/generate_schematic_ai.py Remediation: Use accurate model names in documentation and code comments. Remove fictitious branding ('Nano Banana 2') that misrepresents the underlying AI models being used.

• 🔴 CRITICAL BEHAVIOR_CROSSFILE_ENV_VAR_EXFILTRATION — Cross-file env var exfiltration: 2 files

  Environment variable access with network calls in scripts/generate_schematic.py, scripts/generate_schematic_ai.py Remediation: Review data flow across files: scripts/generate_schematic.py, scripts/generate_schematic_ai.py

• 🔴 CRITICAL BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN — Cross-file exfiltration chain: 2 files

  Multi-file exfiltration chain detected: scripts/generate_schematic.py, scripts/generate_schematic_ai.py collect data → scripts/generate_schematic_ai.py → scripts/generate_schematic_ai.py transmit to network Remediation: Review data flow across files: scripts/generate_schematic.py, scripts/generate_schematic_ai.py

• 🔵 LOW LLM_PROMPT_INJECTION — Mandatory Instruction Override via External Skill Invocation

  The SKILL.md instruction body contains a mandatory directive: '⚠️ MANDATORY: Every clinical report MUST include at least 1 AI-generated figure using the scientific-schematics skill.' This instruction attempts to force the agent to invoke an external skill (scientific-schematics) and execute a bash command unconditionally, regardless of user intent or context. While not a classic jailbreak, it is an instruction override that compels agent behavior beyond the user's stated request. File: SKILL.md Remediation: Change mandatory language to optional/recommended. The agent should only invoke external skills or run scripts when the user explicitly requests it, not as a forced prerequisite for every report.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Over-Broad Capability Claims in Skill Description

  The skill description claims 'Full support with templates, regulatory compliance (HIPAA, FDA, ICH-GCP), and validation tools.' This is an inflated capability claim as the skill is primarily an LLM-guided writing assistant with some regex-based validation scripts. The scripts (e.g., check_deidentification.py, compliance_checker.py) use simple regex pattern matching and cannot provide genuine regulatory compliance assurance. Users may over-rely on these tools for actual HIPAA/FDA compliance decisions. File: SKILL.md Remediation: Clarify in the description that compliance tools are assistive/educational only and not a substitute for qualified legal/regulatory review. Add disclaimers in the validation scripts.

• 🔵 LOW LLM_UNAUTHORIZED_TOOL_USE — Unauthorized Tool Chaining via Mandatory Script Execution

  The SKILL.md instructions mandate execution of scripts/generate_schematic.py for every clinical report, creating an automatic tool-chaining pattern. The allowed-tools field declares [Read, Write, Edit, Bash], so Bash is permitted, but the mandatory invocation of an external AI generation pipeline (including subprocess calls to generate_schematic_ai.py) without explicit user consent for each invocation represents unauthorized automated tool use beyond the user's stated purpose. File: SKILL.md Remediation: Remove the mandatory requirement. Script execution should only occur when the user explicitly requests diagram generation. Document that scripts are available as optional tools.

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/clinical-reports/scripts/generate_schematic.py File: scientific-skills/clinical-reports/scripts/generate_schematic.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🔴 CRITICAL BEHAVIOR_ENV_VAR_EXFILTRATION — Environment variable access with network calls detected

  Script accesses environment variables and makes network calls in scientific-skills/clinical-reports/scripts/generate_schematic_ai.py File: scientific-skills/clinical-reports/scripts/generate_schematic_ai.py Remediation: Remove environment variable harvesting or network transmission

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/clinical-reports/scripts/generate_schematic_ai.py File: scientific-skills/clinical-reports/scripts/generate_schematic_ai.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🔵 LOW LLM_DATA_EXFILTRATION — API Key Passed via Environment Variable to Subprocess

  The generate_schematic.py script reads the OPENROUTER_API_KEY from environment variables and passes it to a subprocess via os.environ.copy(). While this is better than command-line argument exposure, the script also accepts the key via --api-key flag which could expose it in process listings. The key is then used to make external API calls, creating a data flow where credentials are accessed and transmitted externally. File: scripts/generate_schematic.py Remediation: Remove the --api-key command-line flag entirely to prevent credential exposure in process listings. Document that only the environment variable method should be used. Add a warning if the key appears to be hardcoded.

• 🔵 LOW LLM_RESOURCE_ABUSE — Potential Resource Exhaustion via Iterative AI API Calls

  The generate_schematic_ai.py script implements an iterative refinement loop that makes multiple API calls to external AI services (image generation + quality review per iteration). While capped at max 2 iterations, each iteration makes at least 2 API calls (generate + review). If invoked repeatedly or with the mandatory schematic requirement for every report, this could result in significant API cost accumulation and compute resource usage without explicit user awareness of costs. File: scripts/generate_schematic_ai.py Remediation: Add explicit cost warnings before making API calls. Require user confirmation before initiating multi-iteration API calls. Display estimated API cost to user. Remove the mandatory invocation requirement from SKILL.md.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned External Dependency (requests library)

  The generate_schematic_ai.py script imports the 'requests' library without version pinning. The script also includes a pip install suggestion in the error message. Unpinned dependencies are a supply chain risk as a compromised version of the requests package could be silently installed. File: scripts/generate_schematic_ai.py Remediation: Pin the requests library to a specific version (e.g., requests==2.31.0) in a requirements.txt file. Document the dependency with its expected version.

• 🔴 CRITICAL BEHAVIOR_CROSSFILE_ENV_VAR_EXFILTRATION — Cross-file env var exfiltration: 2 files

  Environment variable access with network calls in scripts/generate_schematic.py, scripts/generate_schematic_ai.py Remediation: Review data flow across files: scripts/generate_schematic.py, scripts/generate_schematic_ai.py

• 🔴 CRITICAL BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN — Cross-file exfiltration chain: 2 files

  Multi-file exfiltration chain detected: scripts/generate_schematic.py, scripts/generate_schematic_ai.py collect data → scripts/generate_schematic_ai.py → scripts/generate_schematic_ai.py transmit to network Remediation: Review data flow across files: scripts/generate_schematic.py, scripts/generate_schematic_ai.py

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Undisclosed Third-Party AI Model Usage (Gemini, Nano Banana)

  The skill description states it performs 'structured hypothesis formulation from observations' and 'follows scientific method framework', but the scripts silently invoke external AI models (described as 'Nano Banana 2' / google/gemini-3.1-flash-image-preview and 'Gemini 3.1 Pro Preview' / google/gemini-3.1-pro-preview) via OpenRouter. The YAML manifest description does not disclose that the skill makes external AI API calls or that it depends on third-party AI services. Users may not realize their research content is being processed by external AI models. File: SKILL.md Remediation: Update the skill description and SKILL.md to explicitly disclose that the schematic generation component makes external API calls to OpenRouter using Google Gemini models. Users should be informed of this dependency and data flow before using the skill.

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/hypothesis-generation/scripts/generate_schematic.py File: scientific-skills/hypothesis-generation/scripts/generate_schematic.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🔴 CRITICAL BEHAVIOR_ENV_VAR_EXFILTRATION — Environment variable access with network calls detected

  Script accesses environment variables and makes network calls in scientific-skills/hypothesis-generation/scripts/generate_schematic_ai.py File: scientific-skills/hypothesis-generation/scripts/generate_schematic_ai.py Remediation: Remove environment variable harvesting or network transmission

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/hypothesis-generation/scripts/generate_schematic_ai.py File: scientific-skills/hypothesis-generation/scripts/generate_schematic_ai.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🔵 LOW LLM_DATA_EXFILTRATION — API Key Passed via Environment Variable to Subprocess

  In generate_schematic.py, the OPENROUTER_API_KEY is read from the environment and explicitly re-injected into the subprocess environment when calling generate_schematic_ai.py. While the code comments note this avoids exposure in process listings, the key is still propagated through environment variables across subprocess boundaries. This is a minor concern as it is the standard pattern for API key handling, but the key is read from the user's environment and used to make external network calls. File: scripts/generate_schematic.py Remediation: This pattern is acceptable for API key handling. Ensure the key is never logged or included in error messages. Consider using a secrets manager or credential store rather than environment variables for production use.

• 🔵 LOW LLM_DATA_EXFILTRATION — External Network Calls to OpenRouter API with User-Provided Prompt Data

  The generate_schematic_ai.py script sends user-provided prompt content to the external OpenRouter API (https://openrouter.ai/api/v1). The user's diagram description is included verbatim in the API request payload. While this is the intended functionality of the skill, it means user input (potentially containing sensitive research content) is transmitted to a third-party service. The skill's SKILL.md does not explicitly disclose this data transmission to users. File: scripts/generate_schematic_ai.py Remediation: Add explicit disclosure in SKILL.md that user prompts and diagram descriptions are sent to the OpenRouter API (a third-party service). Users should be informed before their research content is transmitted externally.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned External Dependency: requests Library

  The generate_schematic_ai.py script imports the 'requests' library without any version pinning. The skill does not include a requirements.txt or similar dependency manifest with pinned versions. An attacker who could influence the package installation environment could potentially substitute a malicious version of the requests library. File: scripts/generate_schematic_ai.py:14 Remediation: Include a requirements.txt file with pinned dependency versions (e.g., requests==2.31.0). This ensures reproducible and verifiable installations.

• 🔴 CRITICAL BEHAVIOR_CROSSFILE_ENV_VAR_EXFILTRATION — Cross-file env var exfiltration: 2 files

  Environment variable access with network calls in scripts/generate_infographic_ai.py, scripts/generate_infographic.py Remediation: Review data flow across files: scripts/generate_infographic_ai.py, scripts/generate_infographic.py

• 🔴 CRITICAL BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN — Cross-file exfiltration chain: 2 files

  Multi-file exfiltration chain detected: scripts/generate_infographic_ai.py, scripts/generate_infographic.py collect data → scripts/generate_infographic_ai.py → scripts/generate_infographic_ai.py transmit to network Remediation: Review data flow across files: scripts/generate_infographic_ai.py, scripts/generate_infographic.py

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/infographics/scripts/generate_infographic.py File: scientific-skills/infographics/scripts/generate_infographic.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🔴 CRITICAL BEHAVIOR_ENV_VAR_EXFILTRATION — Environment variable access with network calls detected

  Script accesses environment variables and makes network calls in scientific-skills/infographics/scripts/generate_infographic_ai.py File: scientific-skills/infographics/scripts/generate_infographic_ai.py Remediation: Remove environment variable harvesting or network transmission

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/infographics/scripts/generate_infographic_ai.py File: scientific-skills/infographics/scripts/generate_infographic_ai.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Capability Inflation - References Non-Existent 'Nano Banana Pro AI' Model

  The SKILL.md and scripts repeatedly reference 'Nano Banana Pro AI' and 'Nano Banana Pro' as the image generation engine, but the actual model used in code is 'google/gemini-3-pro-image-preview'. This is a fabricated product name that does not correspond to any real AI model, which could mislead users about what technology is actually being used. The description also claims 'Gemini 3 Pro' for quality review but uses 'google/gemini-3.1-pro-preview' in code. File: scripts/generate_infographic_ai.py:155 Remediation: Update SKILL.md and all documentation to accurately reflect the actual AI models being used (google/gemini-3-pro-image-preview and google/gemini-3.1-pro-preview). Remove references to the non-existent 'Nano Banana Pro AI' branding.

• 🔵 LOW LLM_DATA_EXFILTRATION — API Key Transmitted via HTTP Headers to External Service

  The skill reads the OPENROUTER_API_KEY environment variable and transmits it in HTTP Authorization headers to openrouter.ai. While this is the intended use of an API key, the key is also passed through subprocess arguments in generate_infographic.py (via env dict), and the HTTP-Referer header hardcodes a GitHub URL that could be used for tracking. The API key handling is generally appropriate but warrants noting. File: scripts/generate_infographic_ai.py:270 Remediation: This is low risk as the API key is used as intended. Ensure OPENROUTER_API_KEY is stored securely and not logged. The HTTP-Referer header is benign but unnecessary for functionality.

• 🔵 LOW LLM_RESOURCE_ABUSE — Unbounded Iteration with External API Calls

  The generate_iterative method performs up to N iterations (default 3, configurable via --iterations with no upper bound validation) of image generation and review, each making multiple external API calls. There is no maximum cap enforced on the --iterations argument, meaning a user could specify a very large number of iterations causing excessive API usage and compute costs. File: scripts/generate_infographic_ai.py:330 Remediation: Add a maximum cap on the --iterations argument (e.g., max 10) to prevent runaway API usage. Consider adding cost warnings for high iteration counts.

• 🔵 LOW LLM_DATA_EXFILTRATION — Research Data Including External Sources Written to Disk Without Sanitization

  When the --research flag is used, the skill calls Perplexity Sonar Pro and writes the raw API response (including any search_results) to a JSON file on disk. The research content is also incorporated directly into generation prompts. While this is the intended workflow, the raw external data is persisted without sanitization and could contain unexpected content. File: scripts/generate_infographic_ai.py:390 Remediation: Consider sanitizing or validating research results before writing to disk and before incorporating into generation prompts. Limit what fields from the API response are persisted.

• 🔴 CRITICAL BEHAVIOR_CROSSFILE_ENV_VAR_EXFILTRATION — Cross-file env var exfiltration: 2 files

  Environment variable access with network calls in scripts/generate_schematic.py, scripts/generate_schematic_ai.py Remediation: Review data flow across files: scripts/generate_schematic.py, scripts/generate_schematic_ai.py

• 🔴 CRITICAL BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN — Cross-file exfiltration chain: 2 files

  Multi-file exfiltration chain detected: scripts/generate_schematic.py, scripts/generate_schematic_ai.py collect data → scripts/generate_schematic_ai.py → scripts/generate_schematic_ai.py transmit to network Remediation: Review data flow across files: scripts/generate_schematic.py, scripts/generate_schematic_ai.py

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing License and Compatibility Metadata

  The SKILL.md manifest does not specify a license or compatibility field. While these are optional per the agent skills spec, their absence means users cannot determine the terms under which the skill can be used or which platforms it is compatible with. File: SKILL.md Remediation: Add license (e.g., MIT) and compatibility fields to the YAML frontmatter to improve transparency and discoverability.

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/latex-posters/scripts/generate_schematic.py File: scientific-skills/latex-posters/scripts/generate_schematic.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🔴 CRITICAL BEHAVIOR_ENV_VAR_EXFILTRATION — Environment variable access with network calls detected

  Script accesses environment variables and makes network calls in scientific-skills/latex-posters/scripts/generate_schematic_ai.py File: scientific-skills/latex-posters/scripts/generate_schematic_ai.py Remediation: Remove environment variable harvesting or network transmission

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/latex-posters/scripts/generate_schematic_ai.py File: scientific-skills/latex-posters/scripts/generate_schematic_ai.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🔵 LOW LLM_DATA_EXFILTRATION — API Key Passed via Environment Variable to Subprocess

  In generate_schematic.py, the OPENROUTER_API_KEY is retrieved from the environment and explicitly re-injected into the subprocess environment via env=env before calling generate_schematic_ai.py. While the code comments note this avoids exposure in process listings, the key is still propagated through the environment to a child process. This is a standard and acceptable pattern, but the key is read from the environment and forwarded, creating a dependency on secure key management by the user. The static analyzer flagged this as an exfiltration chain because the key flows from environment → subprocess → external API calls. File: scripts/generate_schematic.py Remediation: This pattern is acceptable for local tool use. Ensure users are instructed to use environment variables rather than --api-key flag to avoid key exposure in process listings. Consider documenting that the key is forwarded to child processes.

• 🔵 LOW LLM_DATA_EXFILTRATION — External API Calls Transmit User Prompt Content

  The generate_schematic_ai.py script sends user-provided prompt content (the diagram description) to the OpenRouter API (https://openrouter.ai/api/v1), which routes to Google Gemini models. This is the intended behavior of the skill, but users should be aware that their research descriptions and diagram prompts are transmitted to external third-party services. The skill does not warn users about this data transmission. File: scripts/generate_schematic_ai.py Remediation: Add a clear disclosure in SKILL.md that user prompts (diagram descriptions) are sent to OpenRouter and Google Gemini APIs. Allow users to opt out or be informed before data is transmitted.

• 🔵 LOW LLM_DATA_EXFILTRATION — Review Log Written to Disk Contains Full Prompt and Critique

  The generate_schematic_ai.py script writes a JSON review log to disk containing the full user prompt, all AI-generated critiques, quality scores, and iteration details. This log persists after the skill completes and may contain sensitive research descriptions. File: scripts/generate_schematic_ai.py Remediation: Inform users that a review log is saved alongside generated images. Consider making log saving optional via a --no-log flag, or document that logs contain prompt content and should be managed accordingly.

• 🔵 LOW LLM_RESOURCE_ABUSE — Unbounded External API Calls with Retry Logic

  The generate_schematic_ai.py script makes multiple sequential API calls to OpenRouter (image generation + quality review per iteration, up to 2 iterations). Each call has a 120-second timeout. While iterations are capped at 2, each iteration makes at least 2 API calls (generate + review), meaning up to 4 external API calls per invocation. This is bounded and acceptable, but users should be aware of potential API costs. File: scripts/generate_schematic_ai.py Remediation: The 2-iteration cap is appropriate. Consider adding cost estimation or a --dry-run flag. Document expected API call counts in the skill description.

• 🔴 CRITICAL BEHAVIOR_CROSSFILE_ENV_VAR_EXFILTRATION — Cross-file env var exfiltration: 3 files

  Environment variable access with network calls in scripts/generate_schematic.py, scripts/generate_schematic_ai.py Remediation: Review data flow across files: scripts/generate_schematic.py, scripts/generate_schematic_ai.py, scripts/verify_citations.py

• 🔴 CRITICAL BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN — Cross-file exfiltration chain: 3 files

  Multi-file exfiltration chain detected: scripts/generate_schematic.py, scripts/generate_schematic_ai.py collect data → scripts/generate_schematic_ai.py → scripts/generate_schematic_ai.py, scripts/verify_citations.py transmit to network Remediation: Review data flow across files: scripts/generate_schematic.py, scripts/generate_schematic_ai.py, scripts/verify_citations.py

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Mandatory Figure Generation Directive May Cause Unintended API Costs

  The SKILL.md instruction body contains a mandatory directive: '⚠️ MANDATORY: Every literature review MUST include at least 1-2 AI-generated figures using the scientific-schematics skill.' and 'This is not optional.' This forces the agent to invoke the generate_schematic.py script (which calls the OpenRouter API with OPENROUTER_API_KEY) for every literature review, regardless of user intent or cost considerations. Users may not be aware that mandatory figure generation will incur API costs. File: SKILL.md Remediation: Change the mandatory directive to a recommendation. Inform users that figure generation incurs API costs and requires OPENROUTER_API_KEY. Allow users to opt out of figure generation explicitly.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Python Dependency in Installation Instructions

  The SKILL.md instructions specify 'pip install requests' without a version pin. This could allow installation of a compromised or incompatible version of the requests library in the future. The requests library is used in verify_citations.py and generate_schematic_ai.py for network calls to CrossRef, doi.org, and OpenRouter APIs. File: SKILL.md Remediation: Pin the dependency to a specific version: 'pip install requests==2.31.0' or use a requirements.txt with pinned versions and hashes for reproducible installs.

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/literature-review/scripts/generate_schematic.py File: scientific-skills/literature-review/scripts/generate_schematic.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🔴 CRITICAL BEHAVIOR_ENV_VAR_EXFILTRATION — Environment variable access with network calls detected

  Script accesses environment variables and makes network calls in scientific-skills/literature-review/scripts/generate_schematic_ai.py File: scientific-skills/literature-review/scripts/generate_schematic_ai.py Remediation: Remove environment variable harvesting or network transmission

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/literature-review/scripts/generate_schematic_ai.py File: scientific-skills/literature-review/scripts/generate_schematic_ai.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🔵 LOW LLM_DATA_EXFILTRATION — API Key Passed via Environment Variable to Subprocess

  In generate_schematic.py, the OPENROUTER_API_KEY is read from the environment and explicitly re-injected into the subprocess environment when calling generate_schematic_ai.py. While the code comments note this avoids exposure in process listings, the key is still propagated through os.environ.copy() and passed to a child process. This is a low-risk pattern but worth noting as the API key is handled across multiple script boundaries. File: scripts/generate_schematic.py Remediation: This pattern is acceptable for local skill execution. Ensure OPENROUTER_API_KEY is not hardcoded anywhere and is only sourced from environment variables or .env files. Consider documenting that the .env file should not be committed to version control.

• 🔵 LOW LLM_DATA_EXFILTRATION — Potential .env File Loading from Current Working Directory

  In generate_schematic_ai.py, the _load_env_file() function attempts to load a .env file from the current working directory (Path.cwd() / '.env') or the script directory. If a malicious .env file is placed in the working directory, it could override environment variables including OPENROUTER_API_KEY, potentially redirecting API calls to an attacker-controlled endpoint if the base_url were also configurable. The risk is low given the fixed base_url, but the CWD-based .env loading is a minor concern. File: scripts/generate_schematic_ai.py Remediation: Use override=False (already done) to prevent .env from overriding existing environment variables. Consider restricting .env loading to only the skill's own directory rather than the current working directory to reduce attack surface.

• 🔵 LOW LLM_RESOURCE_ABUSE — Unbounded HTTP Requests Without Rate Limiting in Citation Verifier

  The verify_citations.py script makes HTTP requests to doi.org and CrossRef API for every DOI found in a document, with only a 0.5-second sleep between requests. For large literature reviews with hundreds of citations, this could result in excessive outbound requests. Additionally, the requests use a 10-second timeout per call, meaning a document with 200 DOIs could take over 100 seconds of network I/O with no upper bound on total requests. File: scripts/verify_citations.py Remediation: Add a maximum DOI count check before processing, implement exponential backoff on failures, and consider batching CrossRef API requests using their batch endpoint to reduce the number of individual HTTP calls.

• 🔴 CRITICAL BEHAVIOR_CROSSFILE_ENV_VAR_EXFILTRATION — Cross-file env var exfiltration: 3 files

  Environment variable access with network calls in scripts/generate_schematic.py, scripts/convert_with_ai.py, scripts/generate_schematic_ai.py Remediation: Review data flow across files: scripts/generate_schematic.py, scripts/convert_with_ai.py, scripts/generate_schematic_ai.py

• 🔴 CRITICAL BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN — Cross-file exfiltration chain: 3 files

  Multi-file exfiltration chain detected: scripts/generate_schematic.py, scripts/convert_with_ai.py, scripts/generate_schematic_ai.py collect data → scripts/generate_schematic_ai.py → scripts/generate_schematic_ai.py transmit to network Remediation: Review data flow across files: scripts/generate_schematic.py, scripts/convert_with_ai.py, scripts/generate_schematic_ai.py

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Capability Inflation via Cross-Skill Promotion

  The SKILL.md instructions contain a section titled 'Visual Enhancement with Scientific Schematics' that aggressively promotes a separate 'scientific-schematics' skill, instructing the agent to 'always consider adding scientific diagrams' and that 'Scientific schematics should be generated by default' even when not requested. This inflates the perceived scope of the markitdown skill and attempts to trigger activation of another skill without user request, constituting capability inflation and unsolicited cross-skill invocation. File: SKILL.md Remediation: Remove the unsolicited cross-skill promotion section. If integration with scientific-schematics is desired, it should be opt-in and user-initiated, not a default behavior imposed by the skill instructions.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Package Installation Instructions

  The SKILL.md and scripts reference installing markitdown via 'pip install markitdown[all]' without version pinning. This exposes users to supply chain risks if the package is compromised or a malicious version is published. The scripts also import from markitdown without version validation. File: SKILL.md Remediation: Pin the markitdown package to a specific known-good version (e.g., 'pip install markitdown[all]==0.1.0'). Consider using a requirements.txt with hashed dependencies for reproducible installs.

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/markitdown/scripts/convert_with_ai.py File: scientific-skills/markitdown/scripts/convert_with_ai.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/markitdown/scripts/generate_schematic.py File: scientific-skills/markitdown/scripts/generate_schematic.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🔴 CRITICAL BEHAVIOR_ENV_VAR_EXFILTRATION — Environment variable access with network calls detected

  Script accesses environment variables and makes network calls in scientific-skills/markitdown/scripts/generate_schematic_ai.py File: scientific-skills/markitdown/scripts/generate_schematic_ai.py Remediation: Remove environment variable harvesting or network transmission

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/markitdown/scripts/generate_schematic_ai.py File: scientific-skills/markitdown/scripts/generate_schematic_ai.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🔵 LOW LLM_DATA_EXFILTRATION — API Key Passed via Command-Line Argument in Multiple Scripts

  Both scripts/convert_with_ai.py and scripts/generate_schematic_ai.py accept API keys via --api-key command-line arguments. While the scripts also support environment variables, accepting secrets as CLI arguments risks exposure in process listings, shell history, and system logs. File: scripts/convert_with_ai.py Remediation: Remove --api-key CLI arguments from all scripts. Require API keys to be provided exclusively via environment variables (OPENROUTER_API_KEY). Document this clearly in usage instructions.

• 🔵 LOW LLM_DATA_EXFILTRATION — API Key Passed via Command-Line Argument (Process Listing Exposure)

  In scripts/generate_schematic.py, the API key can be passed via --api-key command-line argument. While the script does pass the key via environment variable to the subprocess (which is safer), the key is still accepted as a CLI argument which may be visible in process listings on multi-user systems. The script itself notes this concern ('pass API key via environment to avoid exposure in process listings') but still accepts the --api-key flag. File: scripts/generate_schematic.py Remediation: Remove the --api-key CLI argument entirely and require the OPENROUTER_API_KEY environment variable exclusively. This eliminates the risk of key exposure in process listings.

• 🔴 CRITICAL BEHAVIOR_CROSSFILE_ENV_VAR_EXFILTRATION — Cross-file env var exfiltration: 2 files

  Environment variable access with network calls in scripts/generate_schematic.py, scripts/generate_schematic_ai.py Remediation: Review data flow across files: scripts/generate_schematic.py, scripts/generate_schematic_ai.py

• 🔴 CRITICAL BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN — Cross-file exfiltration chain: 2 files

  Multi-file exfiltration chain detected: scripts/generate_schematic.py, scripts/generate_schematic_ai.py collect data → scripts/generate_schematic_ai.py → scripts/generate_schematic_ai.py transmit to network Remediation: Review data flow across files: scripts/generate_schematic.py, scripts/generate_schematic_ai.py

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Cross-Skill Promotion in Instructions (scientific-schematics Skill)

  The SKILL.md instructions prominently promote the use of another skill ('scientific-schematics') and a branded product ('Nano Banana Pro') within the peer review workflow. The instructions state schematics 'should be generated by default' for new documents, which could cause the agent to invoke additional skills and make external API calls beyond what a user expects from a peer review skill. File: SKILL.md Remediation: Make schematic generation opt-in rather than default behavior. Clearly document that this skill will invoke external API calls and potentially incur costs. Remove the 'by default' language to avoid unexpected agent behavior.

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/peer-review/scripts/generate_schematic.py File: scientific-skills/peer-review/scripts/generate_schematic.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🔴 CRITICAL BEHAVIOR_ENV_VAR_EXFILTRATION — Environment variable access with network calls detected

  Script accesses environment variables and makes network calls in scientific-skills/peer-review/scripts/generate_schematic_ai.py File: scientific-skills/peer-review/scripts/generate_schematic_ai.py Remediation: Remove environment variable harvesting or network transmission

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/peer-review/scripts/generate_schematic_ai.py File: scientific-skills/peer-review/scripts/generate_schematic_ai.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🔵 LOW LLM_DATA_EXFILTRATION — API Key Passed via Environment Variable to Subprocess

  In generate_schematic.py, the OpenRouter API key is retrieved from the environment and explicitly re-injected into the subprocess environment before calling generate_schematic_ai.py. While the code comments note this avoids exposure in process listings, the key is still propagated through os.environ.copy() and passed to a child process. This is a low-risk pattern but worth noting as the key is handled across two scripts and could be logged or exposed in verbose/debug output. File: scripts/generate_schematic.py Remediation: This pattern is generally acceptable. Ensure verbose/debug logging does not print the API key. Consider using a secrets manager or agent-native credential store rather than environment variables for sensitive keys.

• 🔵 LOW LLM_DATA_EXFILTRATION — OPENROUTER_API_KEY Loaded from .env File in Working Directory

  The generate_schematic_ai.py script attempts to load a .env file from the current working directory (Path.cwd() / '.env') or the script directory. This means if a malicious .env file is placed in the working directory, it could override the API key with an attacker-controlled value, redirecting API calls (and any data sent) to an attacker-controlled OpenRouter account. File: scripts/generate_schematic_ai.py Remediation: Use override=False (already done) which prevents overwriting existing env vars. Document that the .env file should only be placed in trusted locations. Consider restricting .env loading to the skill's own directory only, not the current working directory.

• 🔵 LOW LLM_DATA_EXFILTRATION — Review Log Written to Disk Contains Full Prompt and Critique Data

  The generate_schematic_ai.py script saves a JSON review log to disk containing the full user prompt, AI critique, quality scores, and file paths. While this is useful for debugging, it persists potentially sensitive information about the user's research content to disk without explicit user consent or cleanup. File: scripts/generate_schematic_ai.py Remediation: Inform users that a review log is saved. Provide an option to disable log saving or automatically clean up logs after use. Ensure the log directory has appropriate permissions.

• 🔵 LOW LLM_RESOURCE_ABUSE — External API Calls with Iterative Refinement Loop May Cause Unexpected Costs

  The generate_schematic_ai.py script makes multiple calls to external AI APIs (OpenRouter/Gemini) in an iterative loop. While iterations are capped at 2, each iteration makes at least 2 API calls (generation + review). This could result in unexpected API costs if the skill is invoked frequently or with many documents. The cost is bounded but not negligible. File: scripts/generate_schematic_ai.py Remediation: Document the expected API cost per invocation clearly. Consider adding a user confirmation step before making API calls, especially for iterative refinement. The current 2-iteration cap is a reasonable safeguard.

• 🔴 CRITICAL BEHAVIOR_CROSSFILE_ENV_VAR_EXFILTRATION — Cross-file env var exfiltration: 2 files

  Environment variable access with network calls in scripts/generate_schematic.py, scripts/generate_schematic_ai.py Remediation: Review data flow across files: scripts/generate_schematic.py, scripts/generate_schematic_ai.py

• 🔴 CRITICAL BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN — Cross-file exfiltration chain: 2 files

  Multi-file exfiltration chain detected: scripts/generate_schematic.py, scripts/generate_schematic_ai.py collect data → scripts/generate_schematic_ai.py → scripts/generate_schematic_ai.py transmit to network Remediation: Review data flow across files: scripts/generate_schematic.py, scripts/generate_schematic_ai.py

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/pptx-posters/scripts/generate_schematic.py File: scientific-skills/pptx-posters/scripts/generate_schematic.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🔴 CRITICAL BEHAVIOR_ENV_VAR_EXFILTRATION — Environment variable access with network calls detected

  Script accesses environment variables and makes network calls in scientific-skills/pptx-posters/scripts/generate_schematic_ai.py File: scientific-skills/pptx-posters/scripts/generate_schematic_ai.py Remediation: Remove environment variable harvesting or network transmission

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/pptx-posters/scripts/generate_schematic_ai.py File: scientific-skills/pptx-posters/scripts/generate_schematic_ai.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🔵 LOW LLM_DATA_EXFILTRATION — API Key Transmitted via Network Requests to External Service

  The scripts read the OPENROUTER_API_KEY environment variable and transmit it as a Bearer token in HTTP Authorization headers to openrouter.ai. While this is the intended use of an API key, the key is sourced from the environment and sent over the network. The static analyzer flagged this as an environment variable exfiltration chain across two files (generate_schematic.py and generate_schematic_ai.py). In normal operation this is legitimate, but the pattern is worth noting: if the API key were replaced or the endpoint were tampered with, credentials could be exposed. File: scripts/generate_schematic_ai.py Remediation: This is expected behavior for an API-key-authenticated service. Ensure the endpoint URL (openrouter.ai) is hardcoded and not user-controllable. Consider adding certificate pinning or domain validation. Document clearly in the skill README that OPENROUTER_API_KEY is required and will be sent to openrouter.ai.

• 🔵 LOW LLM_DATA_EXFILTRATION — User-Controlled Prompt Content Sent to External AI API

  The user's prompt (diagram description) is passed directly to the OpenRouter API as part of the request payload. While this is the intended functionality, user-supplied content is transmitted to an external third-party service (openrouter.ai) without any sanitization or content filtering. Users may not be aware their input is being sent externally. File: scripts/generate_schematic_ai.py Remediation: Clearly disclose in the skill description and SKILL.md that user prompts are sent to the OpenRouter API (a third-party service). Consider adding a user confirmation step before transmitting data externally.

• 🔵 LOW LLM_RESOURCE_ABUSE — External API Calls with Fixed 120-Second Timeout Per Iteration

  Each API call has a 120-second timeout, and the script supports up to 2 iterations with both a generation call and a review call per iteration. This means up to 4 sequential API calls could each block for 120 seconds (total up to 8 minutes). While bounded, this could cause significant agent blocking in automated workflows, especially if the API is slow or unresponsive. File: scripts/generate_schematic_ai.py Remediation: Consider reducing the timeout or adding a total wall-clock timeout for the entire generation process. Provide progress feedback to the user during long-running operations.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned External Dependency (requests library)

  The script imports the 'requests' library without any version pinning. The install instruction shown is 'pip install requests' with no version constraint. An unpinned dependency could be subject to supply chain attacks if a malicious version is published or if the user's environment resolves to a compromised version. File: scripts/generate_schematic_ai.py Remediation: Pin the requests library to a specific known-good version in a requirements.txt file (e.g., requests==2.31.0). Include a requirements.txt in the skill package and document the installation step.

• 🔴 CRITICAL BEHAVIOR_CROSSFILE_ENV_VAR_EXFILTRATION — Cross-file env var exfiltration: 2 files

  Environment variable access with network calls in scripts/generate_schematic.py, scripts/generate_schematic_ai.py Remediation: Review data flow across files: scripts/generate_schematic.py, scripts/generate_schematic_ai.py

• 🔴 CRITICAL BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN — Cross-file exfiltration chain: 2 files

  Multi-file exfiltration chain detected: scripts/generate_schematic.py, scripts/generate_schematic_ai.py collect data → scripts/generate_schematic_ai.py → scripts/generate_schematic_ai.py transmit to network Remediation: Review data flow across files: scripts/generate_schematic.py, scripts/generate_schematic_ai.py

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Mandatory Figure Generation Requirement May Inflate Skill Activation

  The SKILL.md instruction body contains a section marked '⚠️ MANDATORY' that requires every grant proposal to include AI-generated figures using the 'scientific-schematics' skill, and references 'Nano Banana Pro' as if it is a known system component. This creates an over-broad activation pattern by mandating cross-skill invocation regardless of user intent, and references a branded product name ('Nano Banana Pro', 'Nano Banana 2') that may not be a recognized system component, potentially misleading users about available capabilities. File: SKILL.md Remediation: Change the mandatory figure requirement to a recommendation. Remove references to 'Nano Banana Pro' as a system component unless it is a verified, documented part of the deployment environment. Clarify that figure generation is optional and dependent on user preference and available tools.

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/research-grants/scripts/generate_schematic.py File: scientific-skills/research-grants/scripts/generate_schematic.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🔴 CRITICAL BEHAVIOR_ENV_VAR_EXFILTRATION — Environment variable access with network calls detected

  Script accesses environment variables and makes network calls in scientific-skills/research-grants/scripts/generate_schematic_ai.py File: scientific-skills/research-grants/scripts/generate_schematic_ai.py Remediation: Remove environment variable harvesting or network transmission

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/research-grants/scripts/generate_schematic_ai.py File: scientific-skills/research-grants/scripts/generate_schematic_ai.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🔵 LOW LLM_DATA_EXFILTRATION — API Key Passed via Environment Variable to Subprocess

  The generate_schematic.py script reads the OPENROUTER_API_KEY from the environment and passes it explicitly into a subprocess environment. While the code does attempt to avoid exposing the key in process listings by using env= rather than a command-line argument, the key is still read from the environment and propagated. This is a standard and acceptable pattern, but the key is also accepted via --api-key CLI flag which could expose it in process listings on shared systems. File: scripts/generate_schematic.py Remediation: Remove the --api-key CLI flag option to prevent accidental exposure of the API key in process listings. Rely exclusively on the environment variable. Document that users should set OPENROUTER_API_KEY via a secrets manager or shell profile rather than passing it on the command line.

• 🔵 LOW LLM_DATA_EXFILTRATION — API Key Loaded from .env File in Current Working Directory

  The generate_schematic_ai.py script attempts to load a .env file from the current working directory or the script's parent directory. If a malicious .env file is placed in the working directory, it could override the OPENROUTER_API_KEY with an attacker-controlled value, redirecting API calls (and potentially sensitive prompt data) to an attacker-controlled OpenRouter account. File: scripts/generate_schematic_ai.py Remediation: Restrict .env file loading to only the skill's own directory (not the current working directory, which may be user-controlled). Use override=False (already done) to prevent overriding existing environment variables, but also validate that the loaded API key matches expected format before use.

• 🔵 LOW LLM_RESOURCE_ABUSE — External API Calls with Potential for Cost Exhaustion

  The generate_schematic_ai.py script makes multiple calls to OpenRouter AI APIs (image generation and quality review) in an iterative loop. While the maximum iterations are capped at 2, each invocation of the skill can trigger up to 4 API calls (2 generation + 2 review). If the skill is invoked repeatedly or in an automated pipeline, this could result in significant API cost accumulation against the user's OpenRouter account. File: scripts/generate_schematic_ai.py Remediation: Add rate limiting or confirmation prompts before making API calls. Document the expected API cost per invocation clearly in the skill description. Consider adding a --dry-run flag that estimates costs without making actual API calls.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned External Dependency: requests Library

  The generate_schematic_ai.py script imports the 'requests' library without any version pinning in the skill package. There is no requirements.txt or setup.py visible in the skill that pins this dependency to a specific version. Unpinned dependencies are vulnerable to supply chain attacks where a malicious version could be installed. File: scripts/generate_schematic_ai.py:17 Remediation: Include a requirements.txt file in the skill package that pins the requests library to a specific known-good version (e.g., requests==2.31.0). Consider also pinning other transitive dependencies.

• 🔴 CRITICAL BEHAVIOR_CROSSFILE_ENV_VAR_EXFILTRATION — Cross-file env var exfiltration: 6 files

  Environment variable access with network calls in lookup.py, examples.py, research_lookup.py, scripts/generate_schematic.py, scripts/research_lookup.py, scripts/generate_schematic_ai.py Remediation: Review data flow across files: scripts/generate_schematic_ai.py, scripts/generate_schematic.py, examples.py, lookup.py, scripts/research_lookup.py, research_lookup.py

• 🔴 CRITICAL BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN — Cross-file exfiltration chain: 6 files

  Multi-file exfiltration chain detected: lookup.py, examples.py, research_lookup.py, scripts/generate_schematic.py, scripts/research_lookup.py, scripts/generate_schematic_ai.py collect data → scripts/generate_schematic_ai.py → research_lookup.py, scripts/research_lookup.py, scripts/generate_schematic_ai.py transmit to network Remediation: Review data flow across files: scripts/generate_schematic_ai.py, scripts/generate_schematic.py, examples.py, lookup.py, scripts/research_lookup.py, research_lookup.py

• 🔵 LOW LLM_DATA_EXFILTRATION — User Query Text Transmitted to External APIs (Disclosed in Manifest)

  The skill transmits user query text to api.parallel.ai (via PARALLEL_API_KEY) and openrouter.ai (via OPENROUTER_API_KEY). This is explicitly disclosed in the YAML description field, so it is not covert exfiltration. However, users should be aware that their research queries — which may contain sensitive topics, proprietary research questions, or confidential information — are sent to third-party services. The disclosure is present but only in the manifest description, not surfaced as a runtime warning to users. File: SKILL.md Remediation: Add a runtime notice to users before transmitting queries, especially for sensitive research topics. Consider adding a confirmation step for queries that may contain proprietary or confidential information.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Cross-Skill Activation: Promotes 'scientific-schematics' Skill

  The SKILL.md instructions include a section that actively promotes and instructs the agent to use a separate 'scientific-schematics' skill when creating documents, even when the user has not requested diagrams. The instruction states 'always consider adding scientific diagrams' and provides a bash command to invoke the other skill. This represents capability inflation by expanding the skill's activation scope beyond research lookup into document creation and cross-skill orchestration. File: SKILL.md Remediation: Remove the unsolicited cross-skill promotion. The research-lookup skill should focus solely on research lookup. If diagram generation is desired, it should be triggered explicitly by the user, not automatically suggested by the skill's instructions.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned External Installation via curl Pipe to Bash

  The SKILL.md instructions direct the agent to install parallel-cli using 'curl -fsSL https://parallel.ai/install.sh | bash' as a fallback when parallel-cli is not found. This pattern downloads and executes arbitrary code from an external URL without version pinning or integrity verification (no checksum/hash). If the install.sh endpoint is compromised or the domain is hijacked, malicious code could be executed on the user's machine. File: SKILL.md Remediation: Remove the curl-pipe-to-bash installation pattern from agent instructions. Instead, require users to install parallel-cli manually before using the skill, or use a pinned version with checksum verification. Document the installation step in a README rather than having the agent execute it automatically.

• 🔵 LOW LLM_DATA_EXFILTRATION — API Keys Read from Environment Variables and Transmitted to External Services

  The scripts read PARALLEL_API_KEY and OPENROUTER_API_KEY from environment variables and use them to authenticate with external APIs. While this is standard practice, the keys are passed in HTTP Authorization headers to openrouter.ai and api.parallel.ai. The behavior is expected and disclosed, but the scripts do not validate the key format before use, and error messages may inadvertently expose partial key values in logs. File: research_lookup.py Remediation: Validate API key format before use. Ensure error messages do not include key values. Consider masking keys in any debug/verbose output.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Dynamic Import of Unversioned 'openai' Package

  The research_lookup.py and scripts/research_lookup.py files dynamically import the 'openai' package at runtime without any version pinning or integrity check. If the installed openai package is compromised (e.g., via a supply chain attack or typosquatting), malicious code could execute with the agent's privileges. File: research_lookup.py Remediation: Pin the openai package to a specific known-good version in a requirements.txt or pyproject.toml file. Document the required version in the skill's README.

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/research-lookup/examples.py File: scientific-skills/research-lookup/examples.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/research-lookup/lookup.py File: scientific-skills/research-lookup/lookup.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🔴 CRITICAL BEHAVIOR_ENV_VAR_EXFILTRATION — Environment variable access with network calls detected

  Script accesses environment variables and makes network calls in scientific-skills/research-lookup/research_lookup.py File: scientific-skills/research-lookup/research_lookup.py Remediation: Remove environment variable harvesting or network transmission

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/research-lookup/research_lookup.py File: scientific-skills/research-lookup/research_lookup.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/research-lookup/scripts/generate_schematic.py File: scientific-skills/research-lookup/scripts/generate_schematic.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🔴 CRITICAL BEHAVIOR_ENV_VAR_EXFILTRATION — Environment variable access with network calls detected

  Script accesses environment variables and makes network calls in scientific-skills/research-lookup/scripts/generate_schematic_ai.py File: scientific-skills/research-lookup/scripts/generate_schematic_ai.py Remediation: Remove environment variable harvesting or network transmission

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/research-lookup/scripts/generate_schematic_ai.py File: scientific-skills/research-lookup/scripts/generate_schematic_ai.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🔴 CRITICAL BEHAVIOR_ENV_VAR_EXFILTRATION — Environment variable access with network calls detected

  Script accesses environment variables and makes network calls in scientific-skills/research-lookup/scripts/research_lookup.py File: scientific-skills/research-lookup/scripts/research_lookup.py Remediation: Remove environment variable harvesting or network transmission

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/research-lookup/scripts/research_lookup.py File: scientific-skills/research-lookup/scripts/research_lookup.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🔴 CRITICAL BEHAVIOR_CROSSFILE_ENV_VAR_EXFILTRATION — Cross-file env var exfiltration: 2 files

  Environment variable access with network calls in scripts/generate_schematic.py, scripts/generate_schematic_ai.py Remediation: Review data flow across files: scripts/generate_schematic.py, scripts/generate_schematic_ai.py

• 🔴 CRITICAL BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN — Cross-file exfiltration chain: 2 files

  Multi-file exfiltration chain detected: scripts/generate_schematic.py, scripts/generate_schematic_ai.py collect data → scripts/generate_schematic_ai.py → scripts/generate_schematic_ai.py transmit to network Remediation: Review data flow across files: scripts/generate_schematic.py, scripts/generate_schematic_ai.py

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Cross-Skill Activation Promotion via Embedded Marketing

  The SKILL.md instructions contain embedded promotional language for a companion skill ('scientific-schematics') and a branded product ('Nano Banana Pro'), instructing the agent to 'always consider adding scientific diagrams' and to generate schematics 'by default' for new documents. This inflates the activation surface of a separate skill beyond the stated purpose of scholarly evaluation, potentially causing unwanted cross-skill invocations. File: SKILL.md Remediation: Remove or make optional the cross-skill invocation instructions. The scholar-evaluation skill should focus solely on evaluation tasks. If schematic generation is desired, it should be an explicit user-initiated action, not a default behavior embedded in evaluation instructions.

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/scholar-evaluation/scripts/generate_schematic.py File: scientific-skills/scholar-evaluation/scripts/generate_schematic.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🔴 CRITICAL BEHAVIOR_ENV_VAR_EXFILTRATION — Environment variable access with network calls detected

  Script accesses environment variables and makes network calls in scientific-skills/scholar-evaluation/scripts/generate_schematic_ai.py File: scientific-skills/scholar-evaluation/scripts/generate_schematic_ai.py Remediation: Remove environment variable harvesting or network transmission

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/scholar-evaluation/scripts/generate_schematic_ai.py File: scientific-skills/scholar-evaluation/scripts/generate_schematic_ai.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🔵 LOW LLM_DATA_EXFILTRATION — Environment Variable Access Combined with External Network Calls

  The scripts access the OPENROUTER_API_KEY environment variable and use it to make authenticated HTTP requests to an external API (openrouter.ai). While this is the intended design for AI image generation, the pattern of reading environment variables and transmitting them in Authorization headers to external servers represents a data exposure risk if the API key is misused or if the endpoint is substituted. The user prompt content (potentially containing sensitive research data) is also transmitted externally. File: scripts/generate_schematic_ai.py Remediation: Clearly document in SKILL.md that user-provided diagram descriptions and the OPENROUTER_API_KEY are transmitted to openrouter.ai. Validate the base_url is not overridable by user input. Consider adding a user confirmation step before transmitting content to external APIs.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned External Dependency (requests library)

  The generate_schematic_ai.py script imports the 'requests' library without any version pinning or integrity verification. There is no requirements.txt or setup.py with pinned versions visible in the skill package. An unpinned dependency is susceptible to supply chain attacks if a malicious version is published or if the user's environment has a compromised version installed. File: scripts/generate_schematic_ai.py Remediation: Include a requirements.txt with pinned versions (e.g., requests==2.31.0) and ideally hash verification. Document the dependency clearly in SKILL.md so users are aware of external package requirements.

• 🔴 CRITICAL BEHAVIOR_CROSSFILE_ENV_VAR_EXFILTRATION — Cross-file env var exfiltration: 2 files

  Environment variable access with network calls in scripts/generate_schematic.py, scripts/generate_schematic_ai.py Remediation: Review data flow across files: scripts/generate_schematic.py, scripts/generate_schematic_ai.py

• 🔴 CRITICAL BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN — Cross-file exfiltration chain: 2 files

  Multi-file exfiltration chain detected: scripts/generate_schematic.py, scripts/generate_schematic_ai.py collect data → scripts/generate_schematic_ai.py → scripts/generate_schematic_ai.py transmit to network Remediation: Review data flow across files: scripts/generate_schematic.py, scripts/generate_schematic_ai.py

• 🔵 LOW LLM_DATA_EXFILTRATION — Missing allowed-tools Declaration for Sensitive Capabilities

  The skill declares allowed-tools as 'Read Write Edit Bash' but the Python scripts make external network calls to the OpenRouter API, which is not reflected in the allowed-tools list. While 'Bash' and implicitly Python execution are present, the manifest does not declare network access, which could mislead users about the skill's actual data transmission behavior. File: SKILL.md Remediation: Update the manifest to explicitly document that this skill makes external network calls to openrouter.ai. Consider adding a network-access or internet-access declaration to the manifest metadata so users are aware of external data transmission.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Cross-Skill Dependency and Capability Inflation via scientific-schematics

  The SKILL.md instructions prominently promote and instruct the agent to automatically invoke a separate 'scientific-schematics' skill and a 'Nano Banana Pro' product, inflating the perceived scope of this skill beyond its stated purpose of scientific critical thinking. The instructions state schematics 'should be generated by default' and direct the agent to run external scripts, effectively acting as a distribution mechanism for another skill/product without clear disclosure in the manifest description. File: SKILL.md Remediation: Remove or clearly separate the cross-skill promotion from the core scientific critical thinking instructions. If schematic generation is a desired feature, declare it explicitly in the manifest description and allowed-tools. Do not instruct the agent to invoke other skills by default without user request.

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/scientific-critical-thinking/scripts/generate_schematic.py File: scientific-skills/scientific-critical-thinking/scripts/generate_schematic.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🔴 CRITICAL BEHAVIOR_ENV_VAR_EXFILTRATION — Environment variable access with network calls detected

  Script accesses environment variables and makes network calls in scientific-skills/scientific-critical-thinking/scripts/generate_schematic_ai.py File: scientific-skills/scientific-critical-thinking/scripts/generate_schematic_ai.py Remediation: Remove environment variable harvesting or network transmission

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/scientific-critical-thinking/scripts/generate_schematic_ai.py File: scientific-skills/scientific-critical-thinking/scripts/generate_schematic_ai.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🔵 LOW LLM_DATA_EXFILTRATION — API Key Passed via Environment Variable Inheritance

  The generate_schematic.py wrapper passes the OpenRouter API key to the subprocess via os.environ.copy(), which inherits the full environment. While this avoids exposing the key in process arguments (which is good), it means the full environment including any other sensitive variables is passed to the child process. The review log is also written to disk as a JSON file containing the full prompt, critique, and metadata. File: scripts/generate_schematic.py Remediation: Instead of passing the full environment copy, construct a minimal environment containing only the variables needed by the child script. Also consider whether the review log JSON (which contains full prompts and critiques) should be written to disk by default, or made opt-in.

• 🔵 LOW LLM_DATA_EXFILTRATION — Review Log Written to Disk Contains Full Prompt and Critique Data

  The generate_schematic_ai.py script automatically writes a JSON review log to disk containing the full user prompt, AI-generated critique, quality scores, and iteration metadata. This log persists after the skill completes and may contain sensitive information about the user's research or document content. File: scripts/generate_schematic_ai.py Remediation: Make review log generation opt-in rather than automatic. If logs are written, clearly inform the user of their location and content, and provide a way to disable logging for sensitive documents.

• 🔵 LOW LLM_RESOURCE_ABUSE — Unbounded API Calls with Iterative Refinement Loop

  The generate_schematic_ai.py script implements an iterative refinement loop that makes multiple API calls (up to the iteration limit). While the maximum is capped at 2 iterations, each iteration makes at least 2 API calls (one for image generation, one for review), and the wrapper script generate_schematic.py enforces this cap. The resource consumption is bounded but could still result in unexpected API costs for users who are unaware of the multi-call behavior. File: scripts/generate_schematic_ai.py Remediation: Clearly document in the skill description and user-facing output that each invocation may make up to 4 API calls (2 iterations × 2 calls each). Consider prompting the user for confirmation before initiating the iterative refinement process, especially for higher-cost document types.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned External Dependency (requests library)

  The generate_schematic_ai.py script imports the 'requests' library without any version pinning in the skill package. There is no requirements.txt or equivalent dependency manifest included. This means the skill will use whatever version of 'requests' is installed in the environment, which could be a compromised or incompatible version. File: scripts/generate_schematic_ai.py:14 Remediation: Include a requirements.txt file in the skill package with pinned versions (e.g., requests==2.31.0). This ensures reproducible behavior and reduces supply chain risk from unpinned dependencies.

• 🔴 CRITICAL BEHAVIOR_CROSSFILE_ENV_VAR_EXFILTRATION — Cross-file env var exfiltration: 2 files

  Environment variable access with network calls in scripts/generate_schematic.py, scripts/generate_schematic_ai.py Remediation: Review data flow across files: scripts/generate_schematic.py, scripts/generate_schematic_ai.py

• 🔴 CRITICAL BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN — Cross-file exfiltration chain: 2 files

  Multi-file exfiltration chain detected: scripts/generate_schematic.py, scripts/generate_schematic_ai.py collect data → scripts/generate_schematic_ai.py → scripts/generate_schematic_ai.py transmit to network Remediation: Review data flow across files: scripts/generate_schematic.py, scripts/generate_schematic_ai.py

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/scientific-schematics/scripts/generate_schematic.py File: scientific-skills/scientific-schematics/scripts/generate_schematic.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🔴 CRITICAL BEHAVIOR_ENV_VAR_EXFILTRATION — Environment variable access with network calls detected

  Script accesses environment variables and makes network calls in scientific-skills/scientific-schematics/scripts/generate_schematic_ai.py File: scientific-skills/scientific-schematics/scripts/generate_schematic_ai.py Remediation: Remove environment variable harvesting or network transmission

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/scientific-schematics/scripts/generate_schematic_ai.py File: scientific-skills/scientific-schematics/scripts/generate_schematic_ai.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned External Dependency (requests library)

  The skill requires the 'requests' library but does not pin a specific version anywhere in the skill package. The example_usage.sh mentions 'pip install requests' without a version pin. Unpinned dependencies are vulnerable to supply chain attacks where a compromised version of the package could be installed. File: scripts/example_usage.sh:5 Remediation: Pin the requests library to a specific known-good version (e.g., 'pip install requests==2.31.0') and include a requirements.txt with pinned versions for all dependencies. Consider using hash verification (pip install --require-hashes) for additional supply chain security.

• 🔵 LOW LLM_DATA_EXFILTRATION — API Key Passed via Command-Line Flag Exposes Credential in Process Listings

  The generate_schematic.py wrapper script accepts an --api-key flag and passes the API key value through to the subprocess command via cmd.extend. Although the script notes it passes the key via environment to avoid exposure, the api_key value is also accepted as a CLI argument which could appear in process listings (ps aux) on multi-user systems. The environment-variable path is safer, but the --api-key flag pathway remains a risk. File: scripts/generate_schematic.py Remediation: Remove the --api-key CLI flag entirely and require the OPENROUTER_API_KEY environment variable exclusively. If a flag is needed, ensure it is never appended to the subprocess command list and is only passed via the environment dictionary, which this code already does correctly for the subprocess. The risk is the parent process's own argv exposure.

• 🔵 LOW LLM_DATA_EXFILTRATION — User-Supplied Prompt Passed Unsanitized to External AI API

  The user-supplied diagram description (prompt) is passed directly and without sanitization into the API payload sent to OpenRouter. While this is a third-party AI service and not a local execution context, the unsanitized prompt could contain sensitive information from the user's environment or be used to craft adversarial inputs to the image generation model. No input length limits or content filtering are applied before transmission. File: scripts/generate_schematic_ai.py Remediation: Add input validation and length limits on the user prompt before transmission. Consider logging a warning if the prompt contains patterns that look like file paths, credentials, or other sensitive data. Document clearly in the skill that user prompts are transmitted to OpenRouter's external API.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — References Non-Existent AI Models ('Nano Banana 2', 'Gemini 3.1 Pro Preview')

  The skill prominently markets itself as using 'Nano Banana 2 AI' and 'Gemini 3.1 Pro Preview' throughout the SKILL.md and scripts. 'Nano Banana 2' does not appear to be a real Google model name. The actual model IDs used in code are 'google/gemini-3.1-flash-image-preview' and 'google/gemini-3.1-pro-preview'. This mismatch between marketing names and actual model identifiers constitutes capability inflation and could mislead users about what AI systems are actually being used. File: scripts/generate_schematic_ai.py Remediation: Use accurate, verifiable model names in all documentation and marketing materials. Remove references to 'Nano Banana 2' and replace with the actual model identifier. Ensure the OpenRouter URL in comments matches the actual model being used.

• 🔴 CRITICAL BEHAVIOR_CROSSFILE_ENV_VAR_EXFILTRATION — Cross-file env var exfiltration: 4 files

  Environment variable access with network calls in scripts/generate_slide_image_ai.py, scripts/generate_slide_image.py, scripts/generate_schematic.py, scripts/generate_schematic_ai.py Remediation: Review data flow across files: scripts/generate_schematic.py, scripts/generate_slide_image.py, scripts/generate_schematic_ai.py, scripts/generate_slide_image_ai.py

• 🔴 CRITICAL BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN — Cross-file exfiltration chain: 4 files

  Multi-file exfiltration chain detected: scripts/generate_slide_image_ai.py, scripts/generate_slide_image.py, scripts/generate_schematic.py, scripts/generate_schematic_ai.py collect data → scripts/generate_slide_image_ai.py, scripts/generate_schematic_ai.py → scripts/generate_slide_image_ai.py, scripts/generate_schematic_ai.py transmit to network Remediation: Review data flow across files: scripts/generate_schematic.py, scripts/generate_slide_image.py, scripts/generate_schematic_ai.py, scripts/generate_slide_image_ai.py

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Over-Broad Capability Description with Brand Keyword Baiting

  The skill description contains an extensive list of trigger keywords ('PowerPoint slides, conference presentations, seminar talks, research presentations, thesis defense slides, scientific talk') designed to maximize activation across a wide range of user queries. While the skill does provide legitimate presentation functionality, the description is crafted to intercept nearly any presentation-related request. File: SKILL.md Remediation: Narrow the description to accurately reflect the skill's primary use case without exhaustive keyword enumeration.

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/scientific-slides/scripts/generate_schematic.py File: scientific-skills/scientific-slides/scripts/generate_schematic.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🔴 CRITICAL BEHAVIOR_ENV_VAR_EXFILTRATION — Environment variable access with network calls detected

  Script accesses environment variables and makes network calls in scientific-skills/scientific-slides/scripts/generate_schematic_ai.py File: scientific-skills/scientific-slides/scripts/generate_schematic_ai.py Remediation: Remove environment variable harvesting or network transmission

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/scientific-slides/scripts/generate_schematic_ai.py File: scientific-skills/scientific-slides/scripts/generate_schematic_ai.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/scientific-slides/scripts/generate_slide_image.py File: scientific-skills/scientific-slides/scripts/generate_slide_image.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🔴 CRITICAL BEHAVIOR_ENV_VAR_EXFILTRATION — Environment variable access with network calls detected

  Script accesses environment variables and makes network calls in scientific-skills/scientific-slides/scripts/generate_slide_image_ai.py File: scientific-skills/scientific-slides/scripts/generate_slide_image_ai.py Remediation: Remove environment variable harvesting or network transmission

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/scientific-slides/scripts/generate_slide_image_ai.py File: scientific-skills/scientific-slides/scripts/generate_slide_image_ai.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🔴 CRITICAL BEHAVIOR_EVAL_SUBPROCESS — eval/exec combined with subprocess detected

  Dangerous combination of code execution and system commands in scientific-skills/scientific-slides/scripts/validate_presentation.py File: scientific-skills/scientific-slides/scripts/validate_presentation.py Remediation: Remove eval/exec or use safer alternatives

• 🔵 LOW LLM_DATA_EXFILTRATION — Review Log Written to Disk Contains Full Prompts and API Responses

  The generate_schematic_ai.py script writes a JSON review log to disk containing the full user prompt, all critique text from the AI reviewer, and iteration metadata. If the user's prompt contains sensitive research data or proprietary information, this is persisted to disk in plaintext without any access controls. File: scripts/generate_schematic_ai.py Remediation: Inform users that prompts and AI responses are logged to disk. Provide an option to disable logging or automatically delete logs after review. Ensure log files have restricted permissions.

• 🔵 LOW LLM_DATA_EXFILTRATION — API Key Transmitted via Environment Variable to Subprocess

  The generate_slide_image.py and generate_schematic.py wrapper scripts read the OPENROUTER_API_KEY from the environment and explicitly pass it into a subprocess environment copy. While this avoids command-line exposure, the key is still propagated to child processes and could be logged or intercepted in certain environments. The key is also read from a .env file in the working directory, which may be world-readable. File: scripts/generate_slide_image.py:97 Remediation: Ensure .env files have restricted permissions (chmod 600). Consider using a secrets manager rather than environment variables for API keys. Document that the key is passed to child processes.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Third-Party Dependencies

  The scripts rely on third-party packages (requests, Pillow, PyMuPDF/fitz, python-pptx, PyPDF2) without version pinning. The instructions suggest installing these with generic pip install commands. Unpinned dependencies are vulnerable to supply chain attacks where a malicious package update could compromise the skill's behavior. File: scripts/generate_slide_image_ai.py:1 Remediation: Pin all dependencies to specific versions in a requirements.txt file (e.g., requests==2.31.0, Pillow==10.0.0). Use a lockfile and verify package hashes.

• 🔵 LOW LLM_RESOURCE_ABUSE — Unbounded Network Requests with 120-Second Timeout Per Iteration

  The generate_slide_image_ai.py and generate_schematic_ai.py scripts make HTTP requests to the OpenRouter API with a 120-second timeout per call. With up to 2 iterations and multiple slides (potentially 15-18 for a conference talk), the total API call time could be substantial. The scripts do not implement rate limiting, backoff, or total budget caps, which could lead to excessive API usage and cost. File: scripts/generate_slide_image_ai.py:130 Remediation: Implement a total budget cap (maximum number of API calls per session), add exponential backoff for retries, and document expected API costs per presentation.

• 🔴 CRITICAL BEHAVIOR_CROSSFILE_ENV_VAR_EXFILTRATION — Cross-file env var exfiltration: 3 files

  Environment variable access with network calls in scripts/generate_schematic.py, scripts/generate_schematic_ai.py Remediation: Review data flow across files: scripts/generate_schematic.py, scripts/generate_schematic_ai.py, scripts/generate_image.py

• 🔴 CRITICAL BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN — Cross-file exfiltration chain: 3 files

  Multi-file exfiltration chain detected: scripts/generate_schematic.py, scripts/generate_schematic_ai.py collect data → scripts/generate_image.py, scripts/generate_schematic_ai.py → scripts/generate_image.py, scripts/generate_schematic_ai.py transmit to network Remediation: Review data flow across files: scripts/generate_schematic.py, scripts/generate_schematic_ai.py, scripts/generate_image.py

• 🔵 LOW LLM_RESOURCE_ABUSE — Iterative AI API Calls May Cause Excessive Resource Consumption

  The generate_schematic_ai.py script makes multiple sequential API calls per image generation (up to 2 generation calls plus review calls per iteration). For each figure, this results in up to 4 API calls. The SKILL.md instructions mandate generating 5-30 figures per document type (e.g., 20-30 for market research), which could result in 80-120 API calls per document, leading to significant API cost and time consumption without explicit user confirmation. File: SKILL.md Remediation: Add explicit user confirmation before generating large numbers of figures. Provide cost estimates before proceeding with bulk generation. Consider adding a maximum figure count safeguard.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Overly Mandatory Figure Generation Instructions May Cause Unintended Behavior

  The SKILL.md uses strong mandatory language (MANDATORY, CRITICAL, ALWAYS, REQUIRED) to instruct the agent to generate figures even when not explicitly requested by the user. Phrases like 'Every scientific paper MUST include a graphical abstract' and 'When in Doubt, Generate a Figure' could cause the agent to autonomously generate many images and incur API costs without explicit user consent for each action. File: SKILL.md Remediation: Soften mandatory language to recommendations. Require explicit user confirmation before generating figures that incur API costs. Distinguish between user-requested and autonomously-initiated figure generation.

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/scientific-writing/scripts/generate_schematic.py File: scientific-skills/scientific-writing/scripts/generate_schematic.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🔴 CRITICAL BEHAVIOR_ENV_VAR_EXFILTRATION — Environment variable access with network calls detected

  Script accesses environment variables and makes network calls in scientific-skills/scientific-writing/scripts/generate_schematic_ai.py File: scientific-skills/scientific-writing/scripts/generate_schematic_ai.py Remediation: Remove environment variable harvesting or network transmission

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/scientific-writing/scripts/generate_schematic_ai.py File: scientific-skills/scientific-writing/scripts/generate_schematic_ai.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🔵 LOW LLM_DATA_EXFILTRATION — API Key Transmitted via Environment Variable to External Service

  The scripts read the OPENROUTER_API_KEY environment variable and transmit it to an external API endpoint (https://openrouter.ai/api/v1). While this is the intended behavior for an AI image generation service, the key is a sensitive credential. The generate_image.py script also searches parent directories for .env files containing the API key, which could expose credentials from unrelated projects if the skill is run from a sensitive directory. File: scripts/generate_image.py Remediation: Limit .env file search to the skill's own directory only, not parent directories. Document clearly that the API key is transmitted to openrouter.ai. Consider warning users before transmitting credentials.

• 🔵 LOW LLM_DATA_EXFILTRATION — User-Supplied Prompt Transmitted Verbatim to External AI API

  The generate_image.py and generate_schematic_ai.py scripts transmit user-supplied prompts directly to the OpenRouter API without sanitization or content filtering. While this is expected behavior for an image generation skill, the user prompt content (which may include sensitive research details) is sent to an external third-party service (openrouter.ai), which may log or process this data. File: scripts/generate_image.py Remediation: Add a disclosure in SKILL.md that user prompts and any input images are transmitted to openrouter.ai. Consider adding a confirmation step before transmitting potentially sensitive research content to external services.

• 🔵 LOW LLM_DATA_EXFILTRATION — Input Images Encoded and Transmitted to External API

  The generate_image.py script reads local image files provided by the user, encodes them as base64, and transmits them to the external OpenRouter API. This means any image file the user provides (including potentially sensitive research images, medical images, or proprietary figures) is sent to a third-party service. File: scripts/generate_image.py Remediation: Add explicit disclosure that input images are transmitted to openrouter.ai. Warn users not to provide sensitive or proprietary images without understanding the data sharing implications.

• 🔴 CRITICAL BEHAVIOR_CROSSFILE_ENV_VAR_EXFILTRATION — Cross-file env var exfiltration: 2 files

  Environment variable access with network calls in scripts/generate_schematic.py, scripts/generate_schematic_ai.py Remediation: Review data flow across files: scripts/generate_schematic.py, scripts/generate_schematic_ai.py

• 🔴 CRITICAL BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN — Cross-file exfiltration chain: 2 files

  Multi-file exfiltration chain detected: scripts/generate_schematic.py, scripts/generate_schematic_ai.py collect data → scripts/generate_schematic_ai.py → scripts/generate_schematic_ai.py transmit to network Remediation: Review data flow across files: scripts/generate_schematic.py, scripts/generate_schematic_ai.py

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Mandatory Skill Cross-Invocation via Undisclosed Dependency

  The SKILL.md instructions declare that every treatment plan MUST include at least 1 AI-generated figure using the 'scientific-schematics' skill, framed as mandatory ('⚠️ MANDATORY'). This forces invocation of a separate skill (scientific-schematics) without disclosing this dependency in the YAML manifest. The description claims the skill generates treatment plans but does not mention the mandatory dependency on an external skill. This inflates the apparent scope of the skill and silently chains to another skill's capabilities. File: SKILL.md Remediation: Declare the dependency on the scientific-schematics skill in the YAML manifest. Make the schematic generation optional rather than mandatory, and clearly disclose the cross-skill dependency in the description.

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/treatment-plans/scripts/generate_schematic.py File: scientific-skills/treatment-plans/scripts/generate_schematic.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🔴 CRITICAL BEHAVIOR_ENV_VAR_EXFILTRATION — Environment variable access with network calls detected

  Script accesses environment variables and makes network calls in scientific-skills/treatment-plans/scripts/generate_schematic_ai.py File: scientific-skills/treatment-plans/scripts/generate_schematic_ai.py Remediation: Remove environment variable harvesting or network transmission

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/treatment-plans/scripts/generate_schematic_ai.py File: scientific-skills/treatment-plans/scripts/generate_schematic_ai.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🔵 LOW LLM_DATA_EXFILTRATION — API Key Passed via Environment Variable to External AI Service

  The generate_schematic.py and generate_schematic_ai.py scripts require an OPENROUTER_API_KEY environment variable and transmit it to the external OpenRouter API service. While the key is passed via environment (not command-line arguments, which is good practice), the scripts make outbound network calls to https://openrouter.ai/api/v1 using this credential. The skill's description does not disclose that it makes external API calls or requires an API key, creating an undisclosed credential usage pattern. File: scripts/generate_schematic.py Remediation: Disclose in the skill description and SKILL.md that an OPENROUTER_API_KEY is required and that data (diagram descriptions) will be sent to an external API. Prompt the user for consent before making external API calls.

• 🔵 LOW LLM_DATA_EXFILTRATION — User Prompt Content Transmitted to External Third-Party AI Service

  The generate_schematic_ai.py script transmits the user's diagram description prompt (which may contain sensitive clinical context) to the external OpenRouter API, which routes it to Google's Gemini models. In a medical treatment plan context, users may inadvertently include patient-related information in diagram descriptions. The skill does not warn users about this data transmission or advise against including PHI in schematic prompts. File: scripts/generate_schematic_ai.py Remediation: Add a clear warning in SKILL.md and in the script output that diagram descriptions are sent to an external API (OpenRouter/Google Gemini). Advise users not to include PHI or patient-identifiable information in schematic prompts. Add a confirmation prompt before transmitting data externally.

• 🔵 LOW LLM_RESOURCE_ABUSE — Iterative External API Calls Without Rate Limiting or Cost Controls

  The generate_schematic_ai.py script implements an iterative refinement loop that makes multiple calls to external paid AI APIs (image generation + quality review per iteration, up to 2 iterations). Each treatment plan generation could trigger up to 4 external API calls (2 image generations + 2 reviews). There is no rate limiting, cost cap, or user confirmation before incurring API costs. In a busy clinical environment, this could lead to unexpected API cost accumulation. File: scripts/generate_schematic_ai.py Remediation: Add a cost warning before initiating API calls. Implement a configurable cost limit or require explicit user confirmation before each iteration beyond the first. Display estimated API costs to the user.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned External AI Model Dependencies via OpenRouter

  The generate_schematic_ai.py script references specific AI model identifiers (google/gemini-3.1-flash-image-preview and google/gemini-3.1-pro-preview) via OpenRouter. These model identifiers are not version-pinned at the API level and could change behavior if OpenRouter updates model routing. Additionally, the script uses 'requests' library without a pinned version requirement, creating a supply chain risk. File: scripts/generate_schematic_ai.py Remediation: Pin the requests library version in a requirements.txt file. Document the specific model versions being used and implement version checking or fallback behavior if models change.

• 🔴 CRITICAL BEHAVIOR_CROSSFILE_ENV_VAR_EXFILTRATION — Cross-file env var exfiltration: 2 files

  Environment variable access with network calls in scripts/generate_schematic.py, scripts/generate_schematic_ai.py Remediation: Review data flow across files: scripts/generate_schematic.py, scripts/generate_schematic_ai.py

• 🔴 CRITICAL BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN — Cross-file exfiltration chain: 2 files

  Multi-file exfiltration chain detected: scripts/generate_schematic.py, scripts/generate_schematic_ai.py collect data → scripts/generate_schematic_ai.py → scripts/generate_schematic_ai.py transmit to network Remediation: Review data flow across files: scripts/generate_schematic.py, scripts/generate_schematic_ai.py

• 🔵 LOW LLM_PROMPT_INJECTION — Skill Instructs Agent to Automatically Invoke Another Skill (scientific-schematics)

  The SKILL.md instructions direct the agent to automatically invoke the 'scientific-schematics' skill and run generate_schematic.py for new documents by default, without explicit user confirmation. This cross-skill invocation pattern means that activating the venue-templates skill can automatically trigger additional skill execution and external API calls (to openrouter.ai) that the user may not have explicitly requested. The instruction 'For new documents: Scientific schematics should be generated by default' is an autonomy-expanding directive. File: SKILL.md Remediation: Change the default behavior from automatic schematic generation to opt-in. Replace 'should be generated by default' with 'can be generated upon user request'. Require explicit user confirmation before invoking external API calls or other skills.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Over-Broad Capability Claims and Keyword Baiting in Description

  The skill description and SKILL.md contain an extensive list of high-profile venue names (Nature, Science, PLOS, IEEE, ACM, NeurIPS, ICML, CVPR, CHI, NSF, NIH, DOE, DARPA) that serve as keyword triggers to maximize activation. While the skill does provide legitimate templates, the description is unusually broad and keyword-dense, potentially inflating perceived capabilities and triggering the skill for a wider range of queries than necessary. File: SKILL.md Remediation: Narrow the description to accurately reflect the skill's actual bundled capabilities. Avoid listing every possible venue name in the description metadata; instead, describe the general capability.

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/venue-templates/scripts/generate_schematic.py File: scientific-skills/venue-templates/scripts/generate_schematic.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🔴 CRITICAL BEHAVIOR_ENV_VAR_EXFILTRATION — Environment variable access with network calls detected

  Script accesses environment variables and makes network calls in scientific-skills/venue-templates/scripts/generate_schematic_ai.py File: scientific-skills/venue-templates/scripts/generate_schematic_ai.py Remediation: Remove environment variable harvesting or network transmission

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/venue-templates/scripts/generate_schematic_ai.py File: scientific-skills/venue-templates/scripts/generate_schematic_ai.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🔵 LOW LLM_UNAUTHORIZED_TOOL_USE — Cross-File Tool Chain: generate_schematic.py Delegates to generate_schematic_ai.py via subprocess

  The generate_schematic.py script uses subprocess.run() to execute generate_schematic_ai.py, passing the API key via environment variables. This cross-file delegation chain (flagged as BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN) means the outer script acts as a launcher that passes credentials to an inner script making external network calls. While the design intent is to avoid exposing the API key in process listings, the subprocess chain adds complexity and reduces auditability of what is actually executed. File: scripts/generate_schematic.py Remediation: Consider consolidating the two schematic generation scripts into one to reduce the subprocess delegation chain. If the two-script design is maintained, clearly document the execution flow and ensure the subprocess command is constructed from static values only (no user-controlled command injection risk).

• 🔵 LOW LLM_DATA_EXFILTRATION — OPENROUTER_API_KEY Environment Variable Access with External Network Calls

  The generate_schematic_ai.py script reads the OPENROUTER_API_KEY environment variable and uses it to make authenticated HTTP requests to an external API (https://openrouter.ai/api/v1). While this is the intended functionality for AI image generation, the pattern of reading environment variables and transmitting them to external servers represents a data exposure risk. If the environment contains other sensitive keys or if the API key itself is sensitive, this creates a credential exposure vector. The static analyzer flagged this as BEHAVIOR_ENV_VAR_EXFILTRATION. File: scripts/generate_schematic_ai.py Remediation: This is expected behavior for an AI generation skill. However, document clearly that the skill requires and transmits an API key to openrouter.ai. Ensure the skill only reads the specific OPENROUTER_API_KEY variable and does not harvest other environment variables. Consider adding a warning to users about what data is transmitted.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned External Dependency: requests Library

  The generate_schematic_ai.py script imports the requests library without any version pinning. The script checks for its presence and exits if not found, but there is no requirements.txt or pinned dependency specification in the skill package. An unpinned dependency could be satisfied by a compromised or typosquatted package in certain environments. File: scripts/generate_schematic_ai.py:10 Remediation: Add a requirements.txt file to the skill package specifying pinned versions of all dependencies (e.g., requests==2.31.0). Document the installation step clearly in the skill README.

• 🔵 LOW LLM_DATA_EXFILTRATION — API Token Placeholder in Skill Instructions

  The SKILL.md instructions include code examples with placeholder tokens (token='' and token='') for the Forge API. While these are placeholders and not hardcoded secrets, the skill instructs users to provide real API tokens to the ESM3ForgeInferenceClient. If a user provides a real token in a session, it could be logged or exposed in conversation history. The skill does not instruct users to use environment variables for token management. File: SKILL.md Remediation: Update code examples to demonstrate secure token handling via environment variables (e.g., os.environ.get('FORGE_API_TOKEN')) rather than inline string literals. Add explicit guidance to never hardcode tokens in code.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Package Installation

  The skill's installation instructions use 'uv pip install esm' and 'uv pip install flash-attn --no-build-isolation' without version pinning. This exposes users to supply chain risks where a compromised or updated package version could introduce malicious code. The 'flash-attn' package in particular uses --no-build-isolation which bypasses standard build sandboxing. File: SKILL.md Remediation: Pin package versions explicitly (e.g., 'uv pip install esm==X.Y.Z'). Document the expected package versions and checksums. Avoid --no-build-isolation unless strictly necessary, and document the security implications when used.

• 🟠 HIGH MDBLOCK_PYTHON_EVAL_EXEC — Python code block uses eval/exec

  Code block in references/esm-c-api.md at line 337 contains potentially dangerous Python code. File: references/esm-c-api.md:337 Remediation: Review the code block for security implications.

• 🔵 LOW LLM_COMMAND_INJECTION — Use of eval/exec in Python Code Blocks

  The static analyzer flagged a potential eval/exec usage in the Python code blocks embedded in the reference markdown files. Reviewing the actual code blocks, the references use standard Python constructs (e.g., model.forward, model.encode, etc.) and do not contain direct eval/exec calls. However, the skill instructs the agent to load and execute code patterns from reference files, and some patterns like dynamic model loading and arbitrary code execution via asyncio.run() with user-controlled inputs could be misused if user-supplied sequences or configurations are passed without validation. File: references/esm3-api.md Remediation: Validate all user-supplied protein sequences against expected amino acid character sets before passing to model APIs. Ensure no user-controlled strings are passed to eval/exec or os.system calls.

• 🔵 LOW LLM_DATA_EXFILTRATION — AWS Credential Handling in Code Example

  The SKILL.md contains a code example showing AWS credentials being passed directly as keyword arguments to AWSSession, which could encourage users to hardcode AWS credentials in their scripts. File: SKILL.md Remediation: Replace with environment variable or AWS credential file patterns. Add a comment directing users to use IAM roles, environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY), or the AWS credentials file rather than hardcoding values.

• 🔵 LOW LLM_RESOURCE_ABUSE — Unpinned Package Dependencies in Installation Instructions

  The installation section recommends installing numerous packages without version pins (e.g., 'uv pip install rsgislib torchgeo earthengine-api', 'conda install -c conda-forge gdal rasterio fiona'). Unpinned dependencies can lead to unexpected behavior if malicious or broken package versions are published, and could result in dependency conflicts or supply chain risks. File: SKILL.md Remediation: Pin all dependencies to specific versions (e.g., 'rasterio==1.3.9'). Consider providing a requirements.txt or environment.yml with pinned versions for reproducibility and security.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Over-Broad Capability Claims in Skill Description

  The skill description makes extremely broad capability claims, including '30+ scientific domains', '500+ code examples', '8 programming languages', and coverage of 'any geospatial computation task'. These over-broad claims could cause the agent to activate this skill for a very wide range of queries beyond its actual scope, potentially displacing more appropriate tools or skills. The description also lists numerous trigger keywords (remote sensing, GIS, spatial ML, Earth observation, terrain analysis, hydrological modeling, marine spatial analysis, atmospheric science) that could cause excessive activation. File: SKILL.md Remediation: Narrow the description to the core functionality. Avoid 'any geospatial computation task' phrasing. Use specific, accurate capability descriptions rather than exhaustive keyword lists.

• 🔵 LOW LLM_UNAUTHORIZED_TOOL_USE — Missing allowed-tools Declaration

  The skill does not declare an 'allowed-tools' field in its YAML manifest. While this field is optional per the agent skills spec, its absence means there are no declared restrictions on which agent tools this skill can invoke. Given the skill's broad scope and the presence of code examples involving file I/O, network access, subprocess execution, and database operations, declaring allowed tools would improve security posture. File: SKILL.md Remediation: Add an explicit 'allowed-tools' declaration to the YAML frontmatter listing only the tools actually needed for the skill's core functionality. This provides a clear security boundary for the agent runtime.

• 🔵 LOW LLM_DATA_EXFILTRATION — Hardcoded Credential Placeholders in Code Examples

  Several code examples in the skill's markdown files contain placeholder credential patterns that, if filled in by users, could expose sensitive API keys and credentials. Examples include 'YOUR_API_KEY', 'YOUR_ACCESS_TOKEN', and SentinelAPI with 'user'/'password' literals. While these are placeholders, the patterns normalize embedding credentials directly in code rather than using environment variables or secure credential stores. File: references/data-sources.md Remediation: Replace credential placeholders with environment variable patterns (e.g., os.environ.get('SENTINEL_USER')) and add explicit warnings in comments not to hardcode credentials. Reference secure credential management practices.

• 🔵 LOW LLM_COMMAND_INJECTION — eval/exec Usage Detected in Code Blocks (Static Analyzer Finding)

  The static pre-scan flagged MDBLOCK_PYTHON_EVAL_EXEC findings in the markdown files. After reviewing all provided code blocks, the eval/exec patterns appear to be within legitimate geospatial code examples (e.g., subprocess.run calls in SAGA GIS integration). The subprocess.run calls in references/gis-software.md pass command lists constructed from function parameters, which could be a command injection risk if user-supplied input were passed to these functions without validation. File: references/gis-software.md Remediation: Add input validation and sanitization to all functions that construct shell commands from parameters. Use shlex.quote() for any user-supplied path arguments. Add documentation warnings that these functions should not be called with untrusted input.

• 🟡 MEDIUM MDBLOCK_PYTHON_SUBPROCESS — Python code block executes shell commands

  Code block in references/gis-software.md at line 290 contains potentially dangerous Python code. File: references/gis-software.md:290 Remediation: Review the code block for security implications.

• 🟠 HIGH MDBLOCK_PYTHON_EVAL_EXEC — Python code block uses eval/exec

  Code block in references/machine-learning.md at line 207 contains potentially dangerous Python code. File: references/machine-learning.md:207 Remediation: Review the code block for security implications.

• 🟠 HIGH MDBLOCK_PYTHON_EVAL_EXEC — Python code block uses eval/exec

  Code block in references/machine-learning.md at line 435 contains potentially dangerous Python code. File: references/machine-learning.md:435 Remediation: Review the code block for security implications.

• 🔵 LOW LLM_DATA_EXFILTRATION — Credential Handling Guidance Encourages Reading .env Files

  The SKILL.md instructions direct the agent to check for MODAL_TOKEN_ID and MODAL_TOKEN_SECRET in the environment and local .env files before prompting the user. While this is standard practice for credential management, it instructs the agent to proactively scan environment variables and local .env files for secrets. If the agent is operating in a context where it has broad file access, this could inadvertently expose credentials beyond the intended Modal tokens. File: SKILL.md Remediation: Add explicit guidance that the agent should only read .env files in the current project directory and should not traverse parent directories or other locations. Clarify that credential scanning should be scoped strictly to Modal-specific tokens.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Over-Broad Skill Activation Description

  The skill description contains an extensive list of trigger phrases designed to maximize activation across a wide range of scenarios: 'Use this skill whenever the user mentions Modal, serverless GPU compute, deploying ML models to the cloud, serving inference endpoints, running batch processing in the cloud, or needs to scale Python workloads beyond their local machine. Also use when the user wants to run code on H100s, A100s, or other cloud GPUs, or needs to create a web API for a model.' This is broader than necessary for a focused Modal-specific skill and could cause the skill to activate in contexts where it may not be the most appropriate tool. File: SKILL.md Remediation: Narrow the activation description to focus specifically on Modal platform usage rather than general GPU compute or cloud deployment scenarios that might be better served by other tools.

• 🟠 HIGH MDBLOCK_PYTHON_EVAL_EXEC — Python code block uses eval/exec

  Code block in references/functions.md at line 82 contains potentially dangerous Python code. File: references/functions.md:82 Remediation: Review the code block for security implications.

• 🔵 LOW LLM_COMMAND_INJECTION — Python eval/exec Usage in Code Examples

  The static analyzer flagged a potential eval/exec usage in a Python code block within the skill's documentation. After reviewing all referenced files, the flagged pattern appears to be within illustrative code examples (e.g., subprocess.run, shell command execution patterns in references/gpu.md and references/web-endpoints.md) rather than a direct eval/exec call on untrusted input. The skill itself contains no executable scripts, only documentation. However, the skill instructs the agent to generate and run Modal Python code that may include subprocess.run with user-controlled arguments, which could lead to command injection if the agent constructs shell commands from unsanitized user input. File: references/gpu.md Remediation: Ensure that when the agent generates Modal code involving subprocess.run or similar constructs, it validates and sanitizes any user-provided arguments before incorporating them into shell commands. Add guidance in SKILL.md to warn against passing raw user input into subprocess calls.

• 🟡 MEDIUM MDBLOCK_PYTHON_SUBPROCESS — Python code block executes shell commands

  Code block in references/gpu.md at line 159 contains potentially dangerous Python code. File: references/gpu.md:159 Remediation: Review the code block for security implications.

• 🟡 MEDIUM MDBLOCK_PYTHON_SUBPROCESS — Python code block executes shell commands

  Code block in references/gpu.md at line 168 contains potentially dangerous Python code. File: references/gpu.md:168 Remediation: Review the code block for security implications.

• 🟡 MEDIUM MDBLOCK_PYTHON_HTTP_POST — Python code block sends HTTP POST request

  Code block in references/scheduled-jobs.md at line 141 contains potentially dangerous Python code. File: references/scheduled-jobs.md:141 Remediation: Review the code block for security implications.

• 🟡 MEDIUM MDBLOCK_PYTHON_SUBPROCESS — Python code block executes shell commands

  Code block in references/web-endpoints.md at line 149 contains potentially dangerous Python code. File: references/web-endpoints.md:149 Remediation: Review the code block for security implications.

• 🔵 LOW LLM_DATA_EXFILTRATION — Multiple Missing Referenced Files

  The skill references numerous files that do not exist in the package: assets/graphs.md, pathml.py, assets/preprocessing.md, templates/machine_learning.md, templates/data_management.md, templates/preprocessing.md, templates/image_loading.md, assets/multiparametric.md, templates/graphs.md, templates/multiparametric.md, assets/data_management.md, assets/machine_learning.md, assets/image_loading.md. The presence of a referenced 'pathml.py' script that is missing is notable. If the agent attempts to load these missing files from external sources or if a malicious actor places files at these paths, unexpected behavior could result. File: SKILL.md Remediation: Remove references to non-existent files from the skill documentation, or include the missing files in the package. The missing 'pathml.py' reference is particularly notable and should be clarified - if it is intended as an executable script, it should be included or the reference removed.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Package Installation

  The SKILL.md installation instructions use 'uv pip install pathml' and 'uv pip install pathml[all]' without version pinning. This means the skill will always install the latest available version of pathml and its dependencies, which could introduce breaking changes or supply chain risks if the package is compromised or updated with malicious code. File: SKILL.md Remediation: Pin the pathml package to a specific known-good version (e.g., 'uv pip install pathml==X.Y.Z') to ensure reproducibility and reduce supply chain risk. Consider also pinning critical dependencies like torch, onnxruntime, and deepcell.

• 🟠 HIGH MDBLOCK_PYTHON_EVAL_EXEC — Python code block uses eval/exec

  Code block in references/data_management.md at line 441 contains potentially dangerous Python code. File: references/data_management.md:441 Remediation: Review the code block for security implications.

• 🔵 LOW LLM_COMMAND_INJECTION — Python eval/exec Usage in Code Examples

  Static analysis flagged multiple instances of eval/exec patterns in the markdown reference files. Upon review, these appear within legitimate educational code examples demonstrating PyTorch model training, ONNX export, and data processing workflows. The code blocks are documentation examples, not executable scripts bundled with the skill. However, if an agent were to execute these code blocks verbatim with user-supplied paths or parameters, the patterns could introduce risk depending on how user input is interpolated. File: references/machine_learning.md Remediation: The code examples are documentation-only and appear benign in context. No immediate remediation required. If the skill is extended to execute code blocks dynamically, ensure user-supplied inputs are validated and sanitized before use in any exec/eval context.

• 🟠 HIGH MDBLOCK_PYTHON_EVAL_EXEC — Python code block uses eval/exec

  Code block in references/machine_learning.md at line 228 contains potentially dangerous Python code. File: references/machine_learning.md:228 Remediation: Review the code block for security implications.

• 🟠 HIGH MDBLOCK_PYTHON_EVAL_EXEC — Python code block uses eval/exec

  Code block in references/machine_learning.md at line 498 contains potentially dangerous Python code. File: references/machine_learning.md:498 Remediation: Review the code block for security implications.

• 🟠 HIGH MDBLOCK_PYTHON_EVAL_EXEC — Python code block uses eval/exec

  Code block in references/machine_learning.md at line 540 contains potentially dangerous Python code. File: references/machine_learning.md:540 Remediation: Review the code block for security implications.

• 🔵 LOW LLM_DATA_EXFILTRATION — Remote API Call in SegmentMIFRemote Documentation

  The multiparametric reference documents a SegmentMIFRemote transform that sends image data to an external DeepCell cloud API (https://deepcell.org/api/predict). While this is a documented, legitimate third-party service for cell segmentation, users should be aware that slide image data (potentially containing patient-identifiable information) would be transmitted to an external server. This is presented as an optional alternative to local GPU inference. File: references/multiparametric.md Remediation: Add a prominent warning in the documentation that SegmentMIFRemote transmits image data to an external server. Users working with patient data should ensure compliance with applicable privacy regulations (HIPAA, GDPR) before using remote inference. Prefer local SegmentMIF for sensitive data.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing allowed-tools Manifest Field

  The YAML manifest does not specify the 'allowed-tools' field. While this field is optional per the agent skills spec, its absence means there are no declared restrictions on which agent tools this skill may invoke. Given the skill instructs the agent to install packages and execute Python code, declaring allowed tools would improve transparency and reduce the risk of unintended tool use. File: SKILL.md Remediation: Add an explicit 'allowed-tools' field to the YAML frontmatter listing only the tools required (e.g., [Python, Bash]) to constrain the agent's tool usage surface.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Package Installation in Skill Instructions

  The SKILL.md instructs users to install Polars using 'uv pip install polars' without specifying a version pin. This means the agent will always install the latest version, which could introduce breaking changes or, in a supply chain attack scenario, a compromised version of the package. File: SKILL.md Remediation: Pin the package to a specific known-good version, e.g., 'uv pip install polars==1.x.x'. Document the tested version in the skill manifest.

• 🔵 LOW LLM_COMMAND_INJECTION — Static Analyzer Flag: eval/exec Usage in Code Blocks

  The static pre-scan flagged a Python code block containing eval/exec patterns. After manual review of all referenced files, no actual use of eval() or exec() with user-controlled input was found in the skill's reference documentation. The flag likely refers to illustrative code examples (e.g., map_elements with lambdas, or query plan inspection). No exploitable injection vector was identified, but the presence of such patterns in instructional code warrants documentation. File: references/best_practices.md Remediation: No immediate action required. Ensure that any future code examples involving eval/exec are clearly marked as anti-patterns and not as recommended usage patterns.

• 🟠 HIGH MDBLOCK_PYTHON_EVAL_EXEC — Python code block uses eval/exec

  Code block in references/operations.md at line 531 contains potentially dangerous Python code. File: references/operations.md:531 Remediation: Review the code block for security implications.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing allowed-tools and compatibility Metadata

  The SKILL.md manifest does not specify the 'allowed-tools' or 'compatibility' fields. While these are optional per the agent skills specification, their absence means there are no declared restrictions on which agent tools this skill may invoke. The skill executes Python scripts that could use GPU/CPU resources extensively during training runs. File: SKILL.md Remediation: Consider adding 'allowed-tools: [Python, Read]' and a compatibility statement to the manifest to clearly document the skill's intended tool usage scope and supported environments.

• 🔵 LOW LLM_COMMAND_INJECTION — eval/exec Usage Flagged by Static Analyzer in Documentation Code Blocks

  The static pre-scan flagged a potential eval/exec usage within Python code blocks. After thorough review of all script files (template_lightning_module.py, template_datamodule.py, quick_trainer_setup.py) and all referenced markdown documentation files, no actual eval(), exec(), or os.system() calls with user-controlled input were found. The flag appears to be a false positive likely triggered by code examples within markdown documentation blocks (e.g., references/best_practices.md, references/callbacks.md) that discuss PyTorch/Lightning patterns. No exploitable command injection vector was identified. File: references/best_practices.md Remediation: No immediate action required. If documentation examples include eval/exec for illustrative purposes, add clear warnings that these patterns should not be used with untrusted input in production code.

• 🟠 HIGH MDBLOCK_PYTHON_EVAL_EXEC — Python code block uses eval/exec

  Code block in references/lightning_module.md at line 444 contains potentially dangerous Python code. File: references/lightning_module.md:444 Remediation: Review the code block for security implications.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing allowed-tools and compatibility Metadata

  The skill manifest does not specify allowed-tools or compatibility fields. While these are optional per the agent skills specification, their absence means there are no declared restrictions on what tools the agent may use when executing this skill. The skill instructs users to run pip install commands and execute Python code, which implies Bash and Python tool usage, but this is not declared. File: SKILL.md Remediation: Add allowed-tools: [Bash, Python] and a compatibility field to the YAML frontmatter to clearly declare the skill's tool requirements and supported environments.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Package Installation

  The SKILL.md instructions recommend installing qutip and optional packages using uv pip install qutip without version pinning. This exposes users to supply chain risks where a compromised or malicious version of the package could be installed. While qutip is a well-known legitimate scientific library, the lack of version pinning is a security hygiene concern. File: SKILL.md Remediation: Pin package versions explicitly, e.g., uv pip install qutip==5.0.4. Consider providing a requirements.txt or pyproject.toml with pinned dependencies and hash verification.

• 🔵 LOW LLM_COMMAND_INJECTION — Use of eval/exec in Code Examples

  The static analyzer flagged a Python code block using eval/exec. Reviewing the referenced files, the only potentially relevant pattern is the use of dynamic function calls and lambda expressions in spectral density functions (e.g., lambda w: 0.1 * w if w > 0 else 0). These are standard Python patterns in the context of QuTiP's Bloch-Redfield solver and do not represent a direct eval/exec injection risk. No actual eval() or exec() calls were found in the reviewed content. This is a low-severity informational finding based on the static analyzer flag that warrants confirmation of the full file set. File: references/advanced.md Remediation: Verify no actual eval() or exec() calls exist in any unretrieved files (e.g., qutip.py, matplotlib.py, templates/, assets/ files that were not found). If eval/exec is present in missing files, replace with explicit function definitions and validate all inputs before use.

• 🟠 HIGH MDBLOCK_PYTHON_EVAL_EXEC — Python code block uses eval/exec

  Code block in references/visualization.md at line 197 contains potentially dangerous Python code. File: references/visualization.md:197 Remediation: Review the code block for security implications.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing allowed-tools Manifest Field

  The SKILL.md manifest does not specify the allowed-tools field. While this is optional per the agent skills specification, the skill instructs the agent to execute Python code, generate files (LaTeX documents, C code files), and potentially run compilation steps (autowrap, ufuncify). Declaring allowed tools would improve transparency about the skill's intended capabilities and help agents enforce appropriate boundaries. File: SKILL.md Remediation: Add allowed-tools: [Python] or appropriate tool declarations to the SKILL.md YAML frontmatter to clearly communicate the skill's intended tool usage scope.

• 🔵 LOW LLM_COMMAND_INJECTION — User Input Parsing Without Sanitization Warning in Code Examples

  The references/code-generation-printing.md file contains a code pattern (Pattern 3: Interactive Computation) that reads user input via input(), parses it with parse_expr(), and evaluates it as a SymPy expression. The file itself notes 'When parsing user input, validate and sanitize to avoid code injection vulnerabilities' but the example code does not demonstrate any sanitization. If an agent follows this pattern literally with untrusted user input, it could lead to code injection via SymPy's expression parser. File: references/code-generation-printing.md Remediation: Add input validation before calling parse_expr(). Use the local_dict and global_dict parameters of parse_expr() to restrict available symbols, or validate input against an allowlist of safe characters/patterns before parsing.

• 🔵 LOW LLM_COMMAND_INJECTION — srepr Output Can Be eval()'d - Potential Code Execution Note

  The references/code-generation-printing.md file explicitly documents that srepr() output 'can be eval()'ed to recreate the expression'. While this is a legitimate SymPy feature, the documentation in the skill normalizes the use of eval() on SymPy-generated strings. If an agent or user applies this pattern to untrusted input, it creates a code injection risk. The static analyzer also flagged eval/exec usage in Python code blocks. File: references/code-generation-printing.md Remediation: Add a warning note that eval() should only be used on trusted SymPy-generated strings, never on user-provided input. Recommend using parse_expr() with restricted namespaces instead of eval() for reconstructing expressions from strings.

• 🔵 LOW LLM_DATA_EXFILTRATION — File Write Operations in Code Examples Without Scope Limitation

  Multiple code examples in the reference files demonstrate writing files to the filesystem (output.tex, output.txt, output.py, document.tex, *.c files) without any path validation or scope limitation. While these are illustrative examples, an agent following these patterns could write files to arbitrary locations if user-controlled paths are used. File: references/code-generation-printing.md Remediation: Add guidance that file paths should be validated and restricted to safe directories. Avoid using user-controlled input directly in file paths. Consider using tempfile or restricting output to a designated working directory.

• 🟠 HIGH MDBLOCK_PYTHON_EVAL_EXEC — Python code block uses eval/exec

  Code block in references/code-generation-printing.md at line 204 contains potentially dangerous Python code. File: references/code-generation-printing.md:204 Remediation: Review the code block for security implications.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Over-Broad Skill Activation Triggers in Description

  The skill description contains an extensive list of trigger keywords and phrases designed to maximize activation across a very wide range of topics. Phrases like 'Even if the user just says graph learning or geometric deep learning, use this skill' explicitly instruct the agent to activate on vague, broad queries. While this is a legitimate GNN reference skill, the activation language is unusually aggressive and could cause the skill to intercept queries that might be better handled by other tools or the base model. File: SKILL.md Remediation: Narrow the activation description to core use cases. Avoid explicit instructions to activate on vague or tangential queries. Let the agent's natural routing decide when the skill is appropriate.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — No License or Version Pinning Guidance for Dependencies

  The skill instructs users to install torch_geometric and optional dependencies (pyg-lib, torch-scatter, torch-sparse, torch-cluster) without specifying version pins or integrity verification. The YAML manifest also lacks a license field. While this is common in tutorial-style skills, unpinned dependencies introduce supply chain risk if a malicious package version is published. File: SKILL.md Remediation: Recommend pinning dependency versions (e.g., torch_geometric==2.5.3) and verifying package integrity. Add a license field to the YAML manifest.

• 🔵 LOW LLM_UNAUTHORIZED_TOOL_USE — Multiple Referenced Files Not Found in Skill Package

  The SKILL.md references numerous files (assets/link_prediction.md, templates/heterogeneous.md, torch_geometric.py, torch.py, and many others) that were not found in the skill package. While the critical references (references/*.md) are present, missing files could cause the agent to fail silently or attempt to locate files outside the skill directory. The references to torch_geometric.py and torch.py are particularly notable as these could shadow actual Python library modules if they existed. File: SKILL.md Remediation: Remove references to non-existent files or add the missing files to the skill package. Rename any files that could shadow Python standard library or popular package names (torch.py, torch_geometric.py).

• 🟠 HIGH MDBLOCK_PYTHON_EVAL_EXEC — Python code block uses eval/exec

  Code block in SKILL.md at line 196 contains potentially dangerous Python code. File: SKILL.md:196 Remediation: Review the code block for security implications.

• 🔵 LOW LLM_COMMAND_INJECTION — eval/exec Usage in Illustrative Code Blocks (Static Scanner Alert)

  The static pre-scan flagged multiple Python code blocks containing eval/exec patterns. Upon review, these appear in educational/reference markdown files (references/custom_datasets.md, references/scaling.md, references/message_passing.md) as legitimate PyTorch/PyG API usage examples (e.g., torch.no_grad(), model.eval(), etc.). The 'eval' references are PyTorch's model.eval() method, not Python's built-in eval() function. No actual dangerous eval/exec injection patterns were found. This is a false positive from the static scanner, but noted for completeness. File: references/custom_datasets.md Remediation: No action required. The static scanner flagged model.eval() as a false positive. Confirm no actual Python built-in eval() or exec() calls exist with user-controlled input.

• 🔵 LOW LLM_DATA_EXFILTRATION — External URL in Dataset Download Example

  The references/custom_datasets.md file includes an example using download_url() with a placeholder external URL ('https://example.com/data.csv'). While this is clearly illustrative example code, skills that instruct agents to download from external URLs could be abused if a user substitutes a malicious URL. The risk is low given the educational context, but worth noting. File: references/custom_datasets.md Remediation: Add a comment in the example noting that URLs should be validated and trusted before use. Consider adding a note about verifying dataset sources.

• 🟠 HIGH MDBLOCK_PYTHON_EVAL_EXEC — Python code block uses eval/exec

  Code block in references/link_prediction.md at line 94 contains potentially dangerous Python code. File: references/link_prediction.md:94 Remediation: Review the code block for security implications.

• 🟠 HIGH MDBLOCK_PYTHON_EVAL_EXEC — Python code block uses eval/exec

  Code block in references/link_prediction.md at line 137 contains potentially dangerous Python code. File: references/link_prediction.md:137 Remediation: Review the code block for security implications.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing allowed-tools Metadata

  The skill does not specify the 'allowed-tools' field in its YAML manifest. While this field is optional per the agent skills specification, its absence means there are no declared restrictions on which agent tools (Read, Write, Bash, Python, etc.) can be invoked when this skill is active. Given the skill's legitimate purpose of guiding TorchDrug usage, this is a minor informational finding. File: SKILL.md Remediation: Consider adding 'allowed-tools: [Read]' to the YAML manifest since this skill primarily serves as a reference guide and does not require write, bash, or Python execution capabilities at the skill-manifest level.

• 🔵 LOW LLM_COMMAND_INJECTION — Python eval/exec Usage in Code Examples

  The static analyzer flagged a potential eval/exec usage in a Python code block within the referenced markdown files. After reviewing all available content, the code examples in the reference files (core_concepts.md, molecular_property_prediction.md, etc.) use standard PyTorch/TorchDrug APIs and do not contain actual eval() or exec() calls with user-controlled input. The flagged pattern appears to be a false positive from the static scanner. No actual command injection risk was identified in the reviewed content. File: references/core_concepts.md Remediation: No action required. The static scanner flag appears to be a false positive. Continue to avoid eval/exec with user-controlled input in any future code examples added to this skill.

• 🟠 HIGH MDBLOCK_PYTHON_EVAL_EXEC — Python code block uses eval/exec

  Code block in references/core_concepts.md at line 345 contains potentially dangerous Python code. File: references/core_concepts.md:345 Remediation: Review the code block for security implications.

• 🔵 LOW LLM_DATA_EXFILTRATION — Hugging Face Token Exposure Risk in Instructions

  The SKILL.md instructions include an example showing how to set a Hugging Face token as an environment variable with a placeholder value ('your_token_here'). While this is a documentation pattern, the instructions also reference login() prompts and token handling. If a user follows these instructions and the agent assists in setting tokens, there is a risk of token exposure in logs, command history, or agent context. File: SKILL.md Remediation: Add explicit warnings in the instructions about not hardcoding tokens in scripts, using secure credential storage (e.g., .env files excluded from version control), and avoiding logging token values.

• 🔵 LOW LLM_DATA_EXFILTRATION — Multiple Referenced Files Not Found

  Several files referenced in the SKILL.md instructions are not present in the skill package (e.g., templates/generation.md, assets/generation.md, templates/pipelines.md, transformers.py, huggingface_hub.py, and others). Missing files could indicate an incomplete package, or in a worst case, could be fetched from external sources at runtime. The missing transformers.py and huggingface_hub.py are particularly notable as Python files that could contain executable code. File: SKILL.md Remediation: Ensure all referenced files are included in the skill package. If files are intentionally absent, remove references to them from SKILL.md. Verify that the agent will not attempt to fetch missing files from external sources.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing allowed-tools Manifest Field

  The skill does not specify the allowed-tools field in its YAML manifest. While this field is optional per the agent skills specification, its absence means there are no declared restrictions on which agent tools (Read, Write, Bash, Python, etc.) this skill may use. Given that the skill instructs the agent to execute bash commands (pip installs) and Python code, declaring allowed-tools would improve transparency and security posture. File: SKILL.md Remediation: Add an explicit allowed-tools field to the YAML manifest listing the tools this skill requires (e.g., [Bash, Python, Read, Write]) to make capability boundaries clear and auditable.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Package Dependencies in Installation Instructions

  The installation instructions use unpinned package versions (e.g., 'uv pip install torch transformers datasets evaluate accelerate'). Without version pinning, the skill may install different package versions over time, potentially including compromised or incompatible versions. This is a supply chain risk. File: SKILL.md Remediation: Pin specific package versions in installation instructions (e.g., 'transformers==4.40.0') or provide a requirements.txt with pinned versions and hash verification to reduce supply chain risk.

• 🟠 HIGH MDBLOCK_PYTHON_EVAL_EXEC — Python code block uses eval/exec

  Code block in references/models.md at line 214 contains potentially dangerous Python code. File: references/models.md:214 Remediation: Review the code block for security implications.

• 🔵 LOW LLM_COMMAND_INJECTION — Use of eval/exec in Python Code Blocks

  The static analyzer flagged a Python code block using eval/exec within the skill's reference documentation. While the code blocks in the reference files appear to be legitimate instructional examples for the Hugging Face Transformers library (no direct malicious use of eval/exec was identified in the reviewed content), this pattern warrants attention as eval/exec can enable arbitrary code execution if user-controlled input is passed to these functions. File: references/training.md Remediation: Review all Python code blocks in reference files to ensure eval/exec usage (if any) does not incorporate unsanitized user input. Ensure the agent does not blindly execute code blocks from these reference files without validation.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Overly Broad Skill Activation Description

  The skill description contains extensive trigger keyword lists designed to maximize activation: 'Triggers on requests to search, look up, fetch a page, or extract an article.' The description is very broad, covering 'web search (semantic lookups, research, current info)' and 'URL extraction (fetching pages, articles, academic PDFs in batch)'. While this is not malicious, the description is crafted to maximize the skill's activation surface, which could lead to the skill being invoked in contexts where simpler built-in capabilities would suffice. File: SKILL.md Remediation: Narrow the activation description to more precisely describe when this skill should be preferred over built-in web capabilities. Avoid explicit trigger keyword enumeration in the description field.

• 🔵 LOW LLM_PROMPT_INJECTION — Indirect Prompt Injection Risk via Extracted Web Content

  The skill fetches and extracts full-text content from arbitrary external URLs and web pages (via exa_extract.py and exa_search.py with --text flag), then instructs the agent to parse and present that content verbatim. The references/web-extract.md explicitly instructs: 'Keep content verbatim — do not paraphrase or summarize' and 'Preserve all facts, names, numbers, dates, quotes'. Malicious web pages could embed prompt injection payloads in their content that the agent would then process and potentially act upon, since the agent is instructed to treat the extracted content with high fidelity. File: references/web-extract.md Remediation: Add explicit instructions to treat extracted web content as untrusted data, not as instructions. Instruct the agent to sanitize or flag any content that appears to contain instruction-like patterns before presenting it to the user. Consider adding a warning that extracted content should never be interpreted as agent instructions.

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/exa-search/scripts/exa_extract.py File: scientific-skills/exa-search/scripts/exa_extract.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/exa-search/scripts/exa_search.py File: scientific-skills/exa-search/scripts/exa_search.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Dependency Version Range

  The scripts declare a dependency on 'exa-py>=1.14.0' using a minimum-version constraint rather than an exact pinned version. This means future installs could pull in a newer, potentially compromised or breaking version of the exa-py package. While the risk is moderate given the package is from the skill's own author (Exa), unpinned dependencies are a supply chain hygiene concern. File: scripts/exa_search.py:5 Remediation: Pin the dependency to an exact version (e.g., 'exa-py==1.14.0') or use a hash-pinned lockfile. If flexibility is needed, use a narrow range (e.g., 'exa-py>=1.14.0,<2.0.0') and document the rationale.

• 🔵 LOW LLM_DATA_EXFILTRATION — Integration Tracking Header Sent to Third-Party Service

  Every script unconditionally sets the 'x-exa-integration' header to 'k-dense-ai--scientific-agent-skills' on all API requests. The SKILL.md explicitly instructs: 'Do not remove or rename this header when adapting the scripts.' While this appears to be legitimate usage attribution, it means all API calls are tagged and tracked by Exa, and users may not be aware their usage patterns are being attributed to a specific integration identifier. This is a transparency/privacy concern rather than a critical threat. File: scripts/exa_search.py:57 Remediation: Document clearly in the skill description that usage is tracked via this integration header. Allow users to opt out or customize the header. Remove the instruction prohibiting header modification, as it limits user control over their own API usage attribution.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Package Upgrade Pattern in Version Check Code

  The SKILL.md instructs the agent to run a version check that, if the installed version is older than required, executes 'pip3 install --upgrade --break-system-packages idc-index' without pinning to a specific version. While the required version is specified in the comparison, the upgrade command itself uses '--upgrade' without '==0.11.14', meaning it could install a newer (potentially compromised or breaking) version of idc-index rather than exactly the required version. The '--break-system-packages' flag is also notable as it bypasses system package manager protections. File: SKILL.md Remediation: Pin the installation to the exact required version: subprocess.run(["pip3", "install", "--break-system-packages", "idc-index==0.11.14"], check=True). This ensures reproducibility and prevents supply chain attacks via newer malicious package versions.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Optional Dependencies Installed Without Version Pins

  The SKILL.md recommends installing optional packages (pandas, numpy, pydicom) using 'pip install pandas numpy pydicom' without version pins. Unpinned installations are vulnerable to supply chain attacks where a malicious version of any of these packages could be installed. While these are well-known packages, best practice for agent skills is to pin all dependencies. File: SKILL.md Remediation: Pin all optional dependencies to specific known-good versions, e.g., 'pip install pandas==2.x.x numpy==1.x.x pydicom==2.x.x'. Reference the tested versions in the skill metadata.

• 🟡 MEDIUM MDBLOCK_PYTHON_SUBPROCESS — Python code block executes shell commands

  Code block in SKILL.md at line 21 contains potentially dangerous Python code. File: SKILL.md:21 Remediation: Review the code block for security implications.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned External Dependency Installed via Git Clone

  The SKILL.md instructions direct users to install the labarchives-py package directly from a GitHub repository without any version pinning, commit hash, or integrity verification. This exposes users to supply chain attacks if the repository is compromised or if the package is updated with malicious code. The same unpinned GitHub install URL appears in error messages within the scripts. File: SKILL.md Remediation: Pin to a specific commit hash or tag: git clone https://github.com/mcmero/labarchives-py && cd labarchives-py && git checkout <specific-commit-hash>. Alternatively, publish the package to PyPI with a pinned version and use pip install labarchives-py==<version>. Verify package integrity with checksums.

• 🟡 MEDIUM MDBLOCK_PYTHON_HTTP_POST — Python code block sends HTTP POST request

  Code block in references/api_reference.md at line 217 contains potentially dangerous Python code. File: references/api_reference.md:217 Remediation: Review the code block for security implications.

• 🔵 LOW LLM_DATA_EXFILTRATION — SSL Verification Disabled in Reference Documentation

  The authentication guide (references/authentication_guide.md) includes a code example that disables SSL certificate verification with verify=False. While labeled as 'use only for testing', this pattern is commonly copied into production code and could expose users to man-in-the-middle attacks when communicating with the LabArchives API, potentially allowing credential interception. File: references/authentication_guide.md Remediation: Remove the verify=False example entirely or replace it with proper SSL certificate handling (e.g., specifying a custom CA bundle with verify='/path/to/ca-bundle.crt'). Add a prominent warning that disabling SSL verification in production is a security vulnerability.

• 🔵 LOW LLM_DATA_EXFILTRATION — API Credentials Transmitted as URL Query Parameters

  The authentication guide shows API credentials (access_key_id, access_password, user email, and external password) being passed as URL query parameters in GET requests. Query parameters are logged in server access logs, browser history, proxy logs, and HTTP referrer headers, creating multiple vectors for credential exposure. File: references/authentication_guide.md Remediation: Use POST requests with credentials in the request body, or use HTTP Authorization headers. If the LabArchives API requires GET with query params, document the logging risk and recommend log sanitization. Avoid logging full URLs that contain credentials.

• 🟡 MEDIUM MDBLOCK_PYTHON_HTTP_POST — Python code block sends HTTP POST request

  Code block in references/integrations.md at line 93 contains potentially dangerous Python code. File: references/integrations.md:93 Remediation: Review the code block for security implications.

• 🟡 MEDIUM MDBLOCK_PYTHON_HTTP_POST — Python code block sends HTTP POST request

  Code block in references/integrations.md at line 309 contains potentially dangerous Python code. File: references/integrations.md:309 Remediation: Review the code block for security implications.

• 🔵 LOW LLM_DATA_EXFILTRATION — Access Credentials Included in Multipart Upload Request Body

  In entry_operations.py and the API reference, the access_key_id and access_password are included in the multipart form data body of file upload requests. While better than URL parameters, these credentials are still transmitted in plaintext form fields and may be logged by intermediate proxies or the server. File: scripts/entry_operations.py Remediation: Use HTTP Authorization headers (Bearer token or Basic auth) for credential transmission rather than embedding credentials in request body fields. If the LabArchives API requires this pattern, document the risk and ensure HTTPS is always enforced.

• 🔵 LOW LLM_DATA_EXFILTRATION — Credentials Stored in Plaintext YAML Configuration File

  The setup_config.py script collects sensitive credentials (access_key_id, access_password, user_email, user_external_password) and writes them to a plaintext config.yaml file. While file permissions are set to 0o600, the credentials remain unencrypted on disk. The authentication guide also shows credentials hardcoded in R code examples. If the config.yaml file is accidentally committed to version control or accessed by another process, credentials are fully exposed. File: scripts/setup_config.py Remediation: Recommend using OS keychain/secret managers (e.g., keyring library, AWS Secrets Manager, system keychain) instead of plaintext YAML. Enforce that config.yaml is added to .gitignore. Consider encrypting the config file at rest. The skill already mentions environment variables as an alternative — make this the primary recommendation.

• 🔵 LOW LLM_DATA_EXFILTRATION — API Key Exposed in Example Code

  The SKILL.md Quick Start section contains a Python code example that shows an API key being passed directly in the request body with a placeholder value 'sk-...'. While this is a placeholder and not a real key, it demonstrates a pattern that could encourage users to hardcode real API keys in scripts. The example does not include guidance on using environment variables for the api_key field. File: SKILL.md Remediation: Update the example to show loading the API key from an environment variable (e.g., os.getenv('OPENAI_API_KEY')) rather than a hardcoded placeholder, to encourage secure practices.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing allowed-tools Manifest Field

  The SKILL.md YAML frontmatter does not specify the 'allowed-tools' field. While this field is optional per the agent skills specification, its absence means there are no declared restrictions on which agent tools this skill may invoke. The skill's scripts make network requests and file I/O operations, so declaring allowed tools would improve transparency. File: SKILL.md Remediation: Add an 'allowed-tools' field to the YAML frontmatter listing the tools actually used by this skill (e.g., [Python, Bash]) to improve transparency and allow agents to enforce restrictions.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing Compatibility Field in Manifest

  The SKILL.md YAML frontmatter does not specify the 'compatibility' field. This field helps users understand which agent environments the skill is compatible with. Its absence reduces transparency about the skill's intended deployment context. File: SKILL.md Remediation: Add a 'compatibility' field to the YAML frontmatter specifying which agent environments this skill supports (e.g., 'Works with Claude.ai, Claude Code, API').

• 🟡 MEDIUM MDBLOCK_PYTHON_HTTP_POST — Python code block sends HTTP POST request

  Code block in SKILL.md at line 61 contains potentially dangerous Python code. File: SKILL.md:61 Remediation: Review the code block for security implications.

• 🟡 MEDIUM MDBLOCK_PYTHON_HTTP_POST — Python code block sends HTTP POST request

  Code block in SKILL.md at line 92 contains potentially dangerous Python code. File: SKILL.md:92 Remediation: Review the code block for security implications.

• 🟡 MEDIUM MDBLOCK_PYTHON_HTTP_POST — Python code block sends HTTP POST request

  Code block in SKILL.md at line 105 contains potentially dangerous Python code. File: SKILL.md:105 Remediation: Review the code block for security implications.

• 🟡 MEDIUM MDBLOCK_PYTHON_HTTP_POST — Python code block sends HTTP POST request

  Code block in SKILL.md at line 126 contains potentially dangerous Python code. File: SKILL.md:126 Remediation: Review the code block for security implications.

• 🟡 MEDIUM MDBLOCK_PYTHON_HTTP_POST — Python code block sends HTTP POST request

  Code block in SKILL.md at line 139 contains potentially dangerous Python code. File: SKILL.md:139 Remediation: Review the code block for security implications.

• 🟡 MEDIUM MDBLOCK_PYTHON_HTTP_POST — Python code block sends HTTP POST request

  Code block in SKILL.md at line 157 contains potentially dangerous Python code. File: SKILL.md:157 Remediation: Review the code block for security implications.

• 🟡 MEDIUM MDBLOCK_PYTHON_HTTP_POST — Python code block sends HTTP POST request

  Code block in SKILL.md at line 174 contains potentially dangerous Python code. File: SKILL.md:174 Remediation: Review the code block for security implications.

• 🟡 MEDIUM MDBLOCK_PYTHON_HTTP_POST — Python code block sends HTTP POST request

  Code block in SKILL.md at line 194 contains potentially dangerous Python code. File: SKILL.md:194 Remediation: Review the code block for security implications.

• 🔵 LOW LLM_COMMAND_INJECTION — Static Analyzer Flag: eval/exec in Python Code Block

  The static pre-scan flagged a MDBLOCK_PYTHON_EVAL_EXEC finding, indicating a Python code block uses eval or exec. After reviewing all provided Python scripts and SKILL.md code blocks, no actual use of eval() or exec() was found in the provided content. This may be a false positive from the static analyzer, or it may refer to content in referenced files not fully provided (e.g., references/configuration.md, references/architecture.md, references/examples.md). The finding is noted for completeness but could not be confirmed from the provided content. File: references/configuration.md Remediation: Review all Python code blocks across all skill files (including unreferenced files like references/examples.md) for any use of eval() or exec() with user-controlled input. If found, replace with safe alternatives.

• 🟡 MEDIUM MDBLOCK_PYTHON_HTTP_POST — Python code block sends HTTP POST request

  Code block in references/configuration.md at line 116 contains potentially dangerous Python code. File: references/configuration.md:116 Remediation: Review the code block for security implications.

• 🟡 MEDIUM MDBLOCK_PYTHON_HTTP_POST — Python code block sends HTTP POST request

  Code block in references/examples.md at line 17 contains potentially dangerous Python code. File: references/examples.md:17 Remediation: Review the code block for security implications.

• 🟡 MEDIUM MDBLOCK_PYTHON_HTTP_POST — Python code block sends HTTP POST request

  Code block in references/examples.md at line 98 contains potentially dangerous Python code. File: references/examples.md:98 Remediation: Review the code block for security implications.

• 🟡 MEDIUM MDBLOCK_PYTHON_HTTP_POST — Python code block sends HTTP POST request

  Code block in references/examples.md at line 136 contains potentially dangerous Python code. File: references/examples.md:136 Remediation: Review the code block for security implications.

• 🟡 MEDIUM MDBLOCK_PYTHON_HTTP_POST — Python code block sends HTTP POST request

  Code block in references/examples.md at line 182 contains potentially dangerous Python code. File: references/examples.md:182 Remediation: Review the code block for security implications.

• 🟡 MEDIUM MDBLOCK_PYTHON_HTTP_POST — Python code block sends HTTP POST request

  Code block in references/examples.md at line 231 contains potentially dangerous Python code. File: references/examples.md:231 Remediation: Review the code block for security implications.

• 🟡 MEDIUM MDBLOCK_PYTHON_HTTP_POST — Python code block sends HTTP POST request

  Code block in references/examples.md at line 277 contains potentially dangerous Python code. File: references/examples.md:277 Remediation: Review the code block for security implications.

• 🔵 LOW LLM_DATA_EXFILTRATION — Missing License and Compatibility Metadata

  The skill manifest does not specify a license or compatibility field. While not a direct security threat, missing provenance information reduces transparency and auditability of the skill package. File: SKILL.md Remediation: Add a valid SPDX license identifier (e.g., 'MIT', 'Apache-2.0') and specify compatibility (e.g., 'Claude.ai, Claude Code, API') in the YAML frontmatter.

• 🔵 LOW LLM_DATA_EXFILTRATION — Referenced Files Not Found (ete3.py, matplotlib.py)

  The SKILL.md instructions reference 'ete3.py' and 'matplotlib.py' as files, but these files are not present in the skill package. These appear to be misidentified Python library imports rather than actual skill files. However, if these were intended as bundled scripts, their absence creates an incomplete and potentially unsafe skill package. File: SKILL.md Remediation: Clarify whether these are intended as bundled files or library imports. If they are library imports, remove them from the referenced files list. Ensure all referenced files are present in the skill package.

• 🔵 LOW LLM_UNAUTHORIZED_TOOL_USE — Missing allowed-tools Declaration

  The skill does not declare an allowed-tools field in its YAML manifest. The skill executes subprocess calls to external binaries (mafft, iqtree2, FastTree) and performs file I/O. Without an explicit allowed-tools declaration, the agent's tool usage is unconstrained and unauditable. File: SKILL.md Remediation: Add 'allowed-tools: [Bash, Python, Read, Write]' to the YAML frontmatter to explicitly declare the tools this skill requires.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Dependency Installation Instructions

  The skill instructs users to install dependencies without version pinning. This exposes the environment to supply chain attacks where a compromised or malicious package version could be installed. File: SKILL.md:18 Remediation: Pin all dependencies to specific versions (e.g., 'pip install ete3==3.1.3') and use checksums or lock files where possible. Document the expected versions in the skill manifest.

• 🟡 MEDIUM MDBLOCK_PYTHON_SUBPROCESS — Python code block executes shell commands

  Code block in SKILL.md at line 67 contains potentially dangerous Python code. File: SKILL.md:67 Remediation: Review the code block for security implications.

• 🟡 MEDIUM MDBLOCK_PYTHON_SUBPROCESS — Python code block executes shell commands

  Code block in SKILL.md at line 100 contains potentially dangerous Python code. File: SKILL.md:100 Remediation: Review the code block for security implications.

• 🟡 MEDIUM MDBLOCK_PYTHON_SUBPROCESS — Python code block executes shell commands

  Code block in SKILL.md at line 143 contains potentially dangerous Python code. File: SKILL.md:143 Remediation: Review the code block for security implications.

• 🟡 MEDIUM MDBLOCK_PYTHON_SUBPROCESS — Python code block executes shell commands

  Code block in SKILL.md at line 198 contains potentially dangerous Python code. File: SKILL.md:198 Remediation: Review the code block for security implications.

• 🔵 LOW LLM_RESOURCE_ABUSE — Unbounded Compute Resource Usage Without Limits

  The pipeline runs computationally intensive tools (MAFFT, IQ-TREE 2 with 1000 bootstrap replicates) without any timeout, resource limits, or user confirmation for large datasets. For very large inputs, this could exhaust CPU and memory resources for extended periods. File: scripts/phylogenetic_analysis.py:97 Remediation: Add timeout parameters to subprocess.run calls (e.g., timeout=3600), validate input file size before processing, and warn users when datasets exceed recommended thresholds. Consider adding a --max-sequences guard.

• 🔵 LOW LLM_DATA_EXFILTRATION — Missing License and Compatibility Metadata

  The skill manifest does not specify a license or compatibility field. The license is listed as 'Unknown' and compatibility is 'Not specified'. This missing provenance information makes it difficult to assess the trustworthiness and intended deployment context of the skill. Additionally, no allowed-tools field is specified, meaning the skill could invoke any agent tool without declared restrictions. File: SKILL.md Remediation: Add a valid SPDX license identifier, specify compatibility (e.g., Claude.ai, Claude Code), and declare allowed-tools to restrict the agent's tool usage to only what is necessary for the skill's functionality.

• 🔵 LOW LLM_DATA_EXFILTRATION — Access Token Handling Guidance Encourages Insecure Patterns

  The skill instructions and reference files repeatedly use placeholder patterns like 'YOUR_ACCESS_TOKEN' in code examples without sufficient guardrails. The authentication reference notes tokens should not be stored in code or version control, but the SKILL.md itself embeds token usage patterns in Python code blocks that could be copied verbatim by users. The skill instructs the agent to handle OAuth client secrets and refresh tokens, which are highly sensitive credentials. There is no guidance on using environment variables or secret managers for token storage in the agent context. File: SKILL.md Remediation: Add explicit guidance to use environment variables (e.g., os.environ.get('PROTOCOLS_IO_TOKEN')) rather than hardcoded strings. Include warnings about never logging or displaying tokens. Reference secure credential storage patterns appropriate for the agent's execution environment.

• 🔵 LOW LLM_DATA_EXFILTRATION — Missing Referenced Files May Lead to Undefined Behavior

  Multiple referenced files are listed as not found (assets/file_manager.md, assets/authentication.md, assets/additional_features.md, templates/workspaces.md, templates/additional_features.md, assets/protocols_api.md, templates/protocols_api.md, templates/authentication.md, assets/discussions.md, assets/workspaces.md, templates/discussions.md, templates/file_manager.md). The skill instructions direct the agent to read these files for specific functionality. When the agent attempts to read missing files, it may fall back to improvising behavior or fail silently, potentially leading to incorrect API usage or security misconfigurations. File: SKILL.md Remediation: Ensure all referenced files exist within the skill package. Remove references to non-existent files or add the missing files. Implement graceful handling when reference files are not found.

• 🔵 LOW LLM_RESOURCE_ABUSE — Retry Logic Without Maximum Backoff Cap

  The error handling example in SKILL.md implements exponential backoff for rate limit and server errors, but the retry logic uses 'time.sleep(retry_after)' where retry_after comes from the server response header without validation or capping. A malicious or misconfigured server could return an arbitrarily large Retry-After value, causing the agent to sleep indefinitely. Additionally, the exponential backoff (2^attempt) is not capped, though with max_retries=3 this is limited in practice. File: SKILL.md Remediation: Cap the retry_after value to a reasonable maximum (e.g., min(retry_after, 300)). Add a maximum backoff cap for exponential backoff. Validate that retry_after is a positive integer before sleeping.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Over-Broad Capability Description Enabling Excessive Activation

  The skill description is extremely broad, covering protocol discovery, creation, updating, publishing, step management, materials, discussions, workspaces, file management, experiment tracking, and integration projects. While this matches the actual documented functionality, the breadth of the description could cause the skill to be activated in a wide range of scenarios, some of which may not require full API access. The description also lacks specificity about what user data or credentials are required, potentially leading users to provide sensitive tokens without understanding the scope. File: SKILL.md Remediation: Narrow the description to specific use cases. Consider splitting into multiple focused skills (e.g., read-only protocol search vs. write operations). Clearly document what credentials are required and their scope.

• 🟡 MEDIUM MDBLOCK_PYTHON_HTTP_POST — Python code block sends HTTP POST request

  Code block in SKILL.md at line 283 contains potentially dangerous Python code. File: SKILL.md:283 Remediation: Review the code block for security implications.

• 🟡 MEDIUM MDBLOCK_PYTHON_HTTP_POST — Python code block sends HTTP POST request

  Code block in SKILL.md at line 310 contains potentially dangerous Python code. File: SKILL.md:310 Remediation: Review the code block for security implications.

• 🔵 LOW LLM_DATA_EXFILTRATION — Missing allowed-tools Declaration

  The skill manifest does not declare an 'allowed-tools' field. The scripts use Python execution, file I/O (reading structure files, writing output files), and network access (Materials Project API). Without an explicit allowed-tools declaration, the agent has no manifest-level constraint on what tools it may use. This is informational per the skill spec (allowed-tools is optional), but worth noting given the network access involved. File: SKILL.md Remediation: Consider adding 'allowed-tools: [Python, Bash]' to the YAML frontmatter to explicitly document the tools this skill requires, improving transparency for users reviewing the skill manifest.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Package Dependencies

  The SKILL.md installation instructions use unpinned package versions (e.g., 'uv pip install pymatgen', 'uv pip install mp-api'). Without version pinning, the skill may install any available version of these packages, including potentially compromised future versions. The skill mentions 'pymatgen >= 2023.x' as a requirement but does not enforce this in installation commands. This is a supply chain risk, though low severity for a well-known scientific library. File: SKILL.md Remediation: Pin specific versions in installation instructions, e.g., 'uv pip install pymatgen==2024.6.10 mp-api==0.41.2'. Consider providing a requirements.txt or pyproject.toml with pinned dependencies for reproducibility and supply chain security.

• 🟡 MEDIUM BEHAVIOR_ENV_VAR_HARVESTING — Environment variable harvesting detected

  Script iterates through environment variables in scientific-skills/pymatgen/scripts/phase_diagram_generator.py File: scientific-skills/pymatgen/scripts/phase_diagram_generator.py Remediation: Remove environment variable collection unless explicitly required and documented

• 🔵 LOW LLM_DATA_EXFILTRATION — API Key Accessed from Environment Variable and Passed to External Service

  The phase_diagram_generator.py script reads the MP_API_KEY environment variable and passes it directly to MPRester for authentication with the Materials Project API. While this is a legitimate and documented workflow for the Materials Project API, the static analyzer flagged this as a potential env var exfiltration chain because the key is read from the environment and then used in network calls. In this context, the behavior is expected and benign — the API key is used solely to authenticate with the official Materials Project service (materialsproject.org), not exfiltrated to a third-party server. No hardcoded secrets are present. The risk is LOW because the key is properly sourced from an environment variable (not hardcoded), and the destination is the legitimate Materials Project API. File: scripts/phase_diagram_generator.py:44 Remediation: This is expected behavior for Materials Project API usage. Ensure users are aware that their MP_API_KEY is transmitted to materialsproject.org. Consider documenting this clearly in the skill description. No code changes required, but confirm MPRester only connects to the official Materials Project endpoint.

• 🔵 LOW LLM_DATA_EXFILTRATION — Missing License and Compatibility Metadata

  The skill does not specify a license or compatibility field in the YAML frontmatter. While these are optional fields, their absence reduces transparency about the skill's provenance, intended deployment environments, and usage rights. The author is listed as 'K-Dense, Inc.' but no version or license is declared, making it harder to audit or govern the skill in enterprise environments. File: SKILL.md Remediation: Add license, compatibility, and allowed-tools fields to the YAML frontmatter to improve transparency and governance. Example: license: MIT, compatibility: Claude.ai, Claude Code, allowed-tools: [Python, Bash].

• 🔵 LOW LLM_PROMPT_INJECTION — Referenced External Files Not Found (Potential Broken Trust Chain)

  The SKILL.md references several files (adaptyv.py, templates/api-endpoints.md, assets/api-endpoints.md) that were not found in the skill package. While references/api-endpoints.md was found and appears benign, the missing files could represent incomplete packaging or, in a worst case, placeholders intended to be populated with external or user-supplied content at runtime. If the agent attempts to load these missing files from user-provided paths or external sources, this could introduce indirect prompt injection risk. File: SKILL.md Remediation: Ensure all referenced files are bundled within the skill package. Remove references to files that do not exist, or document clearly that they are optional. Do not allow the agent to substitute user-provided or externally-fetched files for missing skill resources.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Over-Broad Skill Activation Triggers in Description

  The skill description contains an extensive list of activation triggers including generic code patterns (imports of adaptyv, adaptyv_sdk, FoundryClient), domain-specific keywords (BLI/SPR assays, thermostability, protein binding), and URL references. While these are plausibly legitimate for a domain-specific skill, the breadth of triggers could cause the skill to activate in contexts where it is not needed, potentially displacing other more appropriate skills or consuming agent context unnecessarily. File: SKILL.md Remediation: Narrow activation triggers to the most specific and unambiguous signals (e.g., explicit Adaptyv API usage). Avoid triggering on generic scientific terms like 'thermostability assays' that may appear in unrelated contexts.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing allowed-tools Specification

  The skill manifest does not specify the 'allowed-tools' field. While this field is optional per the agent skills spec, its absence means there are no declared restrictions on which agent tools (Read, Write, Bash, Python, etc.) this skill may use. Given the skill instructs installation of packages and execution of Python code, documenting allowed tools would improve transparency. File: SKILL.md Remediation: Add an explicit 'allowed-tools' field to the YAML frontmatter, e.g., 'allowed-tools: [Python, Bash]' to document the expected tool usage scope.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing Compatibility Specification

  The skill manifest does not specify the 'compatibility' field, leaving it unclear which agent environments or platforms this skill is designed to work with. This is a minor documentation gap. File: SKILL.md Remediation: Add a 'compatibility' field to the YAML frontmatter specifying supported environments (e.g., 'Works in Claude.ai, Claude Code, API').

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Package Installation

  The skill instructs installation of the 'aeon' package without pinning to a specific version. This creates a supply chain risk where a future compromised or breaking version of the package could be installed automatically. File: SKILL.md Remediation: Pin the package to a specific known-good version, e.g., 'uv pip install aeon==0.9.0' or use a requirements file with pinned versions and hash verification.

• 🔵 LOW LLM_UNAUTHORIZED_TOOL_USE — Multiple Referenced Files Not Found

  The skill references numerous files in its instructions (assets/, templates/ directories, and standalone files like aeon.py, sklearn.py, matplotlib.py) that were not found in the skill package. This creates uncertainty about the skill's actual behavior when those references are followed, and could lead to errors or unexpected behavior if the agent attempts to access them. File: SKILL.md Remediation: Ensure all referenced files are included in the skill package, or remove references to files that do not exist. Audit the file manifest to confirm completeness before distribution.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing allowed-tools and compatibility metadata

  The SKILL.md manifest does not specify 'allowed-tools' or 'compatibility' fields. While these are optional per the agent skills spec, their absence means there are no declared restrictions on which agent tools this skill may invoke, reducing transparency about the skill's intended operational scope. File: SKILL.md Remediation: Add 'allowed-tools' to the YAML frontmatter listing the tools actually used (e.g., Bash, Python) and specify compatibility information to improve transparency and allow agents to enforce tool restrictions.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Over-Broad Capability Description May Trigger Unnecessary Activation

  The skill description is very comprehensive and lists a wide range of astronomical tasks. While this is largely accurate for the astropy library, the breadth of the description (coordinate transformations, unit conversions, FITS file manipulation, cosmological distance calculations, time scale conversions, astronomical data processing) could cause the skill to be activated for a wide variety of astronomy-adjacent queries that may not require it. This is a minor concern and not a significant threat. File: SKILL.md Remediation: Consider narrowing the description to the most common use cases to reduce unnecessary activation. This is a low-priority concern.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Package Installation Instructions

  The installation instructions use 'uv pip install astropy' and 'uv pip install astropy[all]' without specifying a version pin. This means the installed version could change over time, potentially introducing breaking changes or security vulnerabilities from a compromised package version. File: SKILL.md Remediation: Pin the astropy version in installation instructions, e.g., 'uv pip install astropy==6.1.0'. This ensures reproducibility and reduces supply chain risk.

• 🔵 LOW LLM_DATA_EXFILTRATION — Remote File Access Capability Without Explicit Disclosure

  The FITS handling reference documentation explicitly describes accessing remote FITS files via S3 and HTTP URLs using fsspec. While this is a legitimate feature of astropy, the skill manifest does not disclose network access capabilities. Users may not be aware that FITS operations could involve fetching data from remote sources. The skill also references EarthLocation.of_site() and SkyCoord.from_name() which make network requests to online databases. File: references/fits.md Remediation: Add a note in the skill manifest or instructions that certain operations (remote FITS access, named object lookup, observatory site lookup) require network access. Consider adding this to the compatibility or description fields.

• 🔵 LOW LLM_DATA_EXFILTRATION — Missing License Information

  The skill manifest does not specify a license, making it unclear what terms govern its use. This is a minor metadata issue but could affect trust assessment. File: SKILL.md Remediation: Add a proper license field to the YAML frontmatter (e.g., MIT, Apache-2.0).

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing allowed-tools Declaration

  The skill does not declare an allowed-tools field in its YAML manifest. While optional per spec, this means there are no declared restrictions on what agent tools can be used, which reduces transparency about the skill's intended scope. File: SKILL.md Remediation: Add an explicit allowed-tools field to the YAML frontmatter listing only the tools required for the skill's functionality.

• 🔵 LOW LLM_DATA_EXFILTRATION — Missing Compatibility Metadata

  The skill does not specify a compatibility field, which is a minor documentation gap. More importantly, the skill connects to an external remote MCP server (https://bgpt.pro/mcp/sse) and may transmit user search queries to that server. Users may not be aware their queries are sent to a third-party service. File: SKILL.md Remediation: Add compatibility metadata. Explicitly disclose in the skill description that user search queries are transmitted to the external bgpt.pro server, so users can make informed decisions about data privacy.

• 🔵 LOW LLM_DATA_EXFILTRATION — External Remote MCP Server - Third-Party Data Transmission

  All search queries are transmitted to the external server at https://bgpt.pro/mcp/sse. The skill provides no information about data retention, privacy policy, or what data the remote server logs. User research queries (which may contain sensitive research topics or proprietary information) are sent to a third-party service outside the user's control. File: SKILL.md Remediation: Add a privacy disclosure section to the skill documentation explaining what data is transmitted to bgpt.pro, link to the service's privacy policy, and warn users not to include sensitive or proprietary information in search queries.

• 🔵 LOW LLM_DATA_EXFILTRATION — Static Analysis Flags: Environment Variable Access with Network Calls in Unreferenced Python Files

  The pre-scan static analysis detected multiple behavioral signals across 23 Python files in the skill package: environment variable access combined with network calls (BEHAVIOR_ENV_VAR_EXFILTRATION in multiple files), a cross-file exfiltration chain spanning 8 files, and cross-file environment variable exfiltration across 7 files. However, the skill manifest reports 'No script files found' in the provided content, suggesting these Python files may be part of the bgpt-mcp npm package dependency rather than directly bundled skill scripts. Without access to the actual Python file contents, the severity cannot be fully assessed, but the pattern is concerning and warrants review. File: SKILL.md Remediation: Audit all 23 Python files detected in the skill package. Identify which environment variables are being accessed and what network endpoints they are transmitted to. If these files belong to the bgpt-mcp npm dependency, review the package source on GitHub (https://github.com/connerlambden/bgpt-mcp) to verify legitimacy. Ensure no credentials, API keys, or sensitive environment variables are being exfiltrated to external servers beyond the stated bgpt.pro endpoint.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Over-Broad Capability Claims in Description

  The skill description claims to return '25+ fields per paper' and positions itself as a comprehensive research tool. While this may be accurate, the description is marketing-heavy and cannot be verified from the provided skill content alone. The skill delegates all actual functionality to an external MCP server (bgpt.pro), meaning the agent has no visibility into what the remote server actually does or returns. File: SKILL.md Remediation: Clarify in the description that all data processing occurs on a remote third-party server and that the agent cannot verify the completeness or accuracy of returned fields.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned External Package Dependency (npx mcp-remote)

  The skill instructs users to run 'npx mcp-remote' and 'npx bgpt-mcp' without version pinning. Using unpinned npx commands means the latest version of these packages is fetched at runtime, which could introduce supply chain risks if the packages are compromised or updated with malicious code. File: SKILL.md Remediation: Pin specific versions of the npm packages (e.g., 'npx mcp-remote@1.2.3' and 'npx bgpt-mcp@x.y.z') to ensure reproducible and auditable behavior. Reference the GitHub repository for verified release hashes.

• 🔵 LOW LLM_DATA_EXFILTRATION — Missing allowed-tools Declaration in Manifest

  The SKILL.md manifest does not declare an 'allowed-tools' field. While this field is optional per the agent skills spec, the skill installs packages, makes network requests (in update_schema.py), and writes files. Declaring allowed tools would improve transparency about the skill's capabilities. File: SKILL.md Remediation: Add an explicit 'allowed-tools' field to the YAML frontmatter listing the tools actually used, e.g., allowed-tools: [Bash, Python, Read, Write].

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Package Installations in Installation Instructions

  The SKILL.md installation section uses 'uv pip install' without version pins for multiple packages (pybids, bids-validator-deno, heudiconv, dcm2bids, nibabel, pydicom). Unpinned dependencies are vulnerable to supply chain attacks where a malicious version of a package could be installed. File: SKILL.md Remediation: Pin package versions explicitly (e.g., 'uv pip install pybids==0.16.4') or use a requirements.txt/pyproject.toml with locked versions and hash verification.

• ⚪ INFO LLM_CONTEXT_BUDGET_EXCEEDED — 'references/bids_schema.json' excluded from LLM analysis (813,726 chars)

  file size (813,726 chars) exceeds per-file limit (75,000) File: references/bids_schema.json Remediation: Increase llm_analysis.max_referenced_file_chars in your scan policy to include this content in LLM analysis.

• 🔵 LOW LLM_DATA_EXFILTRATION — Network Fetch in update_schema.py Accepts Arbitrary User-Supplied URLs

  The update_schema.py script accepts a --schema-url argument that is passed directly to urllib.request.urlopen() without validation. A user could supply a malicious URL pointing to an attacker-controlled server, causing the script to fetch and write arbitrary content to the references/bids_schema.json file. The fetched content is parsed as JSON and written to disk, but the URL itself is not validated against an allowlist. File: scripts/update_schema.py Remediation: Validate the --schema-url argument against an allowlist of trusted domains (e.g., bids-specification.readthedocs.io, raw.githubusercontent.com/bids-standard). Reject URLs not matching the allowlist before making any network request.

• 🔵 LOW LLM_PROMPT_INJECTION — Fetched External Content Written Directly to Reference Files

  The update_schema.py script fetches content from external URLs (bids-specification.readthedocs.io and raw.githubusercontent.com) and writes it directly to local reference files (references/bids_schema.json and references/beps.yml). These reference files are subsequently used by the skill's instructions as authoritative sources. If the upstream sources were compromised or a malicious URL were supplied, the fetched content could contain embedded instructions that influence the agent's behavior when it reads these reference files. File: scripts/update_schema.py Remediation: After fetching, validate the schema structure against a known-good schema before writing. Consider cryptographic verification (e.g., checking a signature or hash) of fetched content. Treat fetched content as untrusted data rather than trusted instructions.

• 🔵 LOW LLM_DATA_EXFILTRATION — API Key Placeholder Exposed in Instructions

  The SKILL.md instructions include a placeholder for an NCBI API key ('your_api_key_here') in code examples. While this is a placeholder and not a real secret, it normalizes the pattern of embedding API keys directly in code, which could lead users to hardcode real credentials in scripts generated by the agent. File: SKILL.md Remediation: Replace the placeholder with guidance to load the API key from an environment variable or secure credential store, e.g., 'Entrez.api_key = os.environ.get("NCBI_API_KEY")'.

• 🔵 LOW LLM_DATA_EXFILTRATION — Multiple Referenced Files Not Found (Potential Missing Content Risk)

  Many files referenced in the skill instructions do not exist in the package (e.g., templates/blast.md, assets/sequence_io.md, Bio.py, and others). The static analyzer also flagged cross-file exfiltration chains across 8 files and environment variable exfiltration across 7 files. The missing files cannot be audited, and if they are later added with malicious content, the skill would load and use them without any validation. File: SKILL.md Remediation: Ensure all referenced files are present in the skill package and audited before deployment. Remove references to non-existent files. The static analyzer's flags about environment variable exfiltration chains across multiple Python files warrant a deeper audit of the full file inventory (28 files, 23 Python scripts) that were not provided for review.

• 🔵 LOW LLM_PROMPT_INJECTION — Skill Instructs Agent to Read and Execute Content from External Reference Files

  The skill instructs the agent to read reference files and 'extract relevant code patterns' and 'adapt them to the user's specific needs', and to use grep to search reference files. If any of the 23 Python files or reference files in the package contain malicious instructions or code patterns, the agent would incorporate them into generated code. The static analyzer flagged cross-file exfiltration chains across 8 files, suggesting some of the unreviewed Python files may contain suspicious patterns. File: SKILL.md Remediation: Audit all 23 Python files in the package that were not provided for review. Validate that reference files contain only legitimate documentation. The static analyzer's findings about environment variable access combined with network calls in multiple files should be investigated immediately.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing License and Compatibility Metadata

  The skill manifest declares 'license: Unknown' and does not specify compatibility. While not a direct security threat, missing provenance information reduces transparency and makes it harder to assess trustworthiness of the skill package. File: SKILL.md Remediation: Specify a valid SPDX license identifier and list compatible platforms in the manifest.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Package Installation Instruction

  The skill instructs users to install biopython without a pinned version, which could allow a compromised or malicious version of the package to be installed if the package registry is compromised or if a typosquatting package exists. File: SKILL.md Remediation: Pin the package to a specific known-good version, e.g., 'uv pip install biopython==1.85', and consider verifying the package hash.

• 🔵 LOW LLM_UNAUTHORIZED_TOOL_USE — Missing allowed-tools Declaration

  The skill does not declare an 'allowed-tools' field in its YAML manifest. While this field is optional per the spec, the skill instructs the agent to use Read, Grep/Bash (grep commands), and Python execution. Declaring allowed tools would help enforce least-privilege boundaries. File: SKILL.md Remediation: Add 'allowed-tools: [Read, Grep, Python]' to the YAML manifest to explicitly scope the skill's tool access.

• 🔵 LOW LLM_DATA_EXFILTRATION — Missing allowed-tools Declaration

  The skill manifest does not declare an 'allowed-tools' field. While this is optional per the spec, the skill makes extensive use of network calls to external bioinformatics APIs (UniProt, KEGG, NCBI BLAST, PSICQUIC, ChEMBL, ChEBI, UniChem, QuickGO) and writes files to disk. Declaring allowed tools would improve transparency about the skill's capabilities. File: SKILL.md Remediation: Add 'allowed-tools: [Python, Bash]' or more specific tool declarations to the YAML frontmatter to document the skill's tool usage.

• 🔵 LOW LLM_RESOURCE_ABUSE — Potentially Large Batch Processing Without Memory Bounds

  The pathway_analysis.py script retrieves and analyzes all pathways for an organism (potentially hundreds) and stores all results in memory simultaneously. For large organisms like human (hsa), this could result in significant memory consumption as all pathway data including entries and relations are held in the results list. File: scripts/pathway_analysis.py:75 Remediation: Consider streaming results to disk incrementally rather than accumulating all pathway data in memory. The --limit flag partially mitigates this but is optional.

• 🔵 LOW LLM_RESOURCE_ABUSE — Unbounded Polling Loop in BLAST Job Status Check

  The run_blast() function in protein_analysis_workflow.py polls for BLAST job completion with a 5-second sleep interval and a 300-second maximum wait. While a timeout is present, the polling loop could consume resources for extended periods, and the timeout is hardcoded with no user-configurable option. File: scripts/protein_analysis_workflow.py:130 Remediation: Consider making the timeout configurable via a command-line argument. The current implementation is acceptable but could be improved with exponential backoff.

• 🔵 LOW LLM_DATA_EXFILTRATION — Email Address Passed as Command-Line Argument to External Service

  The protein_analysis_workflow.py script accepts an email address as a command-line argument and passes it directly to the NCBI BLAST service. While this is a legitimate NCBI requirement, the email is passed in plaintext and could be logged or exposed in process listings. File: scripts/protein_analysis_workflow.py:167 Remediation: Consider reading the email from an environment variable or configuration file rather than a command-line argument to avoid exposure in process listings.

• 🔵 LOW LLM_DATA_EXFILTRATION — Missing Referenced Files May Cause Fallback to Untrusted Sources

  Several files referenced in the skill instructions are not found in the package: assets/common_patterns.md, scanpy.py, cellxgene_census.py, tiledbsoma.py, templates/census_schema.md, assets/census_schema.md, templates/common_patterns.md. If the agent attempts to resolve these missing references by fetching from external sources or interpreting user-provided content as substitutes, this could introduce indirect prompt injection or data exposure risks. The references to scanpy.py, cellxgene_census.py, and tiledbsoma.py are particularly notable as these shadow legitimate library names. File: SKILL.md Remediation: Ensure all referenced files are included in the skill package. Remove references to non-existent files. Rename any local files that shadow standard library names (e.g., cellxgene_census.py, scanpy.py, tiledbsoma.py) to avoid import shadowing confusion.

• 🔵 LOW LLM_DATA_EXFILTRATION — Pre-Scan Flags Indicate Potential Environment Variable Access and Cross-File Exfiltration Chains in Unreported Scripts

  The static pre-scan analysis detected multiple instances of environment variable access combined with network calls (BEHAVIOR_ENV_VAR_EXFILTRATION in 3 files) and a cross-file exfiltration chain spanning 8 files, as well as cross-file environment variable exfiltration across 7 files. However, no script files were provided for direct analysis. This discrepancy between the static scan findings and the absence of script content in the submission is a significant concern — the scripts flagged by the static analyzer were not included for review. File: SKILL.md Remediation: Conduct a full audit of all Python scripts in the skill package (23 Python files detected by file inventory). Specifically review any scripts that access environment variables (os.environ, os.getenv) in combination with network calls (requests, urllib, httpx, etc.). Ensure no credentials or environment data are transmitted to external endpoints. The 8-file exfiltration chain and 7-file env var exfiltration patterns require immediate investigation.

• 🔵 LOW LLM_PROMPT_INJECTION — User-Controlled Filter Strings Passed to Query Engine Without Validation

  The skill instructs the agent to construct obs_value_filter and var_value_filter strings that are passed directly to the TileDB-SOMA query engine. If user-supplied values (e.g., cell type names, tissue names, gene names) are interpolated into these filter strings without sanitization, a malicious user could craft inputs that manipulate query behavior. The pattern 'f"tissue_general == '{tissue}'"' in multi-dataset integration examples demonstrates direct string interpolation from iterable values. File: SKILL.md Remediation: Validate and sanitize any user-provided values before interpolating them into filter strings. Use allowlists of known valid values (cell types, tissues, diseases) from the Census metadata. Avoid direct f-string interpolation of user input into query filters.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing License and Compatibility Metadata

  The skill manifest does not specify a license or compatibility field. While allowed-tools is optional, the absence of license information reduces transparency and provenance tracking for this skill authored by 'K-Dense Inc.'. The description is well-scoped and matches the stated functionality. File: SKILL.md Remediation: Add a valid SPDX license identifier (e.g., 'MIT', 'Apache-2.0') and specify compatibility information in the YAML frontmatter. Consider adding allowed-tools to document expected tool usage.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Package Installation Without Version Constraints

  The skill instructs installation of 'cellxgene-census' and 'cellxgene-census[experimental]' without pinning to specific versions. This creates a supply chain risk where a compromised or malicious future version of the package could be installed, potentially introducing malicious behavior. File: SKILL.md Remediation: Pin package versions explicitly (e.g., 'uv pip install cellxgene-census==1.12.0') and consider using a lockfile or hash verification to ensure supply chain integrity.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing allowed-tools Manifest Field

  The SKILL.md manifest does not specify the 'allowed-tools' field. While this field is optional per the agent skills specification, its absence means there are no declared restrictions on which agent tools (Read, Write, Bash, Python, etc.) this skill may use. Given that the skill instructs package installation via bash and Python code execution, declaring allowed tools would improve transparency. File: SKILL.md Remediation: Add an explicit 'allowed-tools' field to the YAML frontmatter, e.g., 'allowed-tools: [Bash, Python, Read]', to clearly declare the intended tool usage scope.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Package Installation Without Version Constraints

  The SKILL.md instructs installation of multiple packages (cirq, cirq-google, cirq-ionq, cirq-aqt, cirq-pasqal, azure-quantum) without version pinning. This exposes the environment to supply chain attacks where a compromised or malicious package version could be installed. The use of 'uv pip install cirq' without specifying exact versions (e.g., cirq==1.3.0) means any future malicious release could be automatically pulled. File: SKILL.md Remediation: Pin all package versions explicitly, e.g., 'uv pip install cirq==1.3.0 cirq-google==1.3.0'. Consider using a lockfile (uv.lock) to ensure reproducible installations.

• 🔵 LOW LLM_DATA_EXFILTRATION — API Keys Shown Inline in Code Examples

  The hardware integration reference files (references/hardware.md, hardware.md) contain code examples that show API keys being passed directly as string literals in code (e.g., api_key='your_api_key', access_token='your_token'). While these are placeholder values in documentation, the pattern encourages users to hardcode credentials in their scripts rather than using environment variables exclusively. File: references/hardware.md Remediation: Update documentation examples to exclusively use environment variable patterns (os.environ.get('IONQ_API_KEY')) rather than inline string literals, to discourage credential hardcoding by users following the examples.

• 🔵 LOW LLM_DATA_EXFILTRATION — Referenced files not found in skill package

  Several files referenced in the SKILL.md instructions are not present in the skill package: templates/api_quick_reference.md, assets/api_quick_reference.md, matplotlib.py, assets/workflows.md, cobra.py, templates/workflows.md. The presence of 'matplotlib.py' and 'cobra.py' as referenced files is notable — if these were present, they could shadow the legitimate matplotlib and cobra Python libraries, potentially enabling tool poisoning. Their absence is noted but the naming pattern warrants attention. File: SKILL.md Remediation: Ensure all referenced files are included in the skill package. Avoid naming local files with the same names as standard Python libraries (matplotlib.py, cobra.py) as this can cause import shadowing issues.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing allowed-tools and compatibility metadata

  The SKILL.md manifest does not specify 'allowed-tools' or 'compatibility' fields. While these are optional per the agent skills spec, their absence means there are no declared restrictions on which agent tools (Read, Write, Bash, Python, etc.) this skill may invoke. Given the skill executes complex Python workflows including file I/O and multiprocessing, documenting these constraints would improve transparency. File: SKILL.md Remediation: Add 'allowed-tools' and 'compatibility' fields to the YAML frontmatter to clearly document which agent capabilities this skill requires and in which environments it is supported.

• 🔵 LOW LLM_DATA_EXFILTRATION — Static analyzer flagged environment variable access with network calls across multiple files

  The pre-scan static analysis flagged BEHAVIOR_ENV_VAR_EXFILTRATION (environment variable access combined with network calls) and BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN across 2 files. The provided skill content (SKILL.md, references/workflows.md, references/api_quick_reference.md) does not contain these patterns, suggesting they exist in the 10 Python files present in the package inventory that were not provided for review. This is a significant gap in the analysis and warrants manual inspection of those files. File: references/api_quick_reference.md Remediation: Provide all 10 Python files in the skill package for complete security review. Manually inspect each Python file for os.environ access, requests/urllib calls, subprocess calls, and any patterns that read sensitive data and transmit it externally. If confirmed, these would be CRITICAL findings.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Implicit dependency on unpinned external packages

  The skill's workflows extensively use third-party packages (cobra, pandas, matplotlib, seaborn) without any version pinning or dependency manifest (e.g., requirements.txt). Unpinned dependencies are vulnerable to supply chain attacks where a malicious package version could be installed. The static analyzer also flagged cross-file environment variable exfiltration and network call patterns across 2 files, which may reside in the unreported Python files among the 10 Python files in the package inventory. File: references/workflows.md Remediation: Add a requirements.txt or pyproject.toml with pinned dependency versions. Audit the 10 Python files in the package (not provided for review) for any network calls or environment variable access that could constitute exfiltration behavior.

• 🔵 LOW LLM_DATA_EXFILTRATION — Static Analysis Flags Unverifiable Exfiltration Patterns in Unreported Files

  The pre-scan static analysis reports findings of BEHAVIOR_ENV_VAR_EXFILTRATION (environment variable access combined with network calls), BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN (cross-file exfiltration chain across 2 files), and BEHAVIOR_CROSSFILE_ENV_VAR_EXFILTRATION (cross-file env var exfiltration across 2 files). The file inventory indicates 10 Python files exist in the package, but no script files were provided for review in this analysis. These flagged behaviors — if confirmed — would represent serious data exfiltration risks. The inability to review the Python files prevents full assessment. Remediation: Conduct a full review of all 10 Python files in the package. Specifically investigate any files that access environment variables (os.environ, os.getenv) in combination with network calls (requests, urllib, http.client, socket). If exfiltration patterns are confirmed, remove or sandbox the offending code immediately.

• 🔵 LOW LLM_DATA_EXFILTRATION — External URLs Embedded in Skill Instructions

  The SKILL.md instructions include two external URLs (https://ahkstrategies.net and https://themindbook.app) in the Attribution section. While these appear to be promotional links rather than active data exfiltration, embedding external URLs in skill instructions creates a potential vector for tracking or phishing if the agent or user is directed to visit them. Additionally, the pre-scan static analysis flagged environment variable access with network calls and cross-file exfiltration chains, which could not be verified against the provided script files (none were shown). This warrants attention. File: SKILL.md Remediation: Remove external URLs from skill instructions unless they serve a functional purpose. If attribution is needed, include it in documentation outside the instruction body. Investigate the flagged static analysis findings (BEHAVIOR_ENV_VAR_EXFILTRATION, BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN) in the unreported Python files.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Over-Broad Activation Triggers in Skill Description

  The skill description contains an extensive list of activation keywords and trigger phrases designed to maximize the skill's activation frequency. Phrases like 'council mode', 'mind council', 'deliberate on this', 'help me think through this from all sides', and broad conditions like 'user faces a dilemma, trade-off, or complex choice with no obvious answer' cast an extremely wide net. While not overtly malicious, this pattern inflates the skill's perceived scope and increases the likelihood of unwanted or unintended activation across a wide range of user queries. File: SKILL.md Remediation: Narrow the activation triggers to specific, unambiguous phrases. Avoid broad behavioral conditions like 'faces a dilemma' that could match nearly any complex user query. Use precise, opt-in trigger phrases rather than broad semantic conditions.

• 🔵 LOW LLM_UNAUTHORIZED_TOOL_USE — allowed-tools Declares Write Permission Without Apparent Need

  The YAML manifest declares allowed-tools as 'Read Write', granting file write permissions. However, the skill's stated purpose is purely deliberative — generating multi-perspective analysis through text output. No script files were provided for review, and the instruction body contains no steps that would require writing files. The Write permission appears unnecessary for the declared functionality and represents an over-privileged tool grant. File: SKILL.md Remediation: Remove the Write tool permission if the skill only generates text-based deliberation output. If Write is needed for saving session outputs, document this explicitly in the instructions and limit write scope to a specific output directory.

• 🔵 LOW LLM_DATA_EXFILTRATION — Several Referenced Files Not Found in Package

  Multiple files referenced in the SKILL.md instructions are not present in the skill package: templates/schedulers.md, dask.py, templates/arrays.md, assets/dataframes.md, assets/best-practices.md, assets/arrays.md, templates/bags.md, templates/dataframes.md, templates/futures.md, assets/schedulers.md, templates/best-practices.md, assets/futures.md, assets/bags.md. The instructions direct the agent to 'load these files when users need detailed information,' but many of the referenced paths do not exist. This could cause the agent to attempt to read files from unexpected locations or fail silently. File: SKILL.md Remediation: Ensure all referenced files are included in the skill package, or remove references to non-existent files from the instructions. Audit the file inventory to confirm all paths are correct.

• 🔵 LOW LLM_DATA_EXFILTRATION — Static Analyzer Flagged Potential Environment Variable Exfiltration and Cross-File Exfiltration Chain

  The pre-scan static analysis flagged BEHAVIOR_ENV_VAR_EXFILTRATION (environment variable access with network calls detected) and BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN (cross-file exfiltration chain across 2 files). However, review of all provided file contents (SKILL.md, references/futures.md, references/best-practices.md, references/bags.md, references/dataframes.md, references/arrays.md, references/schedulers.md) reveals no Python or Bash scripts with actual environment variable harvesting or network exfiltration code. The flagged behavior may relate to unreferenced Python files (10 Python files noted in inventory) that were not provided for review. Without access to those files, the risk cannot be fully assessed. File: SKILL.md Remediation: Provide all 10 Python files in the skill package for full security review. Inspect each Python file for environment variable access (os.environ, os.getenv) combined with network calls (requests, urllib, socket) that could constitute data exfiltration. Remove or sandbox any such patterns.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing allowed-tools Metadata

  The skill does not specify the 'allowed-tools' field in its YAML manifest. While this field is optional per the agent skills spec, its absence means there are no declared restrictions on which agent tools (Read, Write, Bash, Python, etc.) can be invoked. Given the skill references numerous external files and the static analyzer flagged potential exfiltration chains, explicit tool restrictions would improve the security posture. File: SKILL.md Remediation: Add an explicit 'allowed-tools' field to the YAML manifest listing only the tools required for the skill's legitimate functionality (e.g., [Read]).

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing Compatibility Metadata

  The skill does not specify the 'compatibility' field in its YAML manifest. This is a minor documentation gap but reduces transparency about the intended execution environment. File: SKILL.md Remediation: Add a 'compatibility' field to the YAML manifest specifying the intended environments (e.g., 'Claude.ai, Claude Code, API').

• 🔵 LOW LLM_DATA_EXFILTRATION — API Key Harvesting from Environment and .env Files

  The skill instructions explicitly direct the agent to read API keys from environment variables and .env files in the current working directory. While this is a common pattern for credential management, the skill accesses a large number of sensitive credentials (18+ API keys) including financial data APIs (FRED, BEA, BLS), genomics APIs, and government data APIs. The instructions also direct the agent to use shell commands like 'echo $FRED_API_KEY' to read environment variables, which could expose credentials in command output logs. File: SKILL.md Remediation: Avoid echoing API keys to shell output. Use secure credential retrieval methods that do not expose keys in logs. Consider limiting the number of credentials the skill accesses to only those needed for the specific query.

• 🔵 LOW LLM_DATA_EXFILTRATION — Missing License and Compatibility Metadata

  The skill manifest does not specify a license or compatibility field. While these are optional per the spec, the absence of license information is notable for a skill that accesses numerous external APIs, some of which have commercial use restrictions (DrugBank, COSMIC, BRENDA). The skill also lacks an allowed-tools declaration, making it impossible to audit which agent capabilities it requires. File: SKILL.md Remediation: Add license metadata to clarify the terms under which this skill may be used. Add allowed-tools to declare which agent capabilities are required. Document any API terms-of-service restrictions that apply to commercial use.

• 🔵 LOW LLM_PROMPT_INJECTION — Indirect Prompt Injection Risk via External API Responses

  The skill instructs the agent to return 'raw JSON' responses from external APIs and to read reference files before making API calls. If any of the 78 external APIs return malicious content (e.g., JSON fields containing instruction-like text), this content could be presented to the agent in a context where it might be interpreted as instructions. The skill explicitly says 'default to showing the full raw JSON' which maximizes exposure to potentially malicious API response content. File: SKILL.md Remediation: Sanitize or clearly delimit external API responses before presenting them to the agent. Consider parsing and extracting only relevant fields rather than returning raw JSON verbatim. Add explicit warnings that API response content should not be interpreted as instructions.

• 🔵 LOW LLM_RESOURCE_ABUSE — Unbounded Parallel API Calls Across 78 Databases

  The skill instructions encourage querying multiple databases in parallel for cross-domain queries (e.g., 'everything about aspirin' or 'everything about BRCA1'), potentially triggering dozens of simultaneous HTTP requests. For broad queries, the skill could initiate 10-20+ parallel API calls simultaneously, consuming significant network and compute resources. The instruction 'cast a wide net' and 'query all relevant databases in parallel' could lead to resource exhaustion in automated workflows. File: SKILL.md Remediation: Implement a maximum concurrency limit for parallel API calls. Require user confirmation before initiating broad multi-database queries. Add rate limiting guidance to prevent resource exhaustion.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Over-Broad Capability Claims in Skill Description

  The skill description claims to cover '78 public scientific, biomedical, materials science, and economic databases' and instructs the agent to activate for an extremely broad range of queries including compounds, genes, proteins, pathways, variants, clinical trials, patents, economic indicators, and 'any public database API query.' This over-broad activation scope could cause the skill to be invoked for nearly any research or data lookup query, potentially displacing more specialized or appropriate tools. File: SKILL.md Remediation: Narrow the activation description to specific use cases rather than 'any public database API query.' Provide more precise trigger conditions to avoid over-broad activation.

• 🔵 LOW LLM_DATA_EXFILTRATION — Static Analyzer Flags Potential Environment Variable Exfiltration Pattern (Unconfirmed)

  The pre-scan static analyzer flagged potential environment variable access combined with network calls (BEHAVIOR_ENV_VAR_EXFILTRATION and BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN). However, review of all provided skill files (SKILL.md and all referenced markdown files) reveals no Python or Bash scripts present in the skill package. The referenced script files (sklearn.py, rdkit.py, scipy.py, datamol.py) were not found. The flagged behavior likely originates from the fsspec-based cloud storage examples in the documentation (which may internally use environment variables for credentials like AWS_ACCESS_KEY_ID). No actual malicious exfiltration code was found in the reviewed content. File: SKILL.md Remediation: Confirm that the missing script files (sklearn.py, rdkit.py, scipy.py, datamol.py) do not contain malicious code. If these files exist in the actual skill package but were not provided for review, they should be audited separately.

• 🔵 LOW LLM_PROMPT_INJECTION — Remote File Fetching Without Input Validation Warning

  The skill's instructions and referenced io_module.md documentation explicitly encourage reading files from remote URLs and cloud storage (S3, GCS, HTTP/HTTPS) using fsspec. User-supplied URLs are passed directly to dm.read_sdf(), dm.read_csv(), etc. without any guidance on validating or sanitizing the source. A malicious actor could supply a URL pointing to a crafted molecular file containing embedded instructions or malicious data. While the risk is low for a cheminformatics library, the skill provides no guidance on validating external data sources. File: SKILL.md Remediation: Add a note in the skill instructions advising users to only read from trusted remote sources, and to validate URLs before passing them to I/O functions.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing allowed-tools Metadata

  The skill does not specify the 'allowed-tools' field in its YAML manifest. While this field is optional per the agent skills spec, its absence means there are no declared restrictions on which agent tools (Read, Write, Bash, Python, etc.) this skill may invoke. Given the skill's instructions include code that reads files, writes files, and makes network calls (e.g., cloud storage via fsspec), declaring allowed tools would improve transparency. File: SKILL.md Remediation: Add an explicit 'allowed-tools' field to the YAML frontmatter listing the tools this skill requires, e.g., allowed-tools: [Python, Read, Write].

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing Compatibility Metadata

  The skill does not specify the 'compatibility' field in its YAML manifest. This field helps users understand in which environments the skill is expected to work. The skill's instructions reference cloud storage (S3, GCS, HTTP) and parallel processing, which may not be available in all environments. File: SKILL.md Remediation: Add a 'compatibility' field to the YAML frontmatter specifying supported environments.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Package Installation Instruction

  The skill instructs users to install datamol without a pinned version: 'uv pip install datamol'. Unpinned package installations are susceptible to supply chain attacks where a malicious version of the package could be published and automatically installed. This is a low-severity concern for a well-known cheminformatics library, but version pinning is a security best practice. File: SKILL.md Remediation: Pin the package version in the installation instruction, e.g., 'uv pip install datamol==0.12.0' or specify a minimum safe version.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing allowed-tools Manifest Field

  The SKILL.md YAML frontmatter does not declare an 'allowed-tools' field. While this field is optional per the agent skills spec, its absence means there are no declared restrictions on which agent tools (Read, Write, Bash, Python, etc.) this skill may invoke. The scripts use Python execution and file I/O, so declaring allowed tools would improve transparency. File: SKILL.md Remediation: Add an explicit 'allowed-tools: [Python, Bash]' declaration to the YAML frontmatter to document the intended tool usage scope.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Package Installation in Instructions

  The SKILL.md instructions recommend installing deepchem using 'uv pip install deepchem' and 'uv pip install deepchem[torch]' and 'uv pip install deepchem[all]' without version pinning. This exposes users to supply chain risks where a compromised or malicious version of the package could be installed. File: SKILL.md Remediation: Pin the deepchem package to a specific known-good version, e.g., 'uv pip install deepchem==2.7.1'. Consider also verifying package integrity via checksums.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing allowed-tools Manifest Field

  The SKILL.md manifest does not specify the 'allowed-tools' field. While this is optional per the agent skills spec, the skill executes Python scripts and generates bash scripts that are then executed via chmod+x and shell invocation. Documenting the intended tool scope would improve transparency. File: SKILL.md Remediation: Add 'allowed-tools: [Python, Bash]' to the YAML frontmatter to explicitly declare the tools this skill uses.

• 🔵 LOW LLM_DATA_EXFILTRATION — External Data Download Without Integrity Verification

  The skill instructs downloading large data files from external URLs (figshare.com, depmap.org) using requests without any checksum or integrity verification. The download_depmap_data function streams content directly to disk with no hash validation, making it susceptible to man-in-the-middle substitution or corrupted data being silently accepted. File: SKILL.md Remediation: Add SHA256 checksum verification after download. DepMap/Figshare publish checksums for their data releases. Verify the downloaded file hash before loading it into pandas.

• 🔵 LOW LLM_DATA_EXFILTRATION — Unresolved Reference to scipy.py

  The SKILL.md references a file named 'scipy.py' which is not found in the skill package. This is a dangling reference. While scipy is a legitimate scientific library, referencing a non-existent local file named scipy.py could cause confusion or, if a malicious actor were to supply a file by that name, could lead to unexpected code execution depending on how the agent resolves the reference. File: SKILL.md Remediation: Remove the reference to scipy.py from the instructions, or clarify that scipy refers to the pip-installable package (scipy) rather than a local file. Ensure all referenced files are bundled within the skill package.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Missing allowed-tools Declaration and Compatibility Metadata

  The skill manifest does not declare allowed-tools or compatibility fields. The skill makes network requests and writes files to disk, which are significant capabilities. Without explicit tool declarations, the agent runtime cannot enforce capability boundaries, and users cannot assess the skill's resource footprint before activation. File: SKILL.md Remediation: Add 'allowed-tools: [Python, Bash]' and a compatibility field to the YAML frontmatter. Explicitly document that the skill makes outbound HTTP requests and writes files to the local filesystem.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — No Version Pinning for External Dependencies

  The skill's code examples use 'import requests' and 'from scipy import stats' without specifying pinned versions. If the agent installs these packages, unpinned dependencies could resolve to compromised or incompatible future versions. The figshare URL also contains a placeholder ('...') suggesting incomplete configuration. File: SKILL.md Remediation: Pin dependency versions in a requirements.txt (e.g., requests==2.31.0, pandas==2.1.0, scipy==1.11.0). Replace the placeholder figshare URL with the actual versioned download URL for the specific DepMap release being targeted.

• 🔵 LOW LLM_DATA_EXFILTRATION — Pre-Scan Flags Indicate Potential Exfiltration Patterns in Unreported Files

  The pre-scan static analysis context reports findings of BEHAVIOR_ENV_VAR_EXFILTRATION, BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN, and BEHAVIOR_CROSSFILE_ENV_VAR_EXFILTRATION across 32 files (22 markdown, 10 Python), yet the skill submission reports 'No script files found' and 'No referenced files.' This discrepancy is significant: the static analyzer detected environment variable access combined with network calls and cross-file exfiltration chains in files that were not surfaced for review. This suggests the skill package may contain hidden or unreported Python scripts with data exfiltration behavior that were not included in the analyzed content. Remediation: Conduct a full audit of all 32 files in the skill package, particularly the 10 Python scripts. Investigate the two files identified in the cross-file exfiltration chain. Do not deploy this skill until all Python files have been reviewed for environment variable harvesting and network exfiltration patterns. The discrepancy between 'no scripts found' in the submission and 10 Python files detected by the static analyzer must be resolved.

• 🔵 LOW LLM_HARMFUL_CONTENT — Pseudoscientific Framework Presented as Established Science

  The skill presents the 'Digital Human DNA (DHDNA)' framework as an established scientific theory with the same validity as biological DNA fingerprinting. The analogy ('Just as biological DNA encodes physical identity through base pairs, Digital Human DNA encodes cognitive identity through thinking patterns') is misleading. The referenced DOIs point to Zenodo preprints, which are not peer-reviewed publications. Presenting a proprietary, unvalidated framework as scientifically equivalent to DNA profiling could mislead users into placing unwarranted confidence in the cognitive profiles generated. File: SKILL.md Remediation: Add clear disclaimers that DHDNA is a proprietary conceptual framework, not a peer-reviewed scientific methodology. Clarify that Zenodo preprints are not peer-reviewed. Avoid analogies that equate the framework's validity to established biological science.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Over-Broad Trigger Description with Keyword Baiting

  The skill's description contains an unusually large number of trigger keywords and phrases designed to maximize activation frequency. Phrases like 'analyze how someone thinks', 'cognitive profile', 'thinking pattern', 'DHDNA', 'digital DNA', 'understand the mind behind any text', and 'deeper insight into the author's reasoning patterns' are all listed as activation triggers. This over-broad activation surface could cause the skill to activate in contexts where it is not appropriate or desired, inflating its perceived utility and usage frequency. File: SKILL.md Remediation: Narrow the trigger description to the core use case. Avoid listing excessive keyword synonyms as activation triggers. Use precise, minimal descriptions that accurately reflect the skill's scope.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Promotional Content and External Brand Links in Skill Instructions

  The SKILL.md instruction body contains multiple promotional links to external commercial platforms (ahkstrategies.net, themindbook.app) and self-referential branding ('AHK Strategies', 'AI Horizon Knowledge'). This is consistent with capability inflation and brand promotion embedded within a skill manifest, potentially using the agent as an advertising vehicle. The 'Built By' section at the bottom of the instructions is promotional in nature and not operationally necessary. File: SKILL.md Remediation: Remove promotional links and branding from the instruction body. Skill instructions should contain only operational guidance. Attribution can be placed in the YAML frontmatter metadata fields.

• 🔵 LOW LLM_DATA_EXFILTRATION — Missing allowed-tools Declaration

  The skill does not declare an 'allowed-tools' field in its YAML manifest. While this field is optional per the agent skills spec, the skill executes Python scripts and Bash commands, so declaring allowed tools would improve transparency and security posture. File: SKILL.md Remediation: Add 'allowed-tools: [Python, Bash, Read, Write]' to the YAML frontmatter to explicitly declare the tools this skill requires.

• 🔵 LOW LLM_DATA_EXFILTRATION — Missing License Information

  The skill manifest lists license as 'Unknown'. Without a clear license, the provenance and trustworthiness of the skill package cannot be fully assessed. This is a minor governance concern rather than a direct security threat. File: SKILL.md Remediation: Specify a valid open-source license (e.g., MIT, Apache-2.0) in the YAML frontmatter to establish clear provenance.

• 🔵 LOW LLM_UNAUTHORIZED_TOOL_USE — Missing allowed-tools Declaration

  The skill manifest does not specify the 'allowed-tools' field. While this field is optional per the agent skills spec, the skill instructs the agent to execute bash commands (dx login, dx build, dx run, etc.) and Python code. Declaring allowed tools would provide an explicit boundary on what the agent is permitted to do, reducing the risk of unintended tool use. File: SKILL.md Remediation: Add an explicit allowed-tools declaration to the YAML frontmatter, e.g., allowed-tools: [Bash, Python, Read, Write] to document and constrain the agent's tool usage.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Package Installation in Dependency Examples

  The references/configuration.md file shows Python dependency installation patterns using pip without version pinning in some examples (e.g., installing samtools, bwa via execDepends without version constraints). Additionally, the SKILL.md itself installs dxpy via 'uv pip install dxpy' without a pinned version. Unpinned dependencies are susceptible to supply chain attacks where a malicious version could be substituted. File: references/configuration.md Remediation: Pin all dependency versions in execDepends entries (e.g., {"name": "samtools", "version": "1.17"}). Pin dxpy installation in SKILL.md to a specific version (e.g., uv pip install dxpy==0.375.0).

• 🔵 LOW LLM_DATA_EXFILTRATION — API Token Hardcoding Warning in SDK Documentation

  The references/python-sdk.md file contains example code showing how to set an API token directly as a string literal ('YOUR_API_TOKEN'). While this is documentation/example code rather than a live secret, it demonstrates a pattern that could be copied verbatim by users and lead to hardcoded credentials in production scripts. The skill's own best practices section does warn against hardcoding credentials, which is a positive signal. File: references/python-sdk.md Remediation: Replace placeholder examples with references to environment variable patterns only. Emphasize that tokens should always come from environment variables or secure vaults, not string literals.

• 🔵 LOW LLM_DATA_EXFILTRATION — Missing allowed-tools Declaration

  The SKILL.md manifest does not specify an allowed-tools field. While this is optional per the agent skills specification, declaring it would help constrain the agent's tool usage and make the skill's security posture more explicit. The skill uses Bash (soffice, pandoc, pdftoppm, git), Python execution, file read/write operations, and npm, none of which are declared. File: SKILL.md Remediation: Add an explicit allowed-tools declaration to the YAML frontmatter listing the tools actually used: [Bash, Python, Read, Write]. This improves auditability and allows the agent runtime to enforce restrictions.

• 🔵 LOW LLM_COMMAND_INJECTION — Subprocess Execution with User-Influenced File Paths

  Multiple scripts (accept_changes.py, soffice.py, redlining.py) invoke subprocess.run() with file paths that ultimately derive from user-provided arguments (input_file, output_file, original_file). While the scripts use list-form subprocess calls (not shell=True), the file paths are passed directly to soffice and git without sanitization. A maliciously crafted filename beginning with '--' or containing special characters could potentially be interpreted as flags by the subprocess. File: scripts/accept_changes.py Remediation: Validate that input file paths are well-formed and do not start with '-'. Use pathlib to resolve and canonicalize paths before passing to subprocesses. Consider adding a '--' separator before file path arguments where supported by the target binary.

• 🔵 LOW LLM_RESOURCE_ABUSE — Missing Timeout on LibreOffice Macro Setup Subprocess

  In accept_changes.py, the _setup_libreoffice_macro() function calls subprocess.run() with a timeout=10 for the initialization step, but the main accept_changes() function's subprocess.run() call has timeout=30. The TimeoutExpired exception in accept_changes() is caught and treated as success (the function returns a success message), which could mask actual failures. Additionally, if LibreOffice hangs indefinitely during macro setup, the 10-second timeout may be insufficient in resource-constrained environments. File: scripts/accept_changes.py Remediation: Do not treat TimeoutExpired as success. Instead, log a warning and return an appropriate error or partial-success message. Consider increasing timeout values or making them configurable. Ensure cleanup of the output file if the operation timed out.

• 🔵 LOW LLM_COMMAND_INJECTION — Dynamic Compilation and LD_PRELOAD Injection of C Shim

  soffice.py dynamically compiles a C source file using gcc and loads the resulting shared library via LD_PRELOAD. While the C source (_SHIM_SOURCE) is hardcoded within the script and not user-controlled, this pattern is inherently risky: it writes a .c file to /tmp, compiles it, and injects it into LibreOffice's process space. If an attacker could influence the shim source or the temp directory, this could lead to arbitrary code execution. The shim itself manipulates socket system calls (socket, listen, accept, close) which is a low-level OS capability. File: scripts/office/soffice.py Remediation: Ensure the temp directory is not world-writable or accessible to other processes. Consider shipping the precompiled shim as a binary artifact rather than compiling at runtime. Validate that _SHIM_SO does not already exist with unexpected content before use (check file hash).

• 🔵 LOW LLM_DATA_EXFILTRATION — Environment Variable Access via os.environ.copy() in soffice.py

  The soffice.py helper calls os.environ.copy() to build the environment for LibreOffice subprocess invocations. While this is a standard and expected pattern for subprocess helpers (passing the current environment to child processes), the static analyzer flagged it as a potential exfiltration vector. In context, the environment is passed only to local LibreOffice (soffice) processes and no network calls are made in this file. The risk is low but worth noting: if the environment contains sensitive secrets (API keys, tokens), they are forwarded to the LibreOffice subprocess. File: scripts/office/soffice.py Remediation: This is largely benign in context. Consider filtering the environment to only pass variables required by LibreOffice rather than the full environment copy, to minimize exposure of sensitive environment variables to child processes.

• 🔵 LOW LLM_COMMAND_INJECTION — eval/exec Usage in Code Examples (Static Analyzer Flag)

  The static analyzer flagged a potential eval/exec usage in a Python code block. After reviewing all code in SKILL.md and the referenced files, no actual eval() or exec() calls with user-controlled input were found. The code examples use standard ETE3 library calls. The flag may be a false positive from pattern matching on library internals or documentation text. No exploitable command injection pattern is present in the skill's code. File: SKILL.md Remediation: No immediate action required. Verify the specific line flagged by the static analyzer to confirm it is not user-controlled input passed to eval/exec.

• 🔵 LOW LLM_DATA_EXFILTRATION — NCBI Taxonomy Database Download to Home Directory

  The skill automatically downloads ~300MB of NCBI taxonomy data to ~/.etetoolkit/taxa.sqlite on first use. While this is legitimate functionality for the ETE3 library, it involves writing to the user's home directory without explicit per-session user confirmation. This is documented behavior but worth noting as it modifies the user's filesystem. File: SKILL.md Remediation: Document clearly to users that first use of NCBI taxonomy features will download ~300MB to their home directory. Consider prompting for user confirmation before triggering NCBITaxa() instantiation.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Package Installation

  The installation instructions use 'uv pip install ete3' and 'uv pip install ete3[gui]' without version pinning. This means the skill could install any version of ete3, including potentially compromised future versions. While ete3 is a well-known bioinformatics library, unpinned dependencies are a supply chain risk. File: SKILL.md Remediation: Pin the ete3 version in installation instructions, e.g., 'uv pip install ete3==3.1.3'. Consider adding a requirements.txt with pinned versions and checksums.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Over-Broad Capability Claims in Skill Description

  The skill claims to support '200+ file formats' across six major scientific domains. While the reference files do cover many formats, the actual Python script (eda_analyzer.py) only implements analysis for a small subset: CSV/TSV, JSON, NPY/NPZ, HDF5, FASTA/FASTQ, and basic TIFF/PNG/JPEG. The gap between the advertised capability and actual implementation could mislead users into trusting analysis results for formats that fall back to generic or no analysis. This is a capability inflation concern. File: SKILL.md Remediation: Clarify in the description which formats have full programmatic analysis support versus which rely on reference documentation only. Distinguish between 'format documentation coverage' and 'automated analysis support'.

• 🔵 LOW LLM_COMMAND_INJECTION — Eval/Exec Usage Flagged by Static Analyzer

  The static pre-scan flagged a Python eval/exec usage in a code block. Reviewing the script, the eda_analyzer.py does not directly call eval() or exec() in its runtime code. However, the SKILL.md instructions contain Python code blocks that demonstrate use of regex with re.search and dynamic content loading from reference files. The reference file content is read and injected into reports without sanitization. If a malicious reference file were substituted, it could embed content that gets executed or injected into reports. The risk is low given reference files are internal to the skill package. File: scripts/eda_analyzer.py Remediation: The static flag appears to be a false positive for this skill's runtime code. Confirm no eval/exec is present in the actual deployed scripts. Ensure reference files are treated as read-only trusted content and not user-modifiable.

• 🔵 LOW LLM_DATA_EXFILTRATION — Full Absolute File Path Disclosed in Generated Reports

  The generate_markdown_report function includes the full absolute path of the analyzed file in the generated markdown report. This could expose sensitive directory structure information (e.g., usernames, project names, internal paths) if reports are shared externally. File: scripts/eda_analyzer.py Remediation: Consider making the full path disclosure optional, or defaulting to relative paths in reports. Add a flag to suppress absolute path disclosure for shared reports.

• 🔵 LOW LLM_PROMPT_INJECTION — Reference File Content Injected Into Reports Without Sanitization

  The eda_analyzer.py reads reference markdown files and injects their raw content directly into generated reports via the 'raw_section' field. If a reference file were modified by an attacker (e.g., through supply chain compromise or local file tampering), malicious markdown or instructions could be embedded in generated reports. The risk is mitigated by the fact that reference files are internal to the skill package and not fetched from external sources. File: scripts/eda_analyzer.py Remediation: Consider sanitizing or escaping reference file content before embedding it in reports. At minimum, validate that reference files have not been tampered with (e.g., via checksums). Do not allow user-controlled input to influence which reference file is loaded.

• 🔵 LOW LLM_RESOURCE_ABUSE — Unbounded File Loading for FASTA/FASTQ Sequences

  The analyze_bioinformatics function loads FASTA sequences using list(SeqIO.parse(...)) which loads ALL sequences into memory at once. For very large FASTA files (e.g., whole genome assemblies with millions of sequences), this could exhaust available memory. FASTQ is capped at 10,000 reads, but FASTA has no limit. File: scripts/eda_analyzer.py Remediation: Apply the same sampling limit used for FASTQ (first N records) to FASTA files. Use an iterator-based approach rather than loading all sequences into a list.

• 🔵 LOW LLM_COMMAND_INJECTION — Python Code Block Contains eval/exec Pattern (Static Analyzer Flag)

  The static pre-scan flagged a potential eval/exec usage in a Python code block within the skill's markdown documentation. After reviewing all code blocks in SKILL.md and references/api_reference.md, no actual eval() or exec() calls are present in the documented examples. The flag appears to be a false positive from the static analyzer pattern-matching on code block content. All Python examples use standard FlowIO API calls (FlowData, create_fcs, read_multiple_data_sets) without dynamic code execution. No actual threat is present. File: SKILL.md Remediation: No action required. The static analyzer flag is a false positive. Continue monitoring if actual script files are added to the skill package.

• 🔵 LOW LLM_DATA_EXFILTRATION — Referenced Script File flowio.py Not Found in Package

  The SKILL.md instructions reference 'flowio.py' as a file within the skill package, but this file was not found. The absence of a referenced file could indicate an incomplete package or that the skill relies on an external/user-provided file. If flowio.py were present and contained malicious code, it would not be detectable. The missing file creates an unverifiable dependency. File: SKILL.md Remediation: Ensure all referenced files are bundled within the skill package. Verify that flowio.py, assets/api_reference.md, and templates/api_reference.md are included or remove references to them if they are not needed.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing allowed-tools and compatibility Metadata

  The SKILL.md YAML frontmatter does not specify the 'allowed-tools' or 'compatibility' fields. While these fields are optional per the agent skills specification, their absence means there are no declared restrictions on which agent tools this skill may invoke. The skill instructs the agent to install packages via 'uv pip install flowio' and perform file read/write operations, which would require Bash and Write tool access at minimum. File: SKILL.md Remediation: Add explicit allowed-tools declaration to the YAML frontmatter, e.g.: allowed-tools: [Bash, Python, Read, Write]. Also specify compatibility to clarify supported environments.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing allowed-tools Manifest Field

  The SKILL.md manifest does not specify the 'allowed-tools' field. While this field is optional per the agent skills specification, its absence means there are no declared restrictions on which agent tools this skill can invoke. Given that the skill instructs the agent to execute bash commands (mpirun, uv pip install, paraview) and Python code, declaring allowed tools would improve transparency and security posture. File: SKILL.md Remediation: Add an explicit 'allowed-tools' field to the YAML frontmatter listing the tools this skill requires, e.g., 'allowed-tools: [Bash, Python, Read, Write]'. This improves auditability and allows the agent runtime to enforce restrictions.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Package Installation in Instructions

  The skill instructs users to install packages using 'uv pip install fluidsim', 'uv pip install fluidsim[fft]', and 'uv pip install fluidsim[fft,mpi]' without version pinning. This means the installed version is not deterministic and could be subject to supply chain attacks if the package is compromised or a malicious version is published. The risk is moderate given fluidsim is a legitimate scientific computing package, but version pinning is a security best practice. File: SKILL.md Remediation: Pin package versions in installation instructions, e.g., 'uv pip install fluidsim==0.7.3'. Document the expected version and provide a hash or checksum for verification.

• 🔵 LOW LLM_COMMAND_INJECTION — Python eval/exec Usage in Code Examples

  The static analyzer flagged a potential eval/exec usage in a Python code block within the skill's reference files. After reviewing all referenced files, the code examples use standard Python constructs (lambda functions, method overrides) rather than dangerous eval/exec calls. The lambda usage in references/advanced_features.md (sim.forcing.forcing_maker.compute_forcing_fft = lambda: compute_forcing_fft(sim)) is a standard Python pattern and not a security risk. No actual eval() or exec() calls were found in the content. This is a low-severity informational finding based on the static analyzer alert. File: references/advanced_features.md Remediation: No action required. The lambda usage is a standard Python pattern. If future code examples are added, avoid using eval() or exec() with user-controlled input.

• 🔵 LOW LLM_DATA_EXFILTRATION — Traversal of Parent Directories for .env File

  The check_env_file() function walks up the entire directory tree from the current working directory to the filesystem root, searching for a .env file. This could inadvertently read an API key from a .env file in a parent directory that the user did not intend to expose to this script, potentially leaking credentials from unrelated projects. File: scripts/generate_image.py:22 Remediation: Limit .env search to the current directory only, or at most one parent level. Document the search behavior clearly so users understand which .env file will be used.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Third-Party Dependency (requests)

  The script imports the requests library without any version pinning or integrity verification. If a user installs a malicious or compromised version of requests (e.g., via typosquatting or supply chain attack), the API key and image data could be exfiltrated. There is no requirements.txt with pinned versions provided. File: scripts/generate_image.py:88 Remediation: Provide a requirements.txt with a pinned version (e.g., requests==2.32.3) and ideally include hash verification. Document the expected version in the skill manifest.

• 🔵 LOW LLM_DATA_EXFILTRATION — API Key Passed via Command-Line Argument

  The script accepts the OpenRouter API key via a --api-key command-line argument. On multi-user systems, command-line arguments are visible in process listings (e.g., ps aux), which could expose the API key to other local users. The .env file fallback is safer, but the CLI option introduces a risk. File: scripts/generate_image.py:270 Remediation: Remove the --api-key CLI argument or document the risk. Prefer environment variable or .env file exclusively. If CLI is needed, consider reading from stdin instead.

• 🔵 LOW LLM_COMMAND_INJECTION — Python eval/exec Usage Flagged by Static Analyzer

  The static pre-scan flagged a MDBLOCK_PYTHON_EVAL_EXEC pattern in the skill's markdown code blocks. After reviewing all provided content, the code blocks in SKILL.md and referenced files use standard Python API calls (e.g., geniml library functions, scanpy operations) and do not contain actual eval() or exec() calls. The flag may be a false positive from the static analyzer detecting a pattern match. No actual dynamic code execution vulnerability was found in the reviewed content. File: SKILL.md Remediation: Verify the missing referenced files (geniml.py, scanpy.py, templates/.md, assets/.md) do not contain eval/exec patterns. Ensure all bundled scripts are reviewed before deployment.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing allowed-tools and Compatibility Metadata

  The skill manifest does not specify 'allowed-tools' or 'compatibility' fields. While these are optional per the agent skills specification, their absence means there are no declared restrictions on which agent tools (Read, Write, Bash, Python, etc.) the skill may invoke. Given that the skill instructs execution of bash commands and Python scripts, declaring allowed tools would improve transparency and reduce the risk of unintended tool use. File: SKILL.md Remediation: Add 'allowed-tools: [Bash, Python, Read, Write]' to the YAML frontmatter to explicitly declare the tools this skill requires, improving auditability and enabling enforcement of tool restrictions.

• 🔵 LOW LLM_UNAUTHORIZED_TOOL_USE — Multiple Referenced Files Not Found in Skill Package

  The SKILL.md references numerous files that were not found in the skill package: templates/region2vec.md, templates/scembed.md, templates/bedspace.md, templates/consensus_peaks.md, templates/utilities.md, assets/region2vec.md, assets/scembed.md, assets/bedspace.md, assets/consensus_peaks.md, assets/utilities.md, scanpy.py, and geniml.py. These missing files could contain additional instructions or code that cannot be analyzed for security threats. The skill instructs the agent to reference these files, but their absence means the agent may behave unpredictably or the files may be fetched from external sources. File: SKILL.md Remediation: Ensure all referenced files are bundled within the skill package. Do not reference files that may be fetched from external or untrusted sources. Audit the complete file inventory before deployment.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Over-Broad Capability Description

  The skill description is extremely broad, claiming support for PostGIS databases, interactive maps, multiple visualization libraries (matplotlib/folium/cartopy), and numerous spatial operations. The allowed-tools field is not specified, and compatibility is not specified. While the skill appears to be a legitimate documentation/helper skill for the geopandas library, the description may cause the agent to activate this skill for a very wide range of geospatial tasks beyond what is appropriate. File: SKILL.md Remediation: Narrow the description to the core use cases. Specify allowed-tools to limit the agent's tool usage. Add compatibility information.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Package Dependencies

  The skill instructs installation of multiple packages (geopandas, folium, mapclassify, pyarrow, psycopg2, geoalchemy2, contextily, cartopy) without version pinning. This exposes users to supply chain risks where a compromised or malicious package version could be installed. File: SKILL.md Remediation: Pin all dependencies to specific verified versions, e.g., 'uv pip install geopandas==1.0.1'. Consider providing a requirements.txt or pyproject.toml with pinned versions and hash verification.

• 🔵 LOW LLM_DATA_EXFILTRATION — Database Credentials in Code Examples

  The data-io.md reference file contains example code showing database connection strings with placeholder credentials (user:password@host:port/database). While these are documentation examples and not hardcoded real credentials, they demonstrate a pattern that could lead users to embed real credentials directly in code rather than using environment variables or secrets management. File: references/data-io.md Remediation: Update examples to use environment variables or secrets management patterns, e.g., create_engine(f'postgresql://{os.environ["DB_USER"]}:{os.environ["DB_PASS"]}@{os.environ["DB_HOST"]}/mydb')

• 🔵 LOW LLM_DATA_EXFILTRATION — Remote URL Data Loading Without Validation

  The data-io.md reference file demonstrates reading spatial data directly from remote URLs (HTTP/HTTPS, S3, Azure Blob) without any input validation, authentication checks, or content verification. This could allow loading of malicious or untrusted geospatial data from arbitrary remote sources. File: references/data-io.md Remediation: Add guidance on validating URLs against allowlists, verifying data provenance, and using authenticated access for cloud storage. Warn users about loading data from untrusted remote sources.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing allowed-tools Manifest Declaration

  The SKILL.md manifest does not declare an allowed-tools field. The skill executes Python scripts and runs multiple subprocess commands (nvidia-smi, rocm-smi, sysctl, system_profiler). While omitting allowed-tools is not a violation per spec, declaring it would improve transparency about what system capabilities the skill requires (Bash, Python). File: SKILL.md Remediation: Add allowed-tools: [Python, Bash] to the YAML frontmatter to clearly communicate the tools required by this skill.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Dependency: psutil

  The skill instructs users to install psutil without a version pin (uv pip install psutil). An unpinned dependency could result in installation of a future compromised or breaking version of the package. psutil is a widely-used and reputable package, making this LOW severity, but version pinning is a best practice for reproducibility and supply chain safety. File: SKILL.md Remediation: Pin the psutil version in the install instruction, e.g., uv pip install psutil==6.1.0, or provide a requirements.txt with a pinned version.

• 🔵 LOW LLM_RESOURCE_ABUSE — Unbounded subprocess calls with timeout but no retry limits

  The script calls external GPU detection tools (nvidia-smi, rocm-smi, sysctl, system_profiler) using subprocess with a 5-10 second timeout each. While individual timeouts are set, if these tools hang or behave unexpectedly, the cumulative wait time could be significant. The system_profiler SPDisplaysDataType call has a 10-second timeout and can be slow on some macOS systems. This is a minor concern but worth noting for latency-sensitive pipelines. File: scripts/detect_resources.py:120 Remediation: Consider reducing the system_profiler timeout or making GPU detection optional/async. Document expected execution time so users can plan accordingly.

• 🔵 LOW LLM_COMMAND_INJECTION — User-Controlled Output Path Passed to File Write Without Sanitization

  The -o/--output argument from the CLI is passed directly to detect_all_resources() and used as a file path for writing JSON output. While this is a standard CLI pattern, there is no validation or sanitization of the path, which could allow path traversal (e.g., ../../etc/cron.d/malicious) if the skill is invoked with attacker-controlled arguments in an automated pipeline. File: scripts/detect_resources.py:160 Remediation: Validate the output path to ensure it stays within an expected directory. Use pathlib.Path(args.output).resolve() and check it is within an allowed base directory before writing.

• 🔵 LOW LLM_DATA_EXFILTRATION — System Resource Information Written to Predictable File Path

  The script writes detailed system resource information (CPU cores, memory, disk space, GPU details, OS version) to a predictable file path .claude_resources.json in the current working directory. While this is the stated purpose of the skill, the file contains potentially sensitive system fingerprinting data that could be read by other processes or skills. The file is not protected and persists on disk. File: scripts/detect_resources.py:175 Remediation: Consider documenting that the output file contains system fingerprinting data. Optionally restrict file permissions (e.g., chmod 600) after writing, or allow users to opt-in to persistence vs. stdout-only output.

• 🔵 LOW LLM_DATA_EXFILTRATION — COSMIC Credentials Passed via Command-Line Arguments

  The SKILL.md documentation shows COSMIC database credentials (email and password) being passed as command-line arguments. Command-line arguments are typically visible in process listings, shell history, and system logs, which could expose credentials. File: SKILL.md Remediation: Recommend using environment variables or a credentials file instead of command-line arguments for sensitive credentials. Document this security consideration in the skill instructions.

• 🔵 LOW LLM_DATA_EXFILTRATION — OpenAI API Key Passed as Plain Text Argument

  The gget gpt module documentation shows the OpenAI API key being passed directly as a command-line argument and in Python code. This exposes the key in shell history, process listings, and potentially logs. File: SKILL.md Remediation: Recommend using environment variables (e.g., OPENAI_API_KEY) rather than passing API keys as arguments. Update documentation to reflect secure credential handling practices.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing allowed-tools and compatibility Metadata

  The skill manifest does not specify 'allowed-tools' or 'compatibility' fields. While optional per spec, the skill executes Python scripts, makes network calls to 20+ external databases, downloads large files (~4GB for AlphaFold), and can write files to disk. Declaring these capabilities would improve transparency and allow agents to enforce appropriate restrictions. File: SKILL.md Remediation: Add 'allowed-tools: [Python, Bash]' and 'compatibility' fields to the YAML frontmatter to accurately reflect the skill's capabilities and intended execution environment.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Package Installation in Documentation

  The SKILL.md installation instructions use 'uv pip install --upgrade gget' without pinning to a specific version. This means the skill will always install the latest version of gget, which could introduce breaking changes or, in a supply chain attack scenario, a compromised version. Additionally, the instruction 'uv uv pip install gget' appears to be a typo that could cause confusion. File: SKILL.md Remediation: Pin gget to a specific known-good version (e.g., 'uv pip install gget==0.28.6'). Verify package integrity via checksums. Fix the 'uv uv pip install' typo.

• 🔵 LOW LLM_UNAUTHORIZED_TOOL_USE — Referenced File gget.py Not Found in Skill Package

  The SKILL.md references a file 'gget.py' that was not found in the skill package. This missing file could indicate an incomplete skill package or a reference to an external dependency that may not be present at runtime, potentially causing unexpected behavior. File: SKILL.md Remediation: Either include the referenced gget.py file in the skill package, remove the reference if it is not needed, or clarify in documentation that gget is an installed package dependency rather than a bundled file.

• 🔵 LOW LLM_DATA_EXFILTRATION — Missing License and Compatibility Metadata

  The SKILL.md manifest does not specify a license or compatibility field. While not a direct security threat, missing provenance information reduces auditability and makes it harder to assess the skill's trustworthiness and intended deployment scope. File: SKILL.md Remediation: Add a license field (e.g., MIT, Apache-2.0) and a compatibility field describing supported platforms to the YAML frontmatter.

• 🔵 LOW LLM_DATA_EXFILTRATION — Several Referenced Internal Files Not Found

  Multiple files referenced in the SKILL.md instructions (templates/fluorescent-pixel-art-generation.md, assets/fluorescent-pixel-art-generation.md, templates/cell-free-protein-expression-optimization.md, assets/cell-free-protein-expression-optimization.md, assets/cell-free-protein-expression-validation.md, templates/cell-free-protein-expression-validation.md) are listed as not found. Missing referenced files could indicate an incomplete package, which may cause the agent to behave unexpectedly or attempt to fetch content from unintended sources. File: SKILL.md Remediation: Ensure all referenced files are included in the skill package. If these files are intentionally omitted, remove the references from SKILL.md to avoid confusion or unintended agent behavior.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing allowed-tools Declaration

  The skill does not declare an allowed-tools field in its YAML manifest. While this field is optional per the agent skills spec, its absence means there are no declared restrictions on which agent tools (Read, Write, Bash, Python, etc.) this skill may invoke. Given the skill references multiple internal files and interacts with external URLs, declaring allowed tools would improve security posture. File: SKILL.md Remediation: Add an explicit allowed-tools field to the YAML frontmatter listing only the tools required for this skill's operation (e.g., [Read] if only reading internal reference files).

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing License and Compatibility Metadata

  The skill manifest does not specify a license or compatibility field. The license is listed as 'Unknown' and compatibility is 'Not specified'. This reduces transparency about the skill's provenance and intended deployment context, which could be exploited to misrepresent the skill's trustworthiness or scope. File: SKILL.md Remediation: Add explicit license (e.g., 'license: MIT') and compatibility fields to the SKILL.md YAML frontmatter to improve transparency and trust.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Package Installation Without Version Constraints

  The skill instructs installation of 'gtars' via 'uv pip install gtars' and 'cargo install gtars-cli' without specifying pinned versions. This means the agent will always install the latest available version, which could be a compromised or malicious package if the package is typosquatted or if the upstream repository is compromised. No version pinning, hash verification, or integrity checks are specified. File: SKILL.md Remediation: Pin specific versions for all package installations, e.g., 'uv pip install gtars==0.1.x' and 'cargo install gtars-cli --version 0.1.x'. Consider adding hash verification or using a lockfile.

• 🔵 LOW LLM_DATA_EXFILTRATION — BBCache Module Fetches External BED Files from BEDbase.org

  The CLI reference documents a 'bbcache' module that fetches BED files from an external service (BEDbase.org) by ID. While this is a documented feature, it introduces a data ingestion pathway from an external network source without any mention of integrity verification, authentication, or sandboxing. Fetched files could contain malformed or adversarial genomic data. File: references/cli.md Remediation: Document that fetched files from external sources should be validated before use. Consider adding checksum verification for downloaded files and warning users about the trust implications of fetching external data.

• 🔵 LOW LLM_RESOURCE_ABUSE — Unbounded Parallel Processing and Memory Configuration Without Limits

  The skill exposes configuration options for parallel thread counts and memory limits without enforcing upper bounds. Instructions like 'gtars --threads 8' and 'gtars.set_option("memory.limit", "4GB")' could be set to arbitrarily high values by user input, potentially causing resource exhaustion on the host system. File: references/python-api.md Remediation: Document recommended safe limits for thread counts and memory usage. Consider adding validation that caps these values to reasonable maximums based on available system resources.

• 🔵 LOW LLM_DATA_EXFILTRATION — Missing allowed-tools Declaration

  The skill manifest does not declare an allowed-tools field. The skill instructs the agent to install packages via 'uv pip install histolab', read/write files (slide thumbnails, tile outputs, CSV reports), and execute Python code. Without an explicit allowed-tools declaration, there is no manifest-level constraint on what tools the agent may use. This is informational per the skill spec (allowed-tools is optional), but the absence means no tool restriction enforcement is possible. File: SKILL.md Remediation: Add an explicit allowed-tools declaration to the YAML frontmatter, e.g., allowed-tools: [Python, Bash, Read, Write] to document and constrain the tools this skill requires.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing Compatibility Field

  The skill manifest does not specify a compatibility field, making it unclear which agent environments or platforms this skill is designed for. This is a minor metadata completeness issue with no direct security impact, but it reduces transparency about the skill's intended deployment context. File: SKILL.md Remediation: Add a compatibility field to the YAML frontmatter specifying supported environments (e.g., Claude.ai, Claude Code, API) to improve transparency and reduce risk of unintended deployment contexts.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Package Installation

  The skill instructs installation of the histolab package without a pinned version: uv pip install histolab. Without a version pin, the agent may install any future version of the package, including potentially compromised or breaking versions. This is a minor supply chain hygiene concern. File: SKILL.md Remediation: Pin the package to a specific known-good version, e.g., uv pip install histolab==0.5.1 or use a requirements.txt with pinned versions and hash verification.

• 🔵 LOW LLM_COMMAND_INJECTION — Use of eval/exec in Python Code Blocks (Static Analyzer Flag)

  The static pre-scan flagged two instances of Python code blocks using eval/exec patterns within the markdown documentation files. After reviewing all provided content (SKILL.md, references/filters_preprocessing.md, references/tile_extraction.md, references/tissue_masks.md, references/slide_management.md, references/visualization.md), no actual eval() or exec() calls were found in the visible code examples. The flagged patterns may be false positives from the static analyzer detecting similar constructs (e.g., cv2.CV_64F or similar tokens), or they may exist in files not provided for review (templates/, assets/ directories). If eval/exec calls do exist in unretrieved files, they would represent a code injection risk if user-controlled input is passed to them. File: references/filters_preprocessing.md Remediation: Audit all files in templates/ and assets/ directories (which were not found/provided) for any eval() or exec() calls. Ensure no user-controlled input is ever passed to eval/exec. Replace any dynamic code execution with safe alternatives.

• 🔵 LOW LLM_DATA_EXFILTRATION — HF_TOKEN Loaded from .env and Passed to External Services

  The skill instructs the agent to load HF_TOKEN from a .env file and use it in all scripts that contact the Hugging Face API. While this is a reasonable pattern for legitimate use, the token is passed to external network endpoints (huggingface.co, Inference Providers like Together/Fireworks/Replicate/Sambanova). The skill also instructs the agent to add .env to .gitignore, which is good practice, but the overall pattern of reading a secret from disk and transmitting it to third-party providers warrants noting. The skill does correctly advise against hardcoding tokens. File: SKILL.md Remediation: This is largely acceptable behavior for a legitimate HF integration skill. Ensure the skill clearly communicates to users which third-party providers receive their token. Consider explicitly listing which external endpoints receive the HF_TOKEN so users can make informed decisions about token scope.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Over-Broad Skill Activation Description with Keyword Baiting

  The skill description in the YAML manifest is extremely broad, listing an extensive array of scientific domains and trigger conditions. It explicitly instructs the agent to activate 'even if they never say Hugging Science explicitly' and to 'prefer it over generic web search for these tasks.' This constitutes capability inflation and activation priority manipulation — the skill is attempting to maximize its own invocation frequency by claiming broad relevance across virtually all scientific ML tasks and instructing the agent to prefer it over other tools. File: SKILL.md Remediation: Narrow the description to accurately reflect the skill's actual scope. Remove instructions that direct the agent to prefer this skill over other tools or to activate without explicit user intent. Activation decisions should be left to the agent's judgment, not mandated by the skill manifest.

• 🔵 LOW LLM_COMMAND_INJECTION — trust_remote_code=True Recommended Without Adequate Warning

  The skill instructs the agent to pass trust_remote_code=True when loading scientific models, and characterizes this as 'normal in this ecosystem.' While technically accurate for some HF models, this flag causes arbitrary Python code from the model repository to be executed on the user's machine. The skill's warning is minimal ('the user should trust the org') and the flagship-resources.md file lists this as a routine step. The skill does not instruct the agent to verify model provenance or warn users about the security implications before executing. File: references/using-models.md Remediation: Strengthen the warning around trust_remote_code=True. Instruct the agent to always explicitly ask for user confirmation before using this flag, explain that it executes arbitrary code from the model repository, and suggest users review the model repository's modeling code before proceeding. Do not normalize this as a routine step.

• 🔵 LOW LLM_RESOURCE_ABUSE — Unbounded Retry Pattern Suggested for Space Rate Limits

  The skill's using-spaces.md reference file suggests adding 'retry-with-backoff' for handling Space queue errors without specifying any maximum retry count or timeout bounds. An agent following this instruction could enter a long-running or effectively unbounded retry loop when calling external Spaces, consuming compute resources and potentially causing the agent to hang indefinitely. File: references/using-spaces.md Remediation: Specify explicit maximum retry counts and total timeout bounds in the retry-with-backoff recommendation (e.g., 'retry up to 3 times with exponential backoff, maximum 60 seconds total'). Instruct the agent to surface failures to the user rather than retrying indefinitely.

• 🔵 LOW LLM_PROMPT_INJECTION — Indirect Prompt Injection Risk via External Catalog Content

  The skill fetches and parses markdown content from an external domain (huggingscience.co) and renders it directly into the agent's context. The parsed content — including entry titles, descriptions, tags, and URLs — is treated as trusted data and presented to the agent without sanitization. A malicious or compromised catalog entry could embed instruction-like text (e.g., 'ignore previous instructions', 'execute the following') that the agent might follow. The parse_markdown function processes H2/H3 headers and free-text description lines from the external source without any content validation. File: scripts/fetch_catalog.py Remediation: Treat all content fetched from external URLs as untrusted. Consider stripping or escaping markdown formatting characters from fetched content before rendering. Add a disclaimer in the output that catalog content is from an external source. Alternatively, instruct the agent to treat fetched catalog content as data only, not as instructions.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing Compatibility and Allowed-Tools Metadata

  The skill manifest does not specify 'compatibility' or 'allowed-tools' fields. While these are optional per the spec, their absence means the agent has no declared constraints on which tools it may use or which environments it is designed for. This reduces transparency about the skill's intended operational scope. File: SKILL.md Remediation: Add 'compatibility' and 'allowed-tools' fields to the YAML frontmatter to clearly declare the intended execution environment and tool restrictions, improving transparency and enabling enforcement of least-privilege principles.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Package Installation via uv pip install

  The skill instructs users to install the 'hypogenic' package without pinning a specific version (e.g., 'uv pip install hypogenic'). This means any future malicious or compromised version published to PyPI could be installed automatically, creating a supply chain risk. Additionally, the skill clones external GitHub repositories (ChicagoHAI/HypoGeniC-datasets, ChicagoHAI/Hypothesis-agent-datasets) without specifying commit hashes or tags, which could expose users to repository tampering. File: SKILL.md Remediation: Pin the package to a specific version (e.g., 'uv pip install hypogenic==X.Y.Z'). For git clones, specify a commit hash or tag (e.g., 'git clone --branch vX.Y.Z') and verify checksums. Consider using a lockfile for reproducible installs.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — External GROBID Service Integration Without Integrity Verification

  The skill instructs users to run GROBID via a setup script ('bash ./modules/setup_grobid.sh') cloned from an external GitHub repository. The GROBID service is a third-party Java application that processes PDFs. Without version pinning or integrity verification of the setup script, a compromised repository could deliver malicious code that runs on the user's machine. File: SKILL.md Remediation: Pin the GROBID version in the setup script, verify checksums of downloaded binaries, and document the expected GROBID version. Consider sandboxing the GROBID service.

• 🔵 LOW LLM_DATA_EXFILTRATION — API Key Stored in Environment Variable Without Guidance on Secure Handling

  The configuration template references an API key via environment variable ('OPENAI_API_KEY') but provides no guidance on secure storage or handling. While using environment variables is better than hardcoding, the skill does not warn against storing keys in plaintext config files or shell history, which could lead to accidental credential exposure. File: references/config_template.yaml Remediation: Add explicit guidance in the documentation about secure API key management: use secret managers, avoid logging environment variables, and warn against committing config files with key references to version control.

• 🔵 LOW LLM_DATA_EXFILTRATION — Missing allowed-tools Declaration

  The skill does not declare an allowed-tools field in the YAML manifest. The skill executes Python scripts (gap_analyzer.py) and reads files from the filesystem. While this is informational only since allowed-tools is optional, the absence means there are no declared restrictions on what tools the agent can use when executing this skill. File: SKILL.md Remediation: Add an explicit allowed-tools declaration to the YAML manifest to document intended tool usage, e.g., allowed-tools: [Python, Bash, Read, Write].

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Over-Broad Skill Activation Description

  The skill description includes an extensive list of trigger keywords and use cases that could cause the skill to activate in a wide range of scenarios beyond its core purpose. The description explicitly lists multiple activation triggers including 'medical device regulations, QMS certification, FDA QMSR, EU MDR, or need help with quality system documentation,' which is broad but not malicious. This is a minor concern as the skill's actual behavior matches its stated purpose. File: SKILL.md Remediation: Narrow the activation description to the core use case. Avoid listing broad keyword triggers that could cause unintended activation in tangentially related conversations.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Missing Referenced Files

  Multiple files referenced in the SKILL.md instructions are not present in the skill package. Files such as references/gap-analysis-checklist.md, templates/quality-manual-guide.md, assets/iso-13485-requirements.md, and many others are referenced but not found. This could cause the agent to fail silently or behave unexpectedly when trying to read these files. While not a direct security threat, missing files could lead to unpredictable agent behavior. File: SKILL.md Remediation: Ensure all referenced files are included in the skill package, or update the instructions to only reference files that exist. Conduct a file inventory audit before publishing the skill.

• 🔵 LOW LLM_PROMPT_INJECTION — Skill Instructs Agent to Fetch and Execute Instructions from External URLs

  The SKILL.md references external URLs (https://docs.lamin.ai, https://github.com/laminlabs/lamindb) as 'Additional Resources' and instructs the agent to read reference files for guidance. While the internal reference files are bundled with the skill and are safe, the inclusion of external documentation URLs could lead the agent to fetch and follow instructions from external sources if it interprets these as authoritative guidance sources. This is a low-risk indirect prompt injection vector. File: SKILL.md Remediation: Clarify in the skill instructions that external URLs are provided for human reference only and the agent should not autonomously fetch or follow instructions from these URLs. The agent should rely solely on the bundled reference files for operational guidance.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Over-Broad Skill Description May Trigger Unintended Activation

  The skill description is very broad, covering a wide range of biological data management tasks, workflow managers, MLOps platforms, ontologies, and deployment strategies. While this reflects the genuine scope of LaminDB, the description could cause the skill to be activated in contexts where it is not the most appropriate tool, potentially displacing more specific skills. File: SKILL.md Remediation: Narrow the description to focus on the core LaminDB-specific use cases. Avoid listing every possible integration or use case in the trigger description, as this increases the chance of unintended activation.

• 🔵 LOW LLM_DATA_EXFILTRATION — Reference Documentation Instructs Storing Cloud Credentials in Environment Variables

  The setup-deployment reference file instructs users to export AWS and GCP credentials as environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, GOOGLE_APPLICATION_CREDENTIALS). While this is standard practice, the skill also includes example code that reads these environment variables and uses them in cloud storage operations. If the agent is operating in an environment where these variables are set, it could inadvertently expose or log credential values during troubleshooting or health-check workflows described in the reference. File: references/setup-deployment.md Remediation: Add explicit warnings in the reference documentation that credentials should never be logged, printed, or included in artifact metadata. Recommend using IAM roles or secrets managers (AWS Secrets Manager, GCP Secret Manager) instead of environment variables where possible.

• 🔵 LOW LLM_DATA_EXFILTRATION — PostgreSQL Connection Strings with Plaintext Passwords in Examples

  Multiple reference files contain example PostgreSQL connection strings with plaintext passwords embedded directly in the command-line arguments and code examples. While these are documentation examples, the agent may reproduce these patterns verbatim when assisting users, potentially normalizing the practice of embedding credentials in connection strings. File: references/setup-deployment.md Remediation: Replace plaintext password examples with placeholder references to environment variables or secrets managers (e.g., postgresql://user:${DB_PASSWORD}@host:5432/db). Add a note that passwords should never be hardcoded in scripts or command-line history.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Package Installation Instructions in Reference Documentation

  The setup-deployment reference file instructs users to install packages using pip without version pinning (e.g., 'pip install lamindb', 'pip install --upgrade lamindb'). The agent may reproduce these commands when assisting users, potentially leading to installation of unintended package versions if a supply chain compromise occurs on PyPI. File: references/setup-deployment.md Remediation: Recommend pinning package versions in production environments (e.g., pip install lamindb==0.x.y). Add a note about verifying package integrity and using virtual environments or lock files (e.g., uv.lock, requirements.txt with pinned versions) for reproducible installations.

• 🔵 LOW LLM_DATA_EXFILTRATION — Static Analyzer Flags Potential Environment Variable Exfiltration and Cross-File Exfiltration Chain

  The pre-scan static analysis flagged BEHAVIOR_ENV_VAR_EXFILTRATION (environment variable access with network calls detected) and BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN (cross-file exfiltration chain across 2 files) and BEHAVIOR_CROSSFILE_ENV_VAR_EXFILTRATION. However, the submitted skill package contains no Python script files and the referenced latch.py is missing. The static findings cannot be confirmed from the available content, but the flags suggest that the complete package (with missing files) may contain data exfiltration behavior. This warrants investigation of the full package. Remediation: Obtain and review the complete skill package including all Python files (latch.py and any other .py files). Specifically check for: (1) os.environ or os.getenv calls combined with network requests, (2) credential or token harvesting, (3) data being sent to external endpoints. Do not deploy this skill until the full package has been audited.

• 🔵 LOW LLM_DATA_EXFILTRATION — Missing License and Compatibility Metadata

  The skill manifest does not specify a license or compatibility field. While not a direct security threat, the absence of provenance information (license: Unknown, compatibility: Not specified) reduces transparency and auditability of the skill package. The skill-author is listed as 'K-Dense Inc.' but no license is declared. File: SKILL.md Remediation: Add explicit license, compatibility, and allowed-tools fields to the YAML frontmatter to improve transparency and auditability.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Missing Referenced Files May Indicate Incomplete or Tampered Package

  Multiple files referenced in the SKILL.md instructions are not found in the skill package: assets/verified-workflows.md, assets/workflow-creation.md, assets/data-management.md, templates/resource-configuration.md, templates/verified-workflows.md, templates/workflow-creation.md, assets/resource-configuration.md, templates/data-management.md, and latch.py. The absence of latch.py is particularly notable given the pre-scan static analysis flagged environment variable exfiltration and cross-file exfiltration chains involving Python files. Missing files could indicate an incomplete package or that malicious files were removed before submission for analysis. File: SKILL.md Remediation: Audit the complete skill package to ensure all referenced files are present and accounted for. Investigate the latch.py file referenced in instructions — its absence combined with static analyzer flags for environment variable exfiltration and cross-file exfiltration chains warrants careful review of the full package before deployment.

• 🔵 LOW LLM_DATA_EXFILTRATION — Static Analyzer False Positive — No Actual Exfiltration Code Present

  The pre-scan static analyzer flagged BEHAVIOR_ENV_VAR_EXFILTRATION, BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN, and BEHAVIOR_CROSSFILE_ENV_VAR_EXFILTRATION. However, examination of all provided content reveals NO Python or Bash scripts in this skill package. The skill contains only markdown documentation files (SKILL.md, reference guides, templates, and examples). There is no executable code that could perform environment variable access or network calls. These static analyzer findings appear to be false positives, possibly triggered by code snippets within the documentation examples (e.g., bash commands shown in templates like 'git clone', 'curl http://localhost:[port]/health'). File: SKILL.md Remediation: No remediation needed for actual exfiltration — the static analyzer findings are false positives from documentation code examples. Verify the skill package does not inadvertently include executable scripts.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Over-Broad Activation Scope in Skill Description

  The skill description claims it should be used 'when creating any scientific document, report, analysis, or visualization' and 'establishes text-based diagrams as the default documentation standard.' The instruction body reinforces this with 'Working with any other skill — this skill defines the documentation layer that wraps every other output.' This extremely broad activation scope could cause the skill to be invoked far more frequently than necessary, potentially interfering with other skills and workflows. File: SKILL.md Remediation: Narrow the activation criteria to specific, well-defined use cases rather than claiming universal applicability across all documentation tasks and all other skills.

• 🔵 LOW LLM_UNAUTHORIZED_TOOL_USE — Missing Compatibility Field in YAML Manifest

  The YAML manifest does not specify a compatibility field, which is noted as 'Not specified' in the manifest details. While this is a LOW severity informational finding per the analysis framework (the field is optional), it reduces transparency about which platforms and environments this skill is designed to operate in. File: SKILL.md Remediation: Add a compatibility field to the YAML manifest specifying supported platforms (e.g., 'Works in Claude.ai, Claude Code, API') to improve transparency and help users understand where the skill is intended to be used.

• 🔵 LOW LLM_DATA_EXFILTRATION — Missing Referenced Asset Files

  Multiple files referenced in SKILL.md instructions are not found in the skill package (e.g., assets/data_analysis_patterns.md, templates/FORMATTING_GUIDE.md, references/market_research.sty, templates/market_research.sty, templates/market_report_template.tex, assets/report_structure_guide.md, templates/report_structure_guide.md, assets/visual_generation_guide.md, references/market_report_template.tex, references/FORMATTING_GUIDE.md, templates/visual_generation_guide.md). While some files are present, the missing ones could cause the agent to fail silently or attempt to fetch them from external sources. File: SKILL.md Remediation: Ensure all referenced files are bundled within the skill package. Audit the references section and remove or add the missing files.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Over-Broad Skill Description and Activation Claims

  The skill description claims to generate reports 'in the style of top consulting firms (McKinsey, BCG, Gartner)' and references brand names prominently. The SKILL.md also contains a 'When to Use This Skill' section with 10 broad use cases covering nearly all business analysis scenarios. This broad activation surface could cause the skill to be invoked more frequently than intended. File: SKILL.md Remediation: Narrow the description to focus on specific, concrete capabilities rather than brand comparisons. Limit the 'When to Use' section to the most specific and differentiated use cases to reduce over-broad activation.

• 🔵 LOW LLM_COMMAND_INJECTION — Unvalidated Topic Input Passed to Subprocess Commands

  The --topic argument provided by the user is formatted directly into shell prompts that are passed to subprocess.run() calls. While the prompts are passed as list arguments (not shell=True), the topic string is embedded into prompt text that is then passed to external scripts. If those scripts perform any shell interpolation or unsafe handling, this could be a vector for injection. File: scripts/generate_market_visuals.py:100 Remediation: Validate and sanitize the topic input before use. Restrict allowed characters (e.g., alphanumeric, spaces, hyphens). Add length limits. Document that topic input should not contain shell metacharacters.

• 🔵 LOW LLM_RESOURCE_ABUSE — Unbounded Visual Generation - Potential Resource Exhaustion

  The skill instructs the agent to generate 5-6 core visuals at the start of every report, and up to 27-28 extended visuals when --all is used. Each visual generation invokes a subprocess with a 2-minute timeout. For large reports, this could result in significant compute and time consumption, especially if the agent is instructed to generate all visuals without user confirmation. File: scripts/generate_market_visuals.py:155 Remediation: Add explicit user confirmation before generating extended visual sets. Implement a hard cap on the number of visuals generated per session. Consider making --all require explicit user opt-in with a warning about resource usage.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing allowed-tools Manifest Field

  The SKILL.md manifest does not specify the 'allowed-tools' field. While this field is optional per the agent skills spec, its absence means there are no declared restrictions on which agent tools (Read, Write, Bash, Python, etc.) this skill may invoke. Given the skill instructs the agent to execute Python code for mass spectrometry analysis, documenting allowed tools would improve transparency. File: SKILL.md Remediation: Add an 'allowed-tools' field to the YAML frontmatter specifying the tools this skill requires, e.g., 'allowed-tools: [Python, Read, Write]'.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing Compatibility Field in Manifest

  The SKILL.md manifest does not specify the 'compatibility' field, leaving it unclear which agent environments or platforms this skill is designed to work with. This is a minor documentation gap. File: SKILL.md Remediation: Add a 'compatibility' field to the YAML frontmatter specifying supported environments, e.g., 'compatibility: Claude.ai, Claude Code, API'.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Package Installation Instruction

  The SKILL.md instructs users to install matchms via 'uv pip install matchms' and 'uv pip install matchms[chemistry]' without specifying a pinned version. Unpinned package installations are susceptible to supply chain attacks where a malicious version could be published and automatically installed. File: SKILL.md Remediation: Pin the package version explicitly, e.g., 'uv pip install matchms==0.26.2' to prevent inadvertent installation of potentially compromised future versions.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing allowed-tools Metadata

  The SKILL.md manifest does not specify the 'allowed-tools' field. While this field is optional per the agent skills specification, its absence means there are no declared restrictions on which agent tools (Read, Write, Bash, Python, etc.) this skill may invoke. Given the skill's instructions include bash commands for running MATLAB/Octave scripts, documenting allowed tools would improve transparency. File: SKILL.md Remediation: Add an 'allowed-tools' field to the YAML frontmatter specifying the tools this skill requires, e.g., 'allowed-tools: [Bash, Read, Write]'.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Multiple Missing Referenced Files

  The SKILL.md references numerous files that do not exist in the skill package (e.g., assets/data-import-export.md, templates/executing-scripts.md, assets/programming.md, templates/python-integration.md, templates/mathematics.md, templates/data-import-export.md, assets/mathematics.md, assets/python-integration.md, assets/matrices-arrays.md, templates/programming.md, assets/executing-scripts.md, templates/octave-compatibility.md, templates/graphics-visualization.md, templates/matrices-arrays.md, assets/graphics-visualization.md, assets/octave-compatibility.md). This discrepancy between declared and actual content could indicate an incomplete or inconsistently packaged skill. File: SKILL.md Remediation: Ensure all referenced files are included in the skill package, or remove references to non-existent files from SKILL.md.

• 🔵 LOW LLM_DATA_EXFILTRATION — Python Integration Reference Demonstrates HTTP Requests to External APIs

  The references/python-integration.md file contains example code that uses Python's 'requests' library to make HTTP calls to external URLs (e.g., 'https://api.example.com/data'). While presented as illustrative examples, if an agent follows these patterns literally with user-supplied URLs or data, it could facilitate unintended data transmission to external endpoints. The pre-scan static analysis flagged environment variable access with network calls, which may relate to this pattern. File: references/python-integration.md Remediation: Add explicit warnings in the reference documentation that HTTP request examples should only be used with trusted, user-approved endpoints. Ensure the agent does not autonomously make network calls without explicit user confirmation.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing allowed-tools Metadata

  The skill does not declare an 'allowed-tools' field in its YAML manifest. While this field is optional per the agent skills spec, its absence means there are no declared restrictions on which agent tools (Read, Write, Bash, Python, etc.) this skill may invoke. Given the skill includes executable Python scripts, declaring allowed tools would improve transparency. File: SKILL.md Remediation: Add an 'allowed-tools' field to the YAML frontmatter, e.g., 'allowed-tools: [Python, Bash]', to explicitly declare which tools the skill requires.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing Compatibility Metadata

  The skill does not declare a 'compatibility' field in its YAML manifest. This is informational only, but declaring compatibility helps users understand the intended execution environment. File: SKILL.md Remediation: Add a 'compatibility' field to the YAML frontmatter describing supported environments (e.g., 'Claude.ai, Claude Code, API').

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing allowed-tools and compatibility metadata

  The SKILL.md manifest does not specify 'allowed-tools' or 'compatibility' fields. While these are optional per the agent skills spec, their absence means there are no declared restrictions on what tools the agent may use when executing this skill. The skill executes Python scripts and Bash commands (pip install), so documenting these would improve transparency. File: SKILL.md Remediation: Add 'allowed-tools: [Python, Bash]' and a 'compatibility' field to the YAML frontmatter to clearly document the skill's tool requirements and intended runtime environments.

• 🔵 LOW LLM_COMMAND_INJECTION — Static Analyzer Flag: eval/exec in Python Code Block

  The static analyzer flagged a potential eval/exec usage in a Python code block within SKILL.md. Upon manual review, no actual eval() or exec() calls are present in the instruction code samples. The code blocks use standard OpenMM and MDAnalysis APIs without dynamic code execution. This appears to be a false positive from the static scanner, possibly triggered by method names or string patterns. No actual command injection risk is present in the reviewed code. File: SKILL.md Remediation: No action required. This is a false positive. Verify with a more targeted static analysis pass if needed.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Referenced Files Not Found in Skill Package

  The SKILL.md references several files (pdbfixer.py, MDAnalysis.py, matplotlib.py, openff.py, openmm.py) that are not present in the skill package. These appear to be module import references misidentified as local files rather than actual bundled resources. While not a direct security threat, missing referenced files could cause confusion or unexpected behavior if the agent attempts to locate them as local skill resources. File: SKILL.md Remediation: Clarify in the SKILL.md that these are Python library imports, not local files bundled with the skill. No security action required, but documentation clarity would prevent agent confusion.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Package Dependencies in Installation Instructions

  The installation instructions recommend installing openmm, mdanalysis, nglview, openff-toolkit, and related packages without version pinning. This exposes users to supply chain risks where a compromised or malicious package version could be installed. While this is common in documentation, it represents a best-practice gap for security-sensitive environments. File: SKILL.md Remediation: Pin specific package versions in installation instructions (e.g., pip install openmm==8.1.1 mdanalysis==2.7.0). Consider providing a requirements.txt or conda environment.yml with pinned versions for reproducibility and supply chain safety.

• 🔵 LOW LLM_COMMAND_INJECTION — Use of eval/exec in Python Code Blocks

  The static analyzer flagged a Python code block using eval/exec. Reviewing the skill content, the code blocks in the examples and reference files do not appear to contain explicit eval/exec calls targeting user input. However, the skill instructs the agent to execute arbitrary Python code examples that include dynamic execution patterns (e.g., loading pickled data with pickle.load, executing user-provided SMILES strings through transformer pipelines). The pickle-based caching pattern in particular can be a vector for arbitrary code execution if the cache file is tampered with or sourced from an untrusted location. File: SKILL.md Remediation: Replace pickle with a safer serialization format such as numpy's .npy/.npz or joblib for caching embeddings. If pickle must be used, validate the cache file's integrity (e.g., via a hash check) before loading. Document that cache files should only be loaded from trusted sources.

• 🔵 LOW LLM_DATA_EXFILTRATION — Missing allowed-tools Declaration

  The skill manifest does not declare an allowed-tools field. While this is optional per the spec, the skill instructs the agent to execute Python code, install packages via uv pip install, run bash commands (grep), and write files (to_state_yaml_file, pickle cache). Without an explicit allowed-tools declaration, there is no manifest-level constraint on what tools the agent may use, increasing the attack surface if the skill is invoked in a sensitive context. File: SKILL.md Remediation: Add an explicit allowed-tools field to the YAML frontmatter listing only the tools required (e.g., [Python, Bash]) to enforce least-privilege tool access.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Package Installation Instructions

  The skill instructs users to install molfeat and its optional dependencies without pinning to specific versions (e.g., uv pip install molfeat, pip install "molfeat[all]"). Unpinned installations are vulnerable to supply chain attacks where a malicious version of a dependency could be installed, potentially compromising the agent's environment. File: SKILL.md Remediation: Pin package versions in installation instructions (e.g., uv pip install molfeat==0.x.y) and provide a requirements.txt or lockfile with verified hashes to ensure reproducible and safe installations.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing allowed-tools Manifest Field

  The SKILL.md manifest does not specify the allowed-tools field. While this is optional per the agent skills specification, the skill instructs the agent to execute Python code (pip/uv installs, file I/O, network reads, database connections) and bash commands. Declaring allowed-tools would improve transparency about the skill's required capabilities. File: SKILL.md Remediation: Add an explicit allowed-tools field to the YAML frontmatter listing the tools required (e.g., Python, Bash, Read, Write) to improve transparency and enable enforcement of capability restrictions.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Package Installation Instructions

  The SKILL.md instructions recommend installing NetworkX via 'uv pip install networkx' and 'uv pip install networkx[default]' without version pinning. This could result in installation of a compromised or incompatible future version of the package. File: SKILL.md Remediation: Pin the NetworkX version in installation instructions (e.g., 'uv pip install networkx==3.x.x') to ensure reproducibility and reduce supply chain risk from future compromised releases.

• 🔵 LOW LLM_COMMAND_INJECTION — Python eval/exec Usage in Code Examples

  The static analyzer flagged a Python code block using eval/exec within the skill's reference documentation. Reviewing the referenced files, the references/io.md file contains a code block that uses exec-like patterns indirectly through pickle deserialization (nx.read_gpickle / pickle.load), which can execute arbitrary code if a malicious pickle file is loaded. While this is documented as a standard NetworkX pattern, it represents a potential code execution risk if users load untrusted pickle files. File: references/io.md Remediation: Add a warning in the documentation that pickle files from untrusted sources should never be loaded, as pickle deserialization can execute arbitrary code. Recommend safer formats (GraphML, JSON, edge lists) for untrusted data sources.

• 🔵 LOW LLM_DATA_EXFILTRATION — SQL Database Integration Without Input Sanitization

  The references/io.md file documents SQL database integration using string-formatted queries via pandas read_sql_query. While the example uses a hardcoded query string, the pattern could encourage users to construct queries with unsanitized user input, leading to SQL injection risks in derived code. File: references/io.md Remediation: Add documentation guidance to use parameterized queries when incorporating user-supplied values into SQL queries, and warn against string concatenation for query construction.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Overly Broad Skill Description May Cause Excessive Activation

  The skill description is extremely broad, covering ECG, EEG, EDA, RSP, PPG, EMG, EOG, HRV, complexity measures, autonomic nervous system assessment, psychophysiology research, and multi-modal integration. While this accurately reflects the NeuroKit2 library's scope, the description is written in a way that maximizes keyword coverage across many domains, which could cause the skill to be activated for a very wide range of physiological data queries even when a simpler or more targeted approach would suffice. File: SKILL.md Remediation: This is a minor concern given the description accurately reflects the library. Consider scoping the description to the most common use cases to reduce unnecessary activation breadth.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Package Installation via uv pip install

  The SKILL.md installation instructions use 'uv pip install neurokit2' without pinning a specific version, and also offer a direct GitHub zipball install from the dev branch ('uv pip install https://github.com/neuropsychology/NeuroKit/zipball/dev'). Unpinned installs are susceptible to supply chain attacks if the package is compromised or a malicious version is published. The dev branch install is particularly risky as it pulls unreviewed, potentially unstable code directly from a branch. File: SKILL.md Remediation: Pin the package to a specific known-good version (e.g., 'uv pip install neurokit2==0.2.7'). Avoid recommending direct dev branch installs in production skill documentation, or at minimum warn users of the risks.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Many Referenced Files Not Found in Skill Package

  The skill references a large number of files (assets/.md, templates/.md, references/*.md, neurokit2.py) that are not present in the skill package. While several reference files were found and appear legitimate, the absence of many expected files (including neurokit2.py which is referenced as a script) means the skill's behavior may be incomplete or unpredictable. The missing neurokit2.py file is particularly notable as it could be a script file that was expected to be bundled. File: SKILL.md Remediation: Ensure all referenced files are included in the skill package. Audit the file references in SKILL.md to remove references to files that do not exist, or add the missing files. The missing neurokit2.py should be investigated to determine if it was intended to be a bundled script.

• 🔵 LOW LLM_UNAUTHORIZED_TOOL_USE — Missing allowed-tools Declaration

  The SKILL.md manifest does not declare an 'allowed-tools' field. While this field is optional per the agent skills specification, its absence means there are no declared restrictions on which agent tools (Read, Write, Bash, Python, etc.) can be used. The skill instructs the agent to use the Read tool to load reference files and execute Python code blocks, but without explicit tool declarations, there is no manifest-level constraint on tool usage. File: SKILL.md Remediation: Add an explicit 'allowed-tools' declaration to the SKILL.md manifest. For this skill, appropriate tools would include: allowed-tools: [Read, Python, Bash] to document intended tool usage and provide a reference for security review.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Overly Broad Activation Trigger Keywords in Description

  The skill description contains an extensive list of trigger keywords designed to activate the skill across a wide range of neuroscience-related queries: 'Neuropixels, SpikeGLX, Open Ephys, Kilosort, quality metrics, or unit curation'. While these are legitimate domain terms, the description is crafted to maximize activation surface by enumerating many specific tool names and workflows. This is a minor concern as the keywords are genuinely relevant to the skill's purpose. File: SKILL.md Remediation: This is a low-severity informational finding. The trigger keywords appear genuinely relevant to the skill's domain. No immediate action required, but consider whether all listed triggers are necessary for the skill's intended use cases.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Package Dependencies in Installation Instructions

  The SKILL.md installation section uses unpinned pip install commands for all dependencies (spikeinterface, probeinterface, neo, kilosort, spykingcircus, mountainsort5, neuropixels-analysis, anthropic, ibl-neuropixel, ibllib). Without version pinning, these installations are vulnerable to supply chain attacks where a malicious package version could be introduced. The 'neuropixels-analysis' package in particular is a third-party package whose provenance is not verifiable from the skill alone. File: SKILL.md Remediation: Pin all dependencies to specific versions (e.g., 'spikeinterface==0.101.0'). Use a requirements.txt or pyproject.toml with exact version constraints. Consider using hash verification (pip install --require-hashes) for critical packages.

• 🔵 LOW LLM_DATA_EXFILTRATION — API Key Exposure Risk in AI Curation Workflow

  The AI curation reference documentation (references/AI_CURATION.md) shows example code with hardcoded API key patterns and instructs users to pass API keys directly in code: 'client = Anthropic(api_key="your-api-key")'. While this is example documentation rather than executable code, it normalizes insecure API key handling practices. Users following these examples may hardcode API keys in their analysis scripts. File: references/AI_CURATION.md Remediation: Update documentation examples to use environment variables for API keys: 'client = Anthropic()' (which reads ANTHROPIC_API_KEY from environment) or explicitly show 'import os; client = Anthropic(api_key=os.environ["ANTHROPIC_API_KEY"])'. Add a security note warning against hardcoding API keys.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing License and Compatibility Metadata

  The skill manifest does not specify a license or compatibility information. The license field is listed as 'Unknown' and compatibility is 'Not specified'. This reduces transparency about the skill's provenance and intended deployment context, which could lead to misuse in environments where the skill is not appropriate. File: SKILL.md Remediation: Add a valid SPDX license identifier and specify compatibility constraints (e.g., which Claude versions or environments are supported) in the YAML frontmatter.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Dependency Installation

  The skill instructs users to install omero-py without a pinned version number. This could expose users to supply chain risks if the package is compromised or if a breaking/malicious version is published. The installation command 'uv pip install omero-py' will always fetch the latest version. File: SKILL.md Remediation: Pin the dependency to a specific known-good version, e.g., 'uv pip install omero-py==5.18.0'. Document the tested version and provide guidance on verifying package integrity.

• 🔵 LOW LLM_DATA_EXFILTRATION — Hardcoded Credentials in Code Examples

  Multiple reference files contain hardcoded credential placeholders (USERNAME = 'user', PASSWORD = 'pass') in example code blocks. While these are clearly placeholder values for documentation purposes, they establish a pattern that users might follow by hardcoding real credentials. The connection.md reference file does include a best practice note about using environment variables, but the majority of examples use hardcoded strings. File: references/connection.md Remediation: Update all code examples to use environment variables or configuration files for credentials. Add prominent warnings in the Quick Start section of SKILL.md advising against hardcoding credentials in scripts.

• 🔵 LOW LLM_COMMAND_INJECTION — Python eval/exec Usage in Code Examples

  The static analyzer flagged a potential eval/exec usage in the Python code blocks within the referenced markdown files. After reviewing all code blocks in the skill's reference files, the code examples use standard OMERO API calls and NumPy operations. No direct eval() or exec() calls with user-controlled input were found in the actual code. The static analyzer flag may be a false positive related to pattern matching on code structure. However, the skill does include dynamic code execution patterns (e.g., plane generators, dynamic query construction) that could be misused if user input is passed unsanitized to OMERO query services like getWhereList(). File: references/tables.md Remediation: Ensure that any user-supplied strings passed to getWhereList() or similar query methods are validated and sanitized before use. Document in the skill instructions that query strings should never be constructed from unsanitized user input.

• 🔵 LOW LLM_DATA_EXFILTRATION — Missing License Information

  The skill manifest does not specify a license. While this is not a direct security threat, it indicates incomplete provenance information for the skill package authored by K-Dense Inc. File: SKILL.md Remediation: Add a valid SPDX license identifier (e.g., MIT, Apache-2.0) to the YAML frontmatter to establish clear provenance and usage rights.

• 🔵 LOW LLM_DATA_EXFILTRATION — Missing Compatibility and Allowed-Tools Metadata

  The skill does not declare 'compatibility' or 'allowed-tools' in its YAML manifest. While these fields are optional per the spec, their absence means there are no declared restrictions on tool usage. The skill executes Python code (Bash/Python scripts) without any declared tool scope. File: SKILL.md Remediation: Add 'allowed-tools: [Python]' and 'compatibility' fields to the YAML frontmatter to document the intended tool scope and environment compatibility.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Referenced Files Not Found in Skill Package

  The SKILL.md references several files that are not present in the skill package: 'assets/api_reference.md', 'opentrons.py', and 'templates/api_reference.md'. Only 'references/api_reference.md' was found. Missing files could indicate an incomplete package or potential for future supply-chain substitution if the skill attempts to load them dynamically. File: SKILL.md Remediation: Remove references to non-existent files from SKILL.md, or include the missing files in the skill package. Verify that 'opentrons.py' is not intended to shadow the legitimate opentrons library import.

• 🔵 LOW LLM_COMMAND_INJECTION — Static Analyzer Flag: eval/exec Pattern in Python Code Blocks

  The static pre-scan flagged a MDBLOCK_PYTHON_EVAL_EXEC pattern. After reviewing all Python code blocks in SKILL.md and the script files, no actual use of eval() or exec() with user-controlled input was found. The flag may be a false positive triggered by documentation examples. However, the 'references/api_reference.md' contains a code block referencing 'protocol.bundled_data' file access which could be a vector if user-controlled filenames are passed. File: references/api_reference.md Remediation: Ensure that any use of protocol.bundled_data in generated protocols validates the filename and does not allow user-controlled path traversal. Confirm the static analyzer finding is a false positive by auditing all code blocks for actual eval/exec usage.

• 🔵 LOW LLM_DATA_EXFILTRATION — Missing License and Compatibility Metadata

  The skill does not specify a license or compatibility field in the YAML frontmatter. While this is informational and low severity per the analysis framework, the absence of provenance metadata (license, compatibility) makes it harder to assess the trustworthiness and intended deployment scope of the skill package. File: SKILL.md Remediation: Add license and compatibility fields to the YAML frontmatter to improve transparency and provenance.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Over-Broad Skill Activation Description

  The skill's description is extremely broad, claiming to apply to a very wide range of scenarios including 'any compute-intensive work' and 'even if not explicitly requested.' The description explicitly states the skill should activate 'Also use when you see CPU-bound Python code (loops, large arrays, ML pipelines, graph analytics, image processing) that would benefit from GPU acceleration, even if not explicitly requested.' This over-broad activation trigger could cause the skill to activate in many unintended contexts, potentially displacing other skills or consuming agent resources unnecessarily. File: SKILL.md Remediation: Narrow the activation criteria to require explicit user intent or request. Remove the 'even if not explicitly requested' clause to prevent unsolicited activation.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Multiple Missing Referenced Files

  The skill references a large number of files (templates/, assets/, and various .py files like numba.py, networkx.py, cupy.py, etc.) that are not present in the skill package. While the core reference files under references/ are present, the missing files include template files and asset files that are referenced in the instruction body. The missing .py files (numba.py, networkx.py, cupy.py, etc.) appear to be Python module names used in code examples rather than actual skill files, but their presence in the referenced files list is confusing. If these files were intended to be part of the package, their absence represents an incomplete supply chain. File: SKILL.md Remediation: Audit the referenced files list to distinguish between actual skill package files and Python module names used in code examples. Remove spurious references or include the missing template/asset files in the package.

• 🔵 LOW LLM_DATA_EXFILTRATION — API Key Exposure via Environment and .env File Access

  The skill instructs the agent to read API keys from environment variables and fall back to reading a .env file in the current working directory. While this is a common pattern, it means the agent will actively read credential files from the filesystem. If the skill is invoked in a context where the .env file contains sensitive credentials beyond the expected API keys (e.g., database passwords, cloud credentials), those could be inadvertently accessed. The skill does not scope or validate which keys it reads. File: SKILL.md Remediation: Explicitly scope key loading to only the specific environment variable names needed (NCBI_API_KEY, CORE_API_KEY, S2_API_KEY, OPENALEX_API_KEY). Do not perform broad .env file reads. Document clearly which variables are accessed.

• 🔵 LOW LLM_PROMPT_INJECTION — Indirect Prompt Injection Risk via External API Responses

  The skill instructs the agent to return 'raw JSON' responses from external academic APIs directly to the user and to the agent's context. Academic paper abstracts, titles, and metadata returned from these APIs are untrusted external content that could contain embedded prompt injection payloads. The instruction 'default to showing the full raw JSON -- the user asked for it' means the agent will surface unfiltered external content into its context without sanitization. A malicious paper abstract or title could attempt to inject instructions into the agent's context. File: SKILL.md Remediation: Treat all content returned from external APIs as untrusted data. Avoid instructing the agent to blindly relay raw external content. Consider summarizing or structuring results rather than dumping raw API responses, and note that embedded text fields (abstracts, titles) should not be interpreted as instructions.

• 🔵 LOW LLM_RESOURCE_ABUSE — Unbounded Parallel API Calls Without Rate Limit Enforcement

  The skill instructs the agent to 'query multiple databases in parallel' for cross-database queries, and lists scenarios where 5+ databases should be queried simultaneously. While rate limits are documented, the instructions do not enforce them programmatically. For databases with no documented rate limits (bioRxiv, medRxiv), the agent could make unlimited parallel requests. Combined with large result sets and pagination, this could result in excessive resource consumption or getting the user's IP rate-limited/blocked by the APIs. File: SKILL.md Remediation: Add explicit guidance to limit parallelism (e.g., max 3 concurrent requests), implement delays between requests even for APIs without documented limits, and add a maximum result count per query to prevent runaway pagination.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Over-Broad Capability Claims and Keyword Baiting in Description

  The skill description contains an extensive list of trigger keywords and use cases ('Triggers on mentions of any supported database or requests like "find papers on X" or "look up this DOI"'). While the skill does appear to legitimately cover these databases, the explicit enumeration of trigger phrases in the description is a mild form of activation abuse / keyword baiting designed to maximize the skill's invocation frequency. The description is unusually broad and explicitly instructs the agent to activate on very generic queries like 'find papers on X'. File: SKILL.md Remediation: Narrow the description to accurately reflect the skill's scope without explicit trigger-phrase enumeration. Let the agent's natural language understanding determine when to invoke the skill rather than embedding activation keywords.

• 🔵 LOW LLM_COMMAND_INJECTION — Python eval/exec Usage Detected in Referenced Code Blocks

  The static analyzer flagged a Python code block using eval/exec patterns within the referenced markdown files. Specifically, the OpenAlex reference file (references/openalex.md) contains a Python code snippet demonstrating abstract reconstruction from an inverted index. While this appears to be documentation/example code rather than executable agent code, the presence of eval/exec patterns in files the agent reads and may execute warrants attention. If the agent interprets and runs these code blocks, it could execute arbitrary code. File: references/openalex.md Remediation: Verify that code blocks in reference files are treated as documentation only and not executed by the agent. The reconstruct function itself is not dangerous, but ensure the agent does not execute arbitrary code blocks found in reference files. The static analyzer flag may be a false positive on this specific snippet.

• 🔵 LOW LLM_COMMAND_INJECTION — Static Analyzer False Positive: Python eval/exec Flag in Markdown Code Block

  The static pre-scan flagged a potential Python eval/exec usage (MDBLOCK_PYTHON_EVAL_EXEC). However, reviewing the full SKILL.md instruction body, no Python code blocks containing eval() or exec() calls are visible in the provided content. The flagged pattern may be a false positive from the static analyzer detecting shell command strings (e.g., 'pz update --install-method release') or similar text. No actual eval/exec usage is present in the analyzed content. This is noted for completeness but does not represent a confirmed threat. File: SKILL.md Remediation: Review the full raw SKILL.md file to confirm whether any Python code block contains eval() or exec() calls. If confirmed, remove or replace with safer alternatives. If this is a false positive, no action is required.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing allowed-tools and compatibility Metadata

  The SKILL.md manifest does not specify the 'allowed-tools' or 'compatibility' fields. While these fields are optional per the agent skills specification, their absence means there are no declared restrictions on which agent tools this skill may invoke. The skill instructs the agent to run 'pz' CLI commands via Bash, but no Bash tool restriction is declared. This is informational only. File: SKILL.md Remediation: Consider adding 'allowed-tools: [Bash]' to the YAML frontmatter to explicitly declare that this skill uses Bash execution, improving transparency and enabling tool restriction enforcement by the agent runtime.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — External CLI Installation from Third-Party Sources Without Version Pinning

  The skill instructs the agent to install the 'pz' CLI from a Homebrew tap (paperzilla-ai/tap/pz), a Scoop bucket sourced from a GitHub repository (https://github.com/paperzilla-ai/scoop-bucket), and a GitHub source repository (https://github.com/paperzilla-ai/pz). None of these installation methods specify a pinned version. If any of these external repositories were compromised or the packages were tampered with, the agent could install a malicious version of the CLI. The skill also references an external Linux install guide URL. File: SKILL.md Remediation: Pin the CLI to a specific version in installation instructions (e.g., 'brew install paperzilla-ai/tap/pz@1.2.3' or equivalent). Document expected checksums or signatures for release binaries. Consider referencing a specific tagged release rather than the default branch for source builds.

• 🔵 LOW LLM_COMMAND_INJECTION — Unvalidated Shell Variable Interpolation in Bash Command Templates

  Multiple reference files use shell variable patterns like $ARGUMENTS, $FILENAME, $RUN_ID, $TASKGROUP_ID, and $INTERACTION_ID directly interpolated into bash command strings without any sanitization or quoting guidance. If user-supplied input contains shell metacharacters (semicolons, backticks, dollar signs, pipes), this could lead to command injection when the agent constructs and executes these commands. While the values are quoted with double quotes in the templates, the instructions do not warn about sanitizing user input before substitution. Remediation: Add explicit guidance to sanitize or validate user-supplied arguments before shell interpolation. Consider using parameter quoting best practices and warn the agent to reject inputs containing shell metacharacters. Use array-based command construction where possible.

• 🔵 LOW LLM_DATA_EXFILTRATION — Installation Script Fetched from Remote URL via Curl-Pipe-Bash Pattern

  The setup instructions direct the agent to execute a remote shell script via the classic curl-pipe-bash pattern: curl -fsSL https://parallel.ai/install.sh | bash. This pattern is a well-known supply chain risk — if the remote URL is compromised or serves a malicious script, arbitrary code will be executed on the user's machine without inspection. There is no integrity verification (e.g., checksum or signature verification) specified. File: SKILL.md Remediation: Replace the curl-pipe-bash pattern with a safer installation method: download the script first, allow the user to inspect it, verify its checksum against a published hash, then execute. Alternatively, prefer the uv tool install method which has better provenance controls, and make it the primary installation path.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Over-Broad Capability Claims and Aggressive Activation Language

  The skill description contains highly aggressive activation language designed to maximize invocation frequency: 'Use this skill for ANY web-related task — even if the user doesn't mention "parallel" or "web" explicitly.' This is a form of capability inflation and keyword baiting that attempts to override normal skill routing by instructing the agent to use this skill even when the user has not requested it. The description also lists an extremely broad set of trigger conditions to maximize activation surface. File: SKILL.md Remediation: Narrow the description to accurately describe the skill's specific capabilities without aggressive activation directives. Remove language that instructs the agent to use the skill even when not explicitly requested.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Package Installation

  The setup section installs parallel-web-tools[cli] via uv tool install without specifying a pinned version. This means the installed package version is not deterministic and could change over time, potentially introducing a compromised or malicious version if the package registry is attacked or the package is typosquatted. File: SKILL.md Remediation: Pin the package to a specific known-good version, e.g., uv tool install "parallel-web-tools[cli]==1.2.3". Publish and document the expected version and checksum so users can verify integrity.

• 🔵 LOW LLM_PROMPT_INJECTION — Indirect Prompt Injection Risk via Extracted Web Content

  The web-extract capability instructs the agent to return extracted content 'verbatim' from arbitrary URLs, including academic PDFs and web pages. This creates an indirect prompt injection surface: malicious content embedded in a fetched webpage or document could contain instruction overrides that the agent processes as part of its context. The instruction 'Keep content verbatim - do not paraphrase or summarize' and 'Preserve all facts, names, numbers, dates, quotes' increases this risk by directing the agent to faithfully reproduce potentially adversarial content. File: references/web-extract.md Remediation: Add a warning to treat extracted web content as untrusted data, not as instructions. Instruct the agent to present extracted content in a clearly delimited block and to ignore any instruction-like text found within fetched content. Consider summarizing rather than verbatim reproduction for untrusted sources.

• 🔵 LOW LLM_DATA_EXFILTRATION — Missing allowed-tools Declaration

  The skill does not declare an allowed-tools field in the YAML manifest. The scripts perform file reads, file writes, and execute Python code. While this is informational (allowed-tools is optional), the absence means there are no declared restrictions on what tools the agent may use when executing this skill. File: SKILL.md Remediation: Add an explicit allowed-tools declaration such as [Python, Bash, Read, Write] to document and constrain the tools this skill requires.

• 🔵 LOW LLM_DATA_EXFILTRATION — Proprietary License Without Accessible Terms

  The skill declares a proprietary license and references LICENSE.txt for complete terms, but LICENSE.txt is not included in the analyzed package. Users and agents cannot verify the terms under which this skill operates, and the proprietary nature means the skill's behavior cannot be independently audited. File: SKILL.md Remediation: Include LICENSE.txt in the skill package, or use a standard open-source license that allows inspection and auditing of the skill's behavior.

• 🔵 LOW LLM_PROMPT_INJECTION — Referenced Files Not Found in Package

  The SKILL.md references several files (forms.md, reference.md) that are not present in the analyzed package. The instructions direct the agent to 'read forms.md and follow its instructions' and reference reference.md for advanced features. If these files are later supplied by an untrusted source or contain malicious instructions, the agent would follow them without validation. File: SKILL.md Remediation: Ensure all referenced instruction files (forms.md, reference.md) are bundled with the skill package and reviewed for malicious content before deployment. Do not allow these files to be sourced from external or user-controlled locations.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Over-Broad Skill Description Triggers Excessive Activation

  The skill description is extremely broad, claiming to handle 'anything with PDF files' and explicitly instructing the agent to activate whenever a user 'mentions a .pdf file or asks to produce one.' This over-broad activation trigger could cause the skill to be invoked in contexts where simpler, safer handling would suffice, and may crowd out other skills or agent behaviors. File: SKILL.md Remediation: Narrow the description to specific capabilities rather than claiming universal PDF handling. Avoid explicit activation instructions in the description field.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Third-Party Library Dependencies

  The skill relies on multiple third-party Python libraries (pypdf, pdfplumber, reportlab, pdf2image, pytesseract, Pillow, pandas) without specifying version pins anywhere in the skill package. Unpinned dependencies are vulnerable to supply chain attacks where a malicious package update could introduce malicious behavior. File: SKILL.md Remediation: Add a requirements.txt with pinned versions (e.g., pypdf==4.3.1, pdfplumber==0.11.0) and instruct users to install from it. Consider using hash-pinned requirements for higher assurance.

• 🔵 LOW LLM_DATA_EXFILTRATION — Unpinned Package Installation Without Version Constraints

  The skill instructs installation of pennylane and multiple hardware plugins (pennylane-qiskit, amazon-braket-pennylane-plugin, pennylane-cirq, pennylane-rigetti, pennylane-ionq) without version pinning. This creates supply chain risk where a compromised or malicious package version could be installed. Additionally, the devices_backends.md reference file shows installation of pennylane-catalyst and other plugins without version pins. File: SKILL.md Remediation: Pin all package versions explicitly, e.g., 'uv pip install pennylane==0.38.0'. Use a lockfile or requirements.txt with hashed dependencies to ensure reproducible and verifiable installations.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing allowed-tools and compatibility Fields

  The SKILL.md manifest does not specify the 'allowed-tools' or 'compatibility' fields. While these are optional per the spec, their absence means there are no declared restrictions on what tools the agent can use when executing this skill, reducing the ability to audit or constrain agent behavior. File: SKILL.md Remediation: Add 'allowed-tools' to restrict the skill to only the tools it needs (e.g., Python, Bash for installation). Add 'compatibility' to document where the skill is intended to run.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Missing Provenance Information and Unpinned Dependencies Across All Reference Files

  The skill references multiple packages installed without version pins across all reference files (references/advanced_features.md references 'from catalyst import qjit' without installation instructions or version pinning; references/devices_backends.md references pennylane-catalyst, strawberryfields, pennylane-azure without version pins). The skill author is listed as 'K-Dense Inc.' but no version field is present in the manifest, reducing auditability. File: SKILL.md Remediation: Add a version field to the SKILL.md manifest. Pin all dependency versions. Include checksums or use a lockfile for reproducible installs.

• 🔵 LOW LLM_DATA_EXFILTRATION — API Tokens and Credentials Referenced in Code Examples Without Secure Handling Guidance

  The references/devices_backends.md file contains code examples that show API tokens and credentials being passed directly as string literals (e.g., ibmqx_token='YOUR_API_TOKEN', api_key='your_api_key', subscription_id='your-subscription-id'). While these are placeholder examples, the skill provides no guidance on secure credential management (e.g., environment variables, credential stores), which could lead users to hardcode real credentials in their code. File: references/devices_backends.md Remediation: Add explicit guidance to load credentials from environment variables or secure credential stores rather than hardcoding them. Example: ibmqx_token=os.environ['IBMQ_TOKEN']. Include a security note warning users never to hardcode API keys.

• 🔵 LOW LLM_COMMAND_INJECTION — Python eval/exec Usage Flagged by Static Analyzer

  The static pre-scan flagged a MDBLOCK_PYTHON_EVAL_EXEC finding, indicating a Python code block in the skill's markdown documentation uses eval or exec. After reviewing all provided content, no explicit eval() or exec() calls are visible in the reviewed files. The flagged usage appears to be within code examples in the documentation (e.g., DataFusion SQL execution via pb.sql(), or internal library calls). This is a low-severity informational finding since the skill contains no executable scripts and the code blocks are illustrative examples for a bioinformatics library. However, if the referenced but missing files (polars_bio.py, polars.py) contain eval/exec, this could be more serious. File: SKILL.md Remediation: Review the missing referenced files (polars_bio.py, polars.py) for any eval/exec usage. If pb.sql() accepts user-provided SQL strings, document that SQL injection risks apply and recommend parameterized queries or input validation.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing allowed-tools and Compatibility Metadata

  The SKILL.md manifest does not specify the allowed-tools or compatibility fields. While these fields are optional per the agent skills specification, their absence means the agent has no declared restrictions on which tools it may invoke. Given that this skill's instructions reference executing Python code, reading/writing files, and making cloud storage network calls (S3, GCS, Azure), the lack of tool declarations reduces transparency about the skill's actual operational scope. File: SKILL.md Remediation: Add allowed-tools to the YAML frontmatter to explicitly declare which agent tools this skill requires (e.g., [Python, Bash, Read, Write]). This improves transparency and allows the agent runtime to enforce appropriate restrictions.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Multiple Referenced Files Not Found in Skill Package

  The skill references numerous files that are not present in the package: templates/file_io.md, templates/pileup_operations.md, polars_bio.py, assets/file_io.md, assets/sql_processing.md, templates/sql_processing.md, templates/interval_operations.md, assets/pileup_operations.md, polars.py, assets/interval_operations.md. The absence of polars_bio.py and polars.py is particularly notable as these could be local script overrides that shadow the legitimate polars-bio library. If these files were present, they could contain malicious code that gets executed instead of the real library. File: SKILL.md Remediation: Audit the skill package to ensure all referenced files are present and accounted for. The references to polars_bio.py and polars.py are particularly concerning as local files with these names could shadow the installed polars-bio and polars packages. Verify the package is complete and that no shadow files exist in the deployment directory.

• 🔵 LOW LLM_DATA_EXFILTRATION — Cloud Credential Environment Variable Exposure in Documentation

  The file_io.md reference file explicitly documents that cloud storage authentication relies on environment variables such as AWS_ACCESS_KEY_ID and GOOGLE_APPLICATION_CREDENTIALS. While this is standard cloud SDK practice, the skill's documentation normalizes reading these sensitive environment variables without warning users about the security implications of credential exposure in shared or logged environments. File: references/file_io.md Remediation: Add a security note in the documentation advising users to use IAM roles, instance profiles, or secrets managers rather than raw environment variable credentials where possible. Warn that credentials in environment variables may be logged or exposed in process listings.

• 🔵 LOW LLM_DATA_EXFILTRATION — Missing allowed-tools Declaration

  The skill does not declare an 'allowed-tools' field in its YAML manifest. This is an optional field per the agent skills spec, but its absence means there are no declared restrictions on which agent tools this skill may use. The skill uses Bash execution (soffice, pdftoppm, gcc), Python execution, file read/write operations, and subprocess calls. Declaring allowed-tools would improve transparency and enable enforcement of least-privilege access. File: SKILL.md Remediation: Add an explicit 'allowed-tools' declaration to the YAML frontmatter listing the tools actually required (e.g., Bash, Python, Read, Write) to improve transparency and enable tool restriction enforcement.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Over-Broad Skill Activation Description

  The skill description is extremely broad, instructing the agent to activate 'any time a .pptx file is involved in any way' and to trigger on generic words like 'deck,' 'slides,' or 'presentation.' This over-broad activation scope could cause the skill to be invoked in contexts where it is not needed, potentially consuming resources or interfering with other skills. While this is a design choice rather than a malicious attack, it represents capability inflation in the skill discovery mechanism. File: SKILL.md Remediation: Narrow the activation criteria to specific, well-defined tasks. Avoid triggering on generic terms that may appear in unrelated contexts.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Dependency Versions in Installation Instructions

  The SKILL.md dependencies section specifies package installations without version pins (e.g., 'pip install markitdown[pptx]', 'pip install Pillow', 'npm install -g pptxgenjs'). Unpinned dependencies are vulnerable to supply chain attacks where a malicious version of a package could be published and automatically installed. File: SKILL.md Remediation: Pin all dependencies to specific, verified versions (e.g., 'pip install markitdown[pptx]==X.Y.Z', 'npm install -g pptxgenjs@X.Y.Z'). Consider using a lockfile (requirements.txt with hashes, package-lock.json) to ensure reproducible installs.

• 🔵 LOW LLM_COMMAND_INJECTION — Use of eval/exec Patterns Flagged by Static Analyzer

  The static pre-scan flagged a Python code block using eval/exec. After reviewing all provided scripts, no direct use of eval() or exec() with user-controlled input was found in the Python scripts themselves. However, the soffice.py script dynamically compiles and loads a C shared library at runtime using gcc and LD_PRELOAD injection. While this is used for a legitimate LibreOffice socket shim, the pattern of runtime code compilation and dynamic library loading is a sensitive operation that could be abused if the shim source (_SHIM_SOURCE) were modified or if the temp directory were writable by an attacker. File: scripts/office/soffice.py Remediation: Ensure the temporary directory used for the shim is not world-writable or accessible by untrusted processes. Consider embedding the compiled shim as a binary resource rather than compiling at runtime, or verify the shim source integrity before compilation.

• 🔵 LOW LLM_DATA_EXFILTRATION — Missing License and Compatibility Metadata

  The skill manifest does not specify a license or compatibility field. The skill-author field credits both 'K-Dense Inc.' and 'Harvard MIMS' for PrimeKG, but the original PrimeKG dataset has its own licensing terms (CC BY 4.0 for academic use). Without explicit license declaration, users cannot determine if they are permitted to use this skill and its bundled data access patterns in their context. This is an informational/compliance concern rather than a direct security threat. File: SKILL.md Remediation: Add explicit license, compatibility, and allowed-tools fields to the YAML frontmatter. Verify and document the licensing terms for the PrimeKG dataset, especially for commercial use.

• 🔵 LOW LLM_COMMAND_INJECTION — Unsanitized String Input Passed to pandas str.contains (Regex Injection)

  The search_nodes function passes the user-supplied name_query string directly to pandas str.contains(), which by default interprets the input as a regular expression. A malicious or malformed regex pattern (e.g., '(a+)+' or an extremely long alternation) could cause catastrophic backtracking, consuming excessive CPU time. While this is not a code execution vulnerability, it represents an injection of control logic via user input into a regex engine. File: scripts/query_primekg.py Remediation: Use regex=False in str.contains() for literal string matching: nodes['name'].str.contains(name_query, case=False, na=False, regex=False). If regex support is needed, validate and sanitize the input first using re.escape().

• 🔵 LOW LLM_RESOURCE_ABUSE — Repeated Full CSV Load on Every Function Call - Potential Resource Exhaustion

  The _load_kg() helper is called inside every public function (search_nodes, get_neighbors, find_paths, get_disease_context). Each call reads the entire 4-million-edge CSV file from disk into memory via pandas. Since get_disease_context calls both search_nodes and get_neighbors internally, a single high-level call triggers two full CSV loads. With a ~4M edge graph, each load can consume several GB of RAM and significant CPU time. Repeated or concurrent calls could exhaust available memory and degrade or crash the agent environment. File: scripts/query_primekg.py Remediation: Implement module-level caching (e.g., a global variable with lazy initialization, or functools.lru_cache on _load_kg) so the CSV is loaded only once per process. Consider using a proper graph database or indexed format for a dataset of this size.

• 🔵 LOW LLM_DATA_EXFILTRATION — Hardcoded Absolute Path Exposing Developer's Local Filesystem Structure

  The skill hardcodes an absolute path to the developer's personal filesystem in both the SKILL.md instructions and the Python script. The path '/mnt/c/Users/eamon/Documents/Data/PrimeKG/kg.csv' (and the Windows equivalent 'C:\Users\eamon\Documents\Data\PrimeKG\kg.csv') reveals the developer's username and local directory structure. While this is not a direct exfiltration risk, it exposes PII (username 'eamon') and will cause the skill to fail on any other machine without modification. It also suggests the skill was not designed for distribution and may have been packaged carelessly. File: scripts/query_primekg.py:7 Remediation: Replace the hardcoded path with a configurable path using an environment variable (e.g., os.environ.get('PRIMEKG_DATA_PATH', 'data/kg.csv')) or a relative path within the skill package. Remove the Windows path reference from SKILL.md as well.

• 🔵 LOW LLM_DATA_EXFILTRATION — Multiple Referenced Files Not Found in Skill Package

  The SKILL.md instructions reference numerous files (templates/policies.md, assets/vectorization.md, assets/policies.md, assets/training.md, templates/vectorization.md, templates/integration.md, assets/environments.md, assets/integration.md, templates/training.md, templates/environments.md, torch.py, gymnasium.py, pufferlib.py) that are not present in the skill package. If these files were to be fetched from external sources at runtime, they could introduce indirect prompt injection or malicious content. Currently they appear to simply be missing bundled files, but the absence creates ambiguity about whether the agent might attempt to resolve them externally. File: SKILL.md Remediation: Ensure all referenced files are bundled within the skill package. If files are intentionally omitted, remove references from SKILL.md to avoid confusion. Explicitly document that all resources are local to prevent any agent behavior that might attempt to fetch missing files from external sources.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing allowed-tools Manifest Field

  The SKILL.md manifest does not specify the allowed-tools field. The skill executes Python scripts that make network calls (to WandB, Neptune, and external RL framework APIs) and performs file I/O (checkpoint saving). While omitting allowed-tools is permitted per spec, declaring it would improve transparency about the skill's actual capabilities. File: SKILL.md Remediation: Add an explicit allowed-tools field to the YAML frontmatter listing the tools actually used, e.g., allowed-tools: [Python, Bash, Write, Read].

• 🔵 LOW LLM_DATA_EXFILTRATION — Neptune API Token Passed via Command-Line Argument

  The training template accepts a Neptune API token via a command-line argument (--neptune-token). While this is a common pattern, passing secrets as CLI arguments can expose them in process listings, shell history, and logs. The token is then passed directly to NeptuneLogger. This is a low-severity concern as it is a user-supplied value rather than a hardcoded secret, but it represents a credential handling risk. File: scripts/train_template.py Remediation: Recommend using environment variables (e.g., os.environ.get('NEPTUNE_API_TOKEN')) or a secrets manager instead of CLI arguments for API tokens. Document this best practice in the skill instructions.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Package Installation Without Version Constraints

  The SKILL.md instructs users to install pydeseq2 using 'uv pip install pydeseq2' without specifying a pinned version. This means any future malicious or compromised version of the package could be installed. While the package itself (owkin/PyDESeq2) is a legitimate bioinformatics library, unpinned installations are a supply chain risk. File: SKILL.md Remediation: Pin the package version explicitly, e.g., 'uv pip install pydeseq2==0.4.1' or use a requirements.txt/lockfile with hashed dependencies.

• 🔵 LOW LLM_UNAUTHORIZED_TOOL_USE — Missing allowed-tools Declaration

  The SKILL.md manifest does not specify an 'allowed-tools' field. The skill executes Python code, reads CSV files, writes output files, and runs bash commands. Without an explicit allowed-tools declaration, the agent's tool usage boundaries are undefined. This is informational per the spec (allowed-tools is optional) but worth noting for security posture. File: SKILL.md Remediation: Add an explicit 'allowed-tools: [Python, Bash, Read, Write]' declaration to the YAML frontmatter to clearly document and constrain the tools this skill requires.

• 🔵 LOW LLM_DATA_EXFILTRATION — Pickle Deserialization of Potentially Untrusted Data

  The script uses pickle to save and load DeseqDataSet objects. If a user loads a pickle file from an untrusted source, arbitrary code execution is possible. The workflow guide also shows loading from pickle files. While this is a common bioinformatics pattern, it represents a data exposure/code execution risk if pickle files are sourced externally. File: scripts/run_deseq2_analysis.py:175 Remediation: Document clearly that pickle files should only be loaded from trusted sources. Consider using safer serialization formats (e.g., HDF5/AnnData's native .h5ad format) for sharing results between users.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing allowed-tools Manifest Field

  The SKILL.md manifest does not specify the 'allowed-tools' field. While this field is optional per the agent skills specification, its absence means there are no declared restrictions on which agent tools this skill can use. Given that this skill handles sensitive medical imaging data (PHI), explicitly declaring tool restrictions would improve security posture and transparency. File: SKILL.md Remediation: Add an explicit 'allowed-tools' field to the YAML frontmatter listing only the tools required for the skill's operation, e.g., 'allowed-tools: [Python, Bash, Read, Write]'.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Package Dependencies in Installation Instructions

  The SKILL.md installation instructions use unpinned package versions (e.g., 'uv pip install pydicom', 'uv pip install pillow', 'uv pip install numpy', etc.). Without version pinning, the skill is vulnerable to supply chain attacks where a compromised or malicious version of a dependency could be installed. This is particularly concerning for a medical imaging skill that handles sensitive patient data (PHI). File: SKILL.md Remediation: Pin all dependencies to specific versions (e.g., 'uv pip install pydicom==2.4.4 pillow==10.2.0 numpy==1.26.4'). Consider using a requirements.txt or pyproject.toml with locked versions and hash verification.

• 🔵 LOW LLM_DATA_EXFILTRATION — Incomplete PHI Anonymization - Missing Critical Tags

  The anonymize_dicom.py script's PHI_TAGS list, while comprehensive, omits several DICOM tags that may contain PHI. Notably absent are: DeviceSerialNumber (can identify specific scanner/institution), StationName, RequestedProcedureID, AccessionNumber, StudyID, and various date/time fields that could enable re-identification. The script also explicitly comments out UID anonymization, which can allow cross-study re-identification of patients. File: scripts/anonymize_dicom.py Remediation: Expand PHI_TAGS to include additional identifying tags (DeviceSerialNumber, StationName, AccessionNumber, StudyID, etc.). Enable UID anonymization by default with an option to preserve UIDs for referential integrity. Consider implementing DICOM PS 3.15 Annex E (De-identification profiles) for compliance with healthcare standards.

• 🔵 LOW LLM_DATA_EXFILTRATION — PHI Exposure Risk in Metadata Extraction Script

  The extract_metadata.py script reads and outputs DICOM metadata including Protected Health Information (PHI) such as PatientName, PatientID, PatientBirthDate, PatientSex, PatientAge, PatientWeight, and other sensitive fields. While this is the stated purpose of the script, there is no warning or safeguard to prevent accidental exposure of PHI when outputting to files or console. The script can write PHI to arbitrary output files specified by the user without any access controls or audit logging. File: scripts/extract_metadata.py Remediation: Add PHI warning banners to output, implement optional PHI redaction mode, add audit logging for PHI access, and warn users when outputting PHI to files. Consider adding a --redact-phi flag that masks sensitive fields.

• 🔵 LOW LLM_DATA_EXFILTRATION — Missing License and Compatibility Metadata

  The skill manifest does not specify a license or compatibility field. While this is informational, the absence of provenance metadata (license, compatibility) makes it harder to audit the skill's trustworthiness and intended deployment scope, particularly for a skill that handles sensitive healthcare/EHR data contexts. File: SKILL.md Remediation: Add license, compatibility, and allowed-tools fields to the YAML frontmatter to improve auditability and restrict tool usage to what is actually needed.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Over-Broad Skill Activation Description with Keyword Baiting

  The skill description and SKILL.md 'When to use this skill' section contain an extensive list of trigger keywords and explicitly instruct the agent to activate even when 'PyHealth isn't named explicitly.' This over-broad activation language could cause the skill to be invoked in contexts where it is not appropriate, inflating its perceived scope and priority over other skills. File: SKILL.md Remediation: Narrow the activation criteria to cases where PyHealth is explicitly requested or clearly the best tool. Avoid instructing the agent to activate on broad domain keywords that could match many unrelated queries.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned External Package Dependency

  The skill instructs users to install PyHealth via 'uv add pyhealth' without pinning to a specific version. While uv generates a lockfile, the initial resolution could pull in a compromised or unexpected version of pyhealth or its transitive dependencies (PyTorch, etc.). The skill also references 'uv add pyhealth==1.16' for legacy use, which is pinned, but the primary recommendation is unpinned. File: SKILL.md Remediation: Pin pyhealth to a specific known-good version (e.g., 'uv add pyhealth==2.x.y') in documentation and starter scripts. Also pin torch to an exact version rather than a range.

• 🔵 LOW LLM_DATA_EXFILTRATION — External Network Data Source in Starter Pipeline

  The starter pipeline hardcodes a Google Cloud Storage URL as the default dataset root. While this is documented as a synthetic dataset for demos, the agent will automatically make outbound network requests to this external URL when running the starter pipeline without user confirmation or awareness that data is being fetched from an external server. File: assets/starter_pipeline.py:22 Remediation: Add a comment or runtime check that clearly informs the user before making external network requests. Consider defaulting to a local path with the GCS URL as an explicit opt-in example.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing allowed-tools Metadata

  The skill does not specify the 'allowed-tools' field in its YAML manifest. While this is optional per the agent skills spec, it means there are no declared restrictions on which agent tools (Read, Write, Bash, Python, etc.) can be invoked. For a skill that executes Python code to control physical laboratory hardware, documenting tool restrictions is advisable. File: SKILL.md Remediation: Add an 'allowed-tools' field to the YAML frontmatter specifying the minimum required tools, e.g., 'allowed-tools: [Python]'. This improves transparency and allows the agent runtime to enforce restrictions.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing Compatibility Metadata

  The skill does not specify the 'compatibility' field in its YAML manifest. Given that this skill controls physical laboratory hardware (Hamilton STAR, Opentrons OT-2, Tecan EVO, etc.) and requires specific USB/network connections, documenting compatibility requirements would help users understand environmental prerequisites. File: SKILL.md Remediation: Add a 'compatibility' field describing platform requirements, e.g., hardware connectivity needs, OS support, and Python version requirements.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Missing Referenced Files (templates/, assets/, pylabrobot.py)

  The SKILL.md references numerous files that are not present in the skill package: templates/visualization.md, templates/analytical-equipment.md, templates/liquid-handling.md, templates/material-handling.md, templates/hardware-backends.md, templates/resources.md, assets/analytical-equipment.md, assets/liquid-handling.md, assets/hardware-backends.md, assets/visualization.md, assets/material-handling.md, assets/resources.md, and pylabrobot.py. These missing files could indicate an incomplete package or that the skill relies on external/user-provided content that has not been bundled. If pylabrobot.py is intended as an executable script, its absence is particularly notable. File: SKILL.md Remediation: Ensure all referenced files are bundled within the skill package. If pylabrobot.py is an executable script, include it and review its contents for security issues. Remove references to files that are not part of the package.

• 🔵 LOW LLM_DATA_EXFILTRATION — Missing allowed-tools Manifest Declaration

  The SKILL.md manifest does not declare an 'allowed-tools' field. While this is optional per the spec, the skill executes Python code, writes files to disk (PNG plots, NetCDF results, CSV summaries), and performs MCMC sampling. Declaring allowed tools would improve transparency about the skill's capabilities. File: SKILL.md Remediation: Add 'allowed-tools: [Python]' to the YAML frontmatter to explicitly declare the tools this skill uses.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Several Referenced Files Are Missing

  The SKILL.md instructions reference multiple files that do not exist in the skill package: arviz.py, templates/linear_regression_template.py, assets/distributions.md, references/hierarchical_model_template.py, references/linear_regression_template.py, templates/distributions.md, assets/sampling_inference.md, pymc.py, scripts.py, templates/sampling_inference.md, templates/hierarchical_model_template.py. This creates a discrepancy between the declared capabilities and actual available resources, which could mislead the agent about available functionality. File: SKILL.md Remediation: Remove references to non-existent files from SKILL.md instructions, or include the missing files in the skill package.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing allowed-tools and compatibility metadata

  The SKILL.md manifest does not specify 'allowed-tools' or 'compatibility' fields. While these are optional per the agent skills spec, their absence means there are no declared restrictions on what tools the agent may use when executing this skill. Given the skill runs Python scripts, documenting tool usage would improve transparency. File: SKILL.md Remediation: Add 'allowed-tools' to the YAML frontmatter listing the tools actually used (e.g., Python, Bash) and specify compatibility information.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing allowed-tools Metadata

  The SKILL.md manifest does not specify the 'allowed-tools' field. While this is an optional field per the agent skills spec, its absence means there are no declared restrictions on which agent tools (Read, Write, Bash, Python, etc.) this skill may invoke. Given the skill installs packages and runs Python code, documenting allowed tools would improve transparency. File: SKILL.md Remediation: Add an 'allowed-tools' field to the YAML frontmatter specifying the tools this skill requires, e.g., 'allowed-tools: [Python, Bash, Read, Write]'.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing Compatibility Metadata

  The SKILL.md manifest does not specify the 'compatibility' field. This makes it unclear in which environments (Claude.ai, Claude Code, API) the skill is intended to operate, potentially leading to unexpected behavior or activation in unsupported contexts. File: SKILL.md Remediation: Add a 'compatibility' field to the YAML frontmatter specifying supported environments.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Package Installation

  The skill instructs installation of 'pyopenms' via 'uv pip install pyopenms' without specifying a version pin. This exposes the skill to supply chain risks where a compromised or malicious version of the package could be installed. File: SKILL.md Remediation: Pin the package to a specific known-good version, e.g., 'uv pip install pyopenms==3.1.0'. Consider also verifying package integrity via hash checking.

• 🔵 LOW LLM_UNAUTHORIZED_TOOL_USE — Multiple Referenced Files Not Found

  The SKILL.md instructions reference numerous files that do not exist in the skill package: templates/signal_processing.md, assets/identification.md, templates/file_io.md, templates/feature_detection.md, assets/file_io.md, assets/feature_detection.md, assets/data_structures.md, assets/signal_processing.md, assets/metabolomics.md, templates/metabolomics.md, pyopenms.py, templates/data_structures.md, templates/identification.md. Missing referenced files could cause the agent to fail silently or behave unexpectedly when attempting to access them. File: SKILL.md Remediation: Ensure all referenced files are included in the skill package, or remove references to non-existent files from the instructions.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing Compatibility and Allowed-Tools Metadata

  The SKILL.md manifest does not specify 'compatibility' or 'allowed-tools' fields. While these are optional per the agent skills spec, their absence means there are no declared restrictions on which tools the agent may use when executing this skill. Given the skill's nature (file I/O, subprocess execution via samtools/bcftools), documenting these would improve transparency. File: SKILL.md Remediation: Add 'compatibility' and 'allowed-tools' fields to the YAML frontmatter to document expected execution environment and tool restrictions. For example: allowed-tools: [Python, Bash]

• 🔵 LOW LLM_PROMPT_INJECTION — Missing Referenced Files May Allow Substitution

  Several files referenced in the SKILL.md instructions are not found in the skill package: 'assets/utilities.md', 'tdc.py', 'assets/oracles.md', 'templates/utilities.md', 'templates/oracles.md'. If an agent attempts to resolve these missing references from user-provided or external sources, it could be exposed to indirect prompt injection via substituted content. The risk is low since the instructions reference them as documentation rather than executable content, but the missing files represent an incomplete package. File: SKILL.md Remediation: Include all referenced files within the skill package, or remove references to non-existent files from the instructions. Do not allow the agent to fetch missing referenced files from external or user-provided sources.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Package Installation

  The SKILL.md instructs installation of PyTDC using 'uv pip install PyTDC' and 'uv pip install PyTDC --upgrade' without version pinning. This means the skill will always install the latest version of PyTDC, which could introduce breaking changes or, in a supply chain compromise scenario, malicious code if the PyPI package were compromised. The upgrade command is particularly risky as it actively fetches the newest version. File: SKILL.md Remediation: Pin the PyTDC version to a specific known-good release, e.g., 'uv pip install PyTDC==0.4.1'. Avoid the --upgrade flag in automated skill workflows. Consider using a lockfile or hash verification.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Missing Compatibility and Allowed-Tools Metadata

  The YAML manifest does not specify 'compatibility' or 'allowed-tools' fields. While these are optional per the spec, their absence means there is no declared constraint on which agent tools this skill may use, and no documented compatibility scope. The scripts use Python execution and network-dependent library calls (PyTDC downloads datasets from remote servers), which could be unexpected in restricted environments. File: SKILL.md Remediation: Add 'allowed-tools: [Python, Bash]' and 'compatibility' fields to the YAML manifest to clearly document the skill's tool requirements and intended execution environments.

• 🔵 LOW LLM_COMMAND_INJECTION — Python eval/exec Usage in Code Examples

  The static analyzer flagged a Python code block using eval/exec within the skill's reference files. After reviewing all provided reference file content, no explicit eval() or exec() calls were found in the visible markdown code blocks. The flagged instance may be in one of the missing/not-found reference files (e.g., pyzotero.py which was not found). If eval/exec is present in the actual pyzotero.py script or other missing files, it could represent a command injection risk if user-controlled input is passed to these functions. File: SKILL.md Remediation: Locate and review pyzotero.py and all missing reference files for eval/exec usage. Ensure no user-controlled input is passed to eval() or exec() without strict sanitization. Replace dynamic evaluation with safer alternatives where possible.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing Compatibility Field in Manifest

  The YAML manifest does not specify a 'compatibility' field (listed as 'Not specified'). While this is a minor documentation gap, it means users cannot easily determine which agent environments this skill is designed for without reading the full documentation. File: SKILL.md Remediation: Add a compatibility field to the YAML manifest specifying supported environments (e.g., 'Claude.ai, Claude Code, API') to improve transparency and discoverability.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Package Installation in Instructions

  The installation instructions use 'uv add pyzotero' and 'uv add pyzotero[cli]' without specifying a version pin. This means the skill will always install the latest available version of pyzotero, which could introduce breaking changes or supply chain risks if the package is compromised or updated with malicious code. File: SKILL.md:20 Remediation: Pin the pyzotero package to a specific known-good version (e.g., 'uv add pyzotero==1.5.3') to ensure reproducible and auditable installations. Document the pinned version and update it deliberately after reviewing changelogs.

• 🔵 LOW LLM_DATA_EXFILTRATION — Credential Handling Guidance Exposes API Keys in Code Examples

  The SKILL.md and references/authentication.md contain inline examples with hardcoded placeholder API keys (e.g., 'ABC1234XYZ') and library IDs. While these are clearly placeholders, the skill instructs users to store credentials in .env files and environment variables, which is appropriate. However, the Quick Start section in SKILL.md shows credentials passed directly as constructor arguments, which could encourage users to hardcode real credentials in scripts. File: SKILL.md:44 Remediation: Add explicit warnings in Quick Start examples that API keys should never be hardcoded in scripts. Emphasize the environment variable approach shown in references/authentication.md as the preferred method.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Potentially Inflated Performance Claims in Skill Description

  The SKILL.md instruction body makes specific quantitative performance claims ('83x faster transpilation than competitors', '29% fewer two-qubit gates') that are presented as absolute facts without qualification or source citation. These claims appear in the skill's marketing-style description and could influence users to over-rely on this skill or make decisions based on unverified benchmarks. The claims are repeated in multiple reference files. File: SKILL.md Remediation: Add source citations for performance claims, qualify them with version numbers and benchmark conditions (e.g., 'As of Qiskit v2.2, benchmarks show...'), and avoid presenting marketing claims as absolute technical facts in skill instructions.

• 🔵 LOW LLM_UNAUTHORIZED_TOOL_USE — Missing allowed-tools Declaration

  The skill manifest does not specify the 'allowed-tools' field. The skill instructs the agent to execute bash commands (pip installs) and Python code, but no tool restrictions are declared. While this field is optional per the spec, its absence means there are no declared constraints on what tools the agent may use when following these instructions. File: SKILL.md Remediation: Add an explicit 'allowed-tools' declaration to the YAML frontmatter to document the intended tool usage scope, e.g., 'allowed-tools: [Bash, Python, Read]'. This improves transparency and allows security tooling to validate behavior against declared intent.

• 🔵 LOW LLM_DATA_EXFILTRATION — API Token Placeholder in Documentation Examples

  The skill's reference files contain placeholder API token strings (e.g., 'YOUR_IBM_QUANTUM_TOKEN', 'YOUR_IONQ_API_TOKEN') in code examples. While these are clearly documentation placeholders and not hardcoded secrets, they demonstrate a pattern where users are instructed to embed API tokens directly in code rather than using more secure methods like environment variables or credential managers. The setup.md does mention the environment variable method as an alternative, which is positive. File: references/setup.md Remediation: Ensure documentation consistently promotes the environment variable method (QISKIT_IBM_TOKEN) as the primary approach, and clearly warns users not to hardcode real tokens in scripts. Consider adding explicit security warnings in the setup guide.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Package Dependencies in Installation Instructions

  The skill instructs users to install packages using 'uv pip install qiskit', 'uv pip install qiskit-nature', 'uv pip install qiskit-machine-learning', 'uv pip install qiskit-optimization', etc., without specifying version pins. Unpinned dependencies can lead to supply chain risks if a malicious version is published to PyPI, or unexpected breaking changes. This affects multiple reference files throughout the skill. File: references/setup.md Remediation: Pin package versions in installation instructions (e.g., 'uv pip install qiskit==1.x.x'). At minimum, document the tested/recommended versions and advise users to pin versions in production environments.

• 🔵 LOW LLM_COMMAND_INJECTION — Use of pickle for Molecule Serialization (Deserialization Risk)

  The SKILL.md instructions recommend using Python's pickle module for storing and loading RDKit molecule objects for performance. Pickle deserialization is inherently unsafe when loading data from untrusted sources, as malicious pickle payloads can execute arbitrary code during deserialization. While the instructions don't explicitly direct loading user-supplied pickle files, the pattern is promoted as a best practice without any safety caveats, which could lead users to deserialize untrusted pickle files. File: SKILL.md Remediation: Add a warning in the instructions that pickle files should only be loaded from trusted sources. Recommend safer alternatives such as storing molecules in SDF or SMILES format, or using rdkit's built-in binary serialization (mol.ToBinary()) which is safer than generic pickle.

• 🔵 LOW LLM_DATA_EXFILTRATION — Missing allowed-tools Declaration

  The skill manifest does not declare an allowed-tools field. The skill instructions and scripts perform file I/O operations (reading SDF/SMILES files, writing CSV/SDF output), execute Python code, and reference external file paths. Without an explicit allowed-tools declaration, the agent's tool usage boundaries are undefined, making it harder to audit or restrict the skill's capabilities. File: SKILL.md Remediation: Add an explicit allowed-tools field to the YAML frontmatter listing the required tools, e.g., allowed-tools: [Python, Read, Write]. This improves auditability and allows the agent runtime to enforce capability restrictions.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Referenced File rdkit.py Not Found

  The SKILL.md instructions reference a file 'rdkit.py' in the skill package, but this file was not found in the skill directory. This could indicate an incomplete skill package, a missing dependency, or a discrepancy between the documented capabilities and the actual package contents. Users relying on this reference may encounter errors or unexpected behavior. File: SKILL.md Remediation: Either include the rdkit.py file in the skill package or remove the reference from the instructions. Ensure all referenced files are present and functional before distributing the skill.

• 🔵 LOW LLM_DATA_EXFILTRATION — API Key Hardcoding Pattern Encouraged in Documentation

  The SKILL.md instructions explicitly show a pattern of hardcoding API keys directly in Python code (rowan.api_key = 'your_api_key_here') as an alternative to environment variables. While the environment variable approach is labeled 'recommended', the inline assignment pattern is prominently shown in the Quick Start section and multiple code examples, which may encourage users to hardcode secrets in scripts. File: SKILL.md Remediation: Remove or de-emphasize the inline API key assignment pattern. Only show the environment variable approach (ROWAN_API_KEY) in examples, and add a warning against hardcoding secrets in code.

• 🔵 LOW LLM_DATA_EXFILTRATION — Webhook Secret Exposed in Plaintext Logging

  The SKILL.md webhook management section shows code that prints webhook secrets directly to stdout (print(f"Secret key: {secret.secret}") and print(f"New secret created (old secret disabled): {new_secret.secret}")). This could lead to secrets being logged in CI/CD pipelines, terminal histories, or log aggregation systems. File: SKILL.md Remediation: Remove print statements that expose secrets. Instruct users to store secrets securely (e.g., environment variables, secret managers) rather than printing them.

• 🔵 LOW LLM_PROMPT_INJECTION — Referenced Script Files Not Found - Potential Missing Validation

  The SKILL.md references two files (rowan.py and rdkit.py) that were not found in the skill package. The static pre-scan also flagged cross-file exfiltration chains across 6 Python files and environment variable exfiltration patterns. The absence of these files prevents full analysis of the actual code behavior, and the static findings suggest the actual scripts (not provided for review) may contain environment variable access combined with network calls. File: SKILL.md Remediation: Ensure all referenced script files are included in the skill package for security review. The static analyzer flagged environment variable access combined with network calls across multiple files - these should be audited to confirm they only access ROWAN_API_KEY and only communicate with legitimate Rowan API endpoints.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Over-Broad Capability Claims in Skill Description

  The skill description and SKILL.md claim an extremely broad range of capabilities (pKa, docking, cofolding, MD, FEP, NMR, ion mobility, BDE, redox potential, spin states, etc.) that span nearly all of computational chemistry and drug discovery. While this may reflect the actual Rowan platform capabilities, the breadth of trigger-keywords and the description could cause the skill to activate for a very wide range of user queries, potentially displacing more appropriate tools. File: SKILL.md Remediation: Narrow trigger-keywords to the most specific use cases. Ensure the description accurately scopes the skill to avoid over-broad activation.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Package Installation Recommended

  The SKILL.md Quick Start and Installation sections recommend installing rowan-python without a pinned version (uv pip install rowan-python or pip install rowan-python). Unpinned installations are vulnerable to supply chain attacks where a malicious version could be published and automatically installed. File: SKILL.md Remediation: Pin the package to a specific known-good version (e.g., pip install rowan-python==X.Y.Z) and document the expected version. Consider providing a hash-verified requirements file.

• 🔵 LOW LLM_DATA_EXFILTRATION — Missing allowed-tools Declaration

  The skill does not declare an 'allowed-tools' field in its YAML manifest. While this is optional per the agent skills spec, the skill executes Python scripts, writes files, and performs file I/O operations. Declaring allowed tools improves transparency and security posture. File: SKILL.md Remediation: Add 'allowed-tools: [Python, Bash]' to the YAML frontmatter to explicitly declare the tools this skill uses.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing allowed-tools and compatibility metadata

  The SKILL.md manifest does not specify 'allowed-tools' or 'compatibility' fields. While these are optional per the agent skills spec, their absence means there are no declared restrictions on which agent tools this skill may invoke. This is informational only. File: SKILL.md Remediation: Consider adding 'allowed-tools' to explicitly declare which agent tools this skill requires, improving transparency and enabling enforcement of least-privilege access.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing allowed-tools Metadata

  The SKILL.md manifest does not specify the 'allowed-tools' field. While this is an optional field per the agent skills spec, its absence means there are no declared restrictions on which agent tools (Read, Write, Bash, Python, etc.) this skill may invoke. Given the skill executes Python scripts and writes files, documenting allowed tools would improve transparency. File: SKILL.md Remediation: Add an explicit 'allowed-tools' field to the YAML frontmatter, e.g., 'allowed-tools: [Python, Read, Write]', to document the intended tool scope.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing Compatibility Field

  The SKILL.md manifest does not specify the 'compatibility' field. This is a minor documentation gap that reduces transparency about where the skill is intended to operate. File: SKILL.md Remediation: Add a 'compatibility' field to the YAML frontmatter documenting the intended runtime environments.

• 🔵 LOW LLM_DATA_EXFILTRATION — Referenced File skbio.py Not Found in Package

  The SKILL.md instructions reference a file 'skbio.py' that is not present in the skill package. This missing file could represent a shadow module intended to intercept or override the legitimate scikit-bio library. If present, a malicious skbio.py in the working directory could shadow the real scikit-bio package and execute arbitrary code when the agent runs 'import skbio'. File: SKILL.md Remediation: Clarify whether skbio.py is an intentional part of the package. If not, remove the reference. If it is intended, ensure it is included and audited for malicious content. Avoid naming local files the same as well-known Python packages to prevent module shadowing.

• 🔵 LOW LLM_DATA_EXFILTRATION — Multiple Referenced Files Not Found (assets/ and templates/ paths)

  Two additional referenced files — 'assets/api_reference.md' and 'templates/api_reference.md' — are listed as referenced but not found in the package. Only 'references/api_reference.md' is present. Missing referenced files could indicate incomplete packaging or placeholders for future content injection. File: SKILL.md Remediation: Remove references to files that do not exist in the package, or include the missing files. Ensure the skill package is complete and all referenced resources are bundled.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing allowed-tools Metadata

  The skill does not specify the 'allowed-tools' field in its YAML manifest. While this field is optional per the agent skills spec, its absence means there are no declared restrictions on which agent tools (Read, Write, Bash, Python, etc.) can be invoked. Given the skill's broad bioinformatics scope, documenting intended tool usage would improve transparency. File: SKILL.md Remediation: Add an 'allowed-tools' field to the YAML frontmatter listing the tools this skill is expected to use, e.g., allowed-tools: [Python, Read, Write].

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing Compatibility Metadata

  The skill does not specify the 'compatibility' field in its YAML manifest. This field helps users understand which environments the skill is designed for. Its absence is a minor documentation gap but does not represent a direct security threat. File: SKILL.md Remediation: Add a 'compatibility' field to the YAML frontmatter specifying supported environments, e.g., compatibility: Works in Claude.ai, Claude Code, API.

• 🔵 LOW LLM_DATA_EXFILTRATION — Missing allowed-tools Metadata

  The skill does not declare an 'allowed-tools' field in its YAML frontmatter. While this is optional per the agent skills spec, documenting which tools are used (Python, Bash) would improve transparency and allow agents to enforce capability restrictions. File: SKILL.md Remediation: Add 'allowed-tools: [Python, Bash]' to the YAML frontmatter to explicitly declare the tools this skill uses.

• 🔵 LOW LLM_DATA_EXFILTRATION — Multiple Referenced Files Not Found

  The skill references numerous files in its instructions that do not exist in the package: templates/supervised_learning.md, assets/model_evaluation.md, assets/preprocessing.md, templates/quick_reference.md, assets/pipelines_and_composition.md, templates/pipelines_and_composition.md, assets/supervised_learning.md, assets/quick_reference.md, sklearn.py, assets/unsupervised_learning.md, templates/preprocessing.md, templates/unsupervised_learning.md, templates/model_evaluation.md. This could cause the agent to attempt to read non-existent files or behave unexpectedly. File: SKILL.md Remediation: Remove references to non-existent files from the skill instructions, or include the missing files in the skill package.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing Compatibility Metadata

  The skill does not specify a 'compatibility' field in its YAML frontmatter. This is a minor documentation gap that reduces transparency about where the skill is intended to operate. File: SKILL.md Remediation: Add a 'compatibility' field to the YAML frontmatter specifying supported environments (e.g., 'Claude.ai, Claude Code, API').

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Over-Broad Capability Description May Trigger Unintended Activation

  The skill description is very broad, claiming to handle 'any survival analysis workflow with the scikit-survival library.' While this is a legitimate documentation skill, the expansive description could cause the agent to activate this skill for a wide range of loosely related statistical or data science queries beyond its intended scope. File: SKILL.md Remediation: Narrow the description to more precisely define the scope of the skill and avoid over-broad activation triggers.

• 🔵 LOW LLM_UNAUTHORIZED_TOOL_USE — Missing allowed-tools Declaration

  The SKILL.md manifest does not declare an allowed-tools field. While this is optional per the spec, the skill references Python code examples extensively and instructs the agent to load reference files, so declaring allowed-tools would improve security posture by limiting what tools the agent can use. File: SKILL.md Remediation: Add an explicit allowed-tools declaration to the YAML frontmatter, e.g., allowed-tools: [Read] since this skill primarily provides reference documentation and code examples rather than executing scripts.

• 🔵 LOW LLM_DATA_EXFILTRATION — Static Analyzer Flagged Potential Environment Variable Exfiltration Pattern

  The pre-scan static analyzer flagged BEHAVIOR_ENV_VAR_EXFILTRATION and BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN across 3 files. However, manual review of all available referenced files (references/cox-models.md, references/competing-risks.md, references/svm-models.md, references/data-handling.md, references/ensemble-models.md, references/evaluation-metrics.md) shows no evidence of environment variable access, network calls, or data exfiltration patterns. Several referenced files (sklearn.py, sksurv.py, templates/, assets/) were not found and could not be reviewed. The risk is LOW given no evidence in available files, but the missing files cannot be cleared. File: references/evaluation-metrics.md Remediation: Audit the missing referenced files (sklearn.py, sksurv.py, all templates/ and assets/ files) for environment variable access and network calls before deploying this skill. Remove or review any files that access os.environ, subprocess, or make network requests.

• 🔵 LOW LLM_DATA_EXFILTRATION — Missing allowed-tools Declaration

  The skill does not declare an allowed-tools field in its YAML manifest. While this is optional per the spec, the skill executes Python code, writes files to disk (h5ad, PNG figures), and reads local files. Declaring allowed tools would improve transparency and allow the agent runtime to enforce appropriate restrictions. File: SKILL.md Remediation: Add allowed-tools: [Python, Read, Write] to the YAML frontmatter to explicitly declare the tools this skill requires.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Unresolved Referenced Files May Cause Confusion

  The SKILL.md references matplotlib.py, scvelo.py, and scanpy.py as files, but these are not found in the skill package. These appear to be Python import statements misidentified as file references. While not a direct security threat, this could cause confusion about the skill's actual dependencies and scope. File: SKILL.md Remediation: Clarify the skill's actual file dependencies in the manifest. Ensure referenced files are either bundled with the skill or clearly identified as external library imports.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Package Installation Recommended

  The SKILL.md instructs users to install scvelo via pip install scvelo without pinning a specific version. This means any future compromised or malicious release of the scvelo package on PyPI could be installed automatically, introducing supply chain risk. File: SKILL.md Remediation: Pin to a specific known-good version, e.g., pip install scvelo==0.2.5. Consider also pinning scanpy and other dependencies.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing allowed-tools Manifest Field

  The SKILL.md manifest does not specify the 'allowed-tools' field. While this is optional per the agent skills spec, documenting which tools are required (Python, Bash, Read, Write, etc.) improves transparency and allows runtime enforcement of tool restrictions. File: SKILL.md Remediation: Add an explicit 'allowed-tools' field to the YAML frontmatter listing only the tools required for operation, e.g., 'allowed-tools: [Python, Read, Write]'.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing Compatibility Field in Manifest

  The SKILL.md manifest does not specify the 'compatibility' field. This reduces transparency about which environments the skill is designed to operate in. File: SKILL.md Remediation: Add a 'compatibility' field to the YAML frontmatter specifying supported environments.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Package Installation in Instructions

  The installation instructions use 'uv pip install scvi-tools' and 'uv pip install scvi-tools[cuda]' without pinning to a specific version. This creates a supply chain risk where a compromised or malicious version of the package could be installed automatically. File: SKILL.md Remediation: Pin the package to a specific known-good version, e.g., 'uv pip install scvi-tools==1.1.2'. Consider also verifying package integrity via hash checking.

• 🔵 LOW LLM_DATA_EXFILTRATION — Missing Script Files Referenced in Instructions

  The SKILL.md references files 'matplotlib.py' and 'seaborn.py' as referenced files, but these files were not found in the skill package. The static analyzer also reports 3 Python files in the inventory but none are present in the provided content. This discrepancy is suspicious - missing files could indicate incomplete package delivery or that scripts were intentionally omitted from analysis. The static pre-scan flags BEHAVIOR_ENV_VAR_EXFILTRATION and BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN across 3 files, suggesting the missing Python scripts may contain malicious behavior. File: SKILL.md Remediation: Obtain and analyze the missing Python script files (matplotlib.py, seaborn.py, and the third unidentified file). The static analyzer's detection of environment variable access combined with network calls across multiple files is a strong indicator of data exfiltration behavior that must be investigated before this skill is used.

• 🔵 LOW LLM_DATA_EXFILTRATION — Static Analysis Flags Cross-File Environment Variable Exfiltration Chain

  The pre-scan static analyzer detected BEHAVIOR_ENV_VAR_EXFILTRATION (environment variable access with network calls) and BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN across 3 files, as well as BEHAVIOR_CROSSFILE_ENV_VAR_EXFILTRATION. These findings strongly suggest that the Python scripts in this package (which were not provided for review) read environment variables (potentially containing API keys, tokens, or credentials) and transmit them via network calls. This is a classic data exfiltration pattern. The skill's benign-looking seaborn documentation facade may be a distraction from malicious script behavior. File: SKILL.md Remediation: Do NOT use this skill until all Python files are reviewed. The combination of environment variable access and outbound network calls across multiple files is a high-confidence indicator of credential/secret exfiltration. Audit all 3 Python files for: (1) os.environ or os.getenv calls, (2) requests/urllib/http network calls, (3) data being sent to external endpoints. If confirmed malicious, remove the skill immediately and rotate any secrets that may have been exposed.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Skill Name Matches Popular Library - Potential Capability Inflation

  The skill is named 'seaborn' and closely mirrors the real seaborn Python library documentation. While the content appears to be a legitimate reference guide, naming a skill after a well-known library could be used to inflate perceived authority or cause the agent to prefer this skill over other sources of information about seaborn. The description is accurate and the instructions appear benign, but the pattern warrants noting. File: SKILL.md Remediation: Ensure the skill name and description accurately reflect that this is a reference/guide skill, not the seaborn library itself. Consider naming it 'seaborn-guide' or 'seaborn-reference' to avoid confusion.

• 🔵 LOW LLM_DATA_EXFILTRATION — Missing allowed-tools Declaration

  The skill does not declare an 'allowed-tools' field in its YAML manifest. While this field is optional per the agent skills spec, its absence means there are no declared restrictions on what tools the agent can use when executing this skill. The skill references reading internal files (references/*.md) and executing Python code, so declaring allowed tools would improve security posture. File: SKILL.md Remediation: Add an explicit 'allowed-tools' declaration to the YAML manifest, such as: allowed-tools: [Read, Python] to limit the skill to only the tools it legitimately needs.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Over-Broad Capability Claims in Skill Description

  The skill description is very broad, claiming to work with 'any black-box model' and listing numerous trigger phrases. While this is largely accurate for the SHAP library, the extensive keyword list in the 'When to Use This Skill' section could lead to over-activation of the skill in contexts where it may not be the most appropriate tool. This is a minor concern as the claims are generally legitimate for the SHAP library. File: SKILL.md Remediation: Consider narrowing the trigger phrases to more specific SHAP-related queries to avoid over-activation. The current list is broad but not malicious.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Package Installation in Installation Section

  The installation instructions use 'uv pip install shap' and 'uv pip install -U shap' without version pinning. This could allow installation of a compromised or unexpected version of the SHAP package if the package registry is compromised or if a malicious package with a similar name is published. File: SKILL.md Remediation: Pin specific versions in installation instructions, e.g., 'uv pip install shap==0.44.0 matplotlib==3.8.0'. This ensures reproducibility and reduces supply chain risk.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing allowed-tools and compatibility metadata

  The SKILL.md manifest does not specify 'allowed-tools' or 'compatibility' fields. While these are optional per the agent skills spec, their absence means there are no declared restrictions on which agent tools (Read, Write, Bash, Python, etc.) can be used. The scripts do write CSV files and execute Python code, so documenting this would improve transparency. File: SKILL.md Remediation: Add 'allowed-tools: [Python, Bash, Write, Read]' and a 'compatibility' field to the YAML frontmatter to clearly document the skill's tool requirements and platform support.

• 🔵 LOW LLM_DATA_EXFILTRATION — Missing allowed-tools Declaration

  The skill manifest does not specify an 'allowed-tools' field. While this is optional per the agent skills spec, it means there are no declared restrictions on which agent tools (Read, Write, Bash, Python, etc.) can be used. The scripts execute Python code, create directories, save files, and run subprocesses. Declaring allowed tools would improve transparency. File: SKILL.md Remediation: Add 'allowed-tools: [Python, Bash]' or appropriate tool list to the YAML frontmatter to explicitly declare what tools this skill uses.

• 🔵 LOW LLM_DATA_EXFILTRATION — Multiple Referenced Files Not Found in Package

  The skill references numerous files that were not found in the package: assets/discrete_choice.md, templates/time_series.md, sklearn.py, statsmodels.py, templates/glm.md, templates/linear_models.md, assets/stats_diagnostics.md, templates/discrete_choice.md, templates/stats_diagnostics.md, assets/glm.md, assets/linear_models.md, scipy.py, matplotlib.py, assets/time_series.md. The presence of referenced Python files (sklearn.py, statsmodels.py, scipy.py, matplotlib.py) that are not found is notable. If these files were present, they could contain executable code not visible in this analysis. File: SKILL.md Remediation: Ensure all referenced files are included in the skill package. If Python script files (sklearn.py, statsmodels.py, scipy.py, matplotlib.py) are intended to be part of the skill, their contents must be reviewed for security issues before deployment. Missing files could indicate an incomplete package or files that were intentionally omitted from review.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing allowed-tools Metadata

  The skill does not declare an 'allowed-tools' field in its YAML manifest. While this field is optional per the agent skills spec, its absence means there are no declared restrictions on which agent tools (Read, Write, Bash, Python, etc.) can be invoked. Given the skill's scope (statistical modeling), this is informational only. File: SKILL.md Remediation: Consider adding 'allowed-tools: [Python, Bash, Read]' or similar to the YAML frontmatter to explicitly declare intended tool usage and limit the attack surface.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing Compatibility Metadata

  The skill does not specify a 'compatibility' field in its YAML manifest. This is a minor documentation gap with no direct security impact. File: SKILL.md Remediation: Add a 'compatibility' field to the YAML frontmatter to clarify which environments the skill is intended for.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned External Dependencies Referenced in Code Examples

  The skill's code examples reference multiple external libraries (statsmodels, sklearn, scipy, matplotlib, numpy, pandas) without version pinning. While these are well-known scientific Python libraries, the absence of version constraints means the skill could behave differently across environments and is subject to supply chain risks if a dependency is compromised. File: SKILL.md Remediation: Document required library versions in a requirements.txt or similar file with pinned versions (e.g., statsmodels==0.14.0) to ensure reproducibility and reduce supply chain risk.

• 🔵 LOW LLM_COMMAND_INJECTION — Python eval/exec Usage Flagged by Static Analyzer

  The static pre-scan flagged a Python code block containing eval/exec usage within the SKILL.md instruction body. After reviewing the actual code blocks in the skill, no direct use of eval() or exec() was found in the visible content. The flag may be a false positive from the static analyzer detecting patterns in code examples. However, the referenced files tiledb.py and tiledbvcf.py are not found/not provided, so their content cannot be verified. If those files contain eval/exec with user-controlled input, this could be a command injection risk. File: SKILL.md Remediation: Locate and review tiledb.py and tiledbvcf.py for any eval/exec usage with user-controlled input. If found, replace with safer alternatives such as ast.literal_eval() for data parsing or explicit function dispatch.

• 🔵 LOW LLM_DATA_EXFILTRATION — Missing Referenced Script Files

  The SKILL.md references two Python files (tiledb.py and tiledbvcf.py) that were not found in the skill package. This means the full behavior of the skill cannot be verified. These files could contain data exfiltration, credential access, or other malicious behavior that is not visible in the instruction body alone. File: SKILL.md Remediation: Ensure all referenced script files are included in the skill package and reviewed before deployment. Do not deploy skills with missing referenced files as their behavior cannot be audited.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing allowed-tools and Compatibility Metadata

  The skill does not declare allowed-tools or compatibility fields in its YAML manifest. While these fields are optional per the agent skills spec, their absence means there are no declared restrictions on which agent tools this skill may invoke. Given the skill's instructions include cloud storage access patterns (S3, Azure, GCS) and pip install commands, declaring tool restrictions would improve security posture. File: SKILL.md Remediation: Consider adding allowed-tools to restrict the skill to only the tools it legitimately needs (e.g., Bash, Python). This provides a defense-in-depth layer against unexpected tool usage.

• 🔵 LOW LLM_DATA_EXFILTRATION — Unpinned Package Versions in Installation Instructions

  The SKILL.md installation instructions recommend installing packages without pinned versions (e.g., 'uv pip install timesfm[torch]', 'pip install torch>=2.0.0'). Unpinned or loosely-pinned dependencies can allow supply chain attacks where a malicious package version is installed. The skill uses only minimum version constraints (>=) rather than exact pins (==). File: SKILL.md Remediation: Pin all dependencies to exact versions (e.g., 'timesfm==2.5.0', 'torch==2.4.1'). Provide a requirements.txt or pyproject.toml with locked versions and checksums.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing Compatibility Field in YAML Manifest

  The YAML manifest does not specify a 'compatibility' field. While this is optional per the skill spec, the skill makes network calls to HuggingFace Hub and requires specific hardware (GPU/RAM), which may not be compatible with all agent environments. The absence of compatibility metadata could lead to the skill being activated in unsuitable environments. File: SKILL.md Remediation: Add a compatibility field specifying minimum requirements, e.g.: 'compatibility: Requires Python 3.10+, 4GB RAM, internet access for model download. Tested on Claude Code.'

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Model Weights Downloaded from External Source Without Integrity Verification

  The skill downloads ~800MB model weights from HuggingFace Hub on first use ('google/timesfm-2.5-200m-pytorch') without any checksum or signature verification. If the HuggingFace repository were compromised or a man-in-the-middle attack occurred, malicious weights could be loaded. The check_system.py script verifies disk space but does not verify the integrity of downloaded weights. File: scripts/check_system.py Remediation: Document the expected SHA256 hash of the model weights and add a post-download verification step. Consider using HuggingFace's built-in revision pinning (specific commit hash) to ensure reproducibility and integrity.

• 🔵 LOW LLM_RESOURCE_ABUSE — Unbounded Batch Processing Without Resource Guards

  The batch forecasting workflow in SKILL.md and forecast_csv.py allows forecasting an unbounded number of series from a CSV file. If a user provides a CSV with thousands of columns, the skill will attempt to load all series into memory simultaneously before chunking. The auto-detection of numeric columns ('value_cols = numeric_cols') means any wide CSV could trigger excessive memory consumption. File: scripts/forecast_csv.py:100 Remediation: Add a maximum series count limit (e.g., warn if >1000 columns detected, require explicit --value-cols for large CSVs). Enforce chunked processing by default rather than loading all series at once.

• 🔵 LOW LLM_DATA_EXFILTRATION — Static Analysis Flags Potential Environment Variable Exfiltration and Cross-File Exfiltration Chain

  The pre-scan static analysis detected signals for environment variable access combined with network calls (BEHAVIOR_ENV_VAR_EXFILTRATION) and a cross-file exfiltration chain across 2 files (BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN, BEHAVIOR_CROSSFILE_ENV_VAR_EXFILTRATION). The skill package contains 6 Python files and 9 markdown files, but no script files were surfaced for review. The referenced Python files (umap.py, matplotlib.py, etc.) were not found. The unreferenced Python scripts in the package could not be inspected and may contain the flagged behaviors. This warrants further investigation of the full package contents. File: SKILL.md Remediation: Inspect all 6 Python files in the package for environment variable harvesting (os.environ, os.getenv) combined with outbound network calls (requests, urllib, httpx, socket). Identify and remove any cross-file data collection and exfiltration patterns. Do not install or use this skill until all Python files have been audited.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Referenced Files Listed as Python Module Names (Suspicious Naming)

  The skill references files named matplotlib.py, umap.py, tensorflow.py, hdbscan.py, and sklearn.py. These names shadow well-known Python standard library and third-party packages. If these files existed in the skill directory, they could shadow legitimate imports and cause unexpected behavior. While the files are listed as 'not found', their naming pattern is suspicious and could indicate an attempt to shadow legitimate packages. File: SKILL.md Remediation: Avoid naming skill files with the same names as popular Python packages. If these are intended as documentation references, rename them to avoid shadowing (e.g., umap_reference.md, matplotlib_guide.md).

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing Compatibility and Allowed-Tools Metadata

  The skill does not specify 'compatibility' or 'allowed-tools' in its YAML manifest. While optional, these fields help users and agents understand the skill's intended scope and tool requirements. The absence of allowed-tools means there are no declared restrictions on what tools the agent may use when executing this skill. File: SKILL.md Remediation: Add 'compatibility' and 'allowed-tools' fields to the YAML frontmatter to clearly declare the skill's intended environment and tool restrictions.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Missing Version Pins on Package Installation

  The SKILL.md instructs installation of umap-learn and umap-learn[parametric_umap] without pinning specific versions. Unpinned package installations are vulnerable to supply chain attacks where a malicious version could be published and automatically installed. File: SKILL.md Remediation: Pin specific versions in installation instructions, e.g., 'uv pip install umap-learn==0.5.3'. Consider providing a requirements.txt or pyproject.toml with locked dependencies.

• 🔵 LOW LLM_DATA_EXFILTRATION — Static Analyzer Flags Potential Env Var Exfiltration Chain - Not Confirmed in Reviewed Content

  The pre-scan static analyzer flagged BEHAVIOR_ENV_VAR_EXFILTRATION and BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN across 2 files, and BEHAVIOR_CROSSFILE_ENV_VAR_EXFILTRATION. However, the reviewed skill content (SKILL.md and all available referenced files) contains only legitimate API calls to api.fiscaldata.treasury.gov with no environment variable access, credential harvesting, or suspicious network destinations. Several referenced files were not found (assets/, templates/ variants), meaning the flagged behavior may reside in missing/unreviewed files. This warrants attention but cannot be confirmed from available content. File: SKILL.md Remediation: Audit all files in the assets/ and templates/ subdirectories that were not available for review. Verify that no Python scripts in those directories access environment variables (os.environ, os.getenv) and subsequently make network calls. Ensure all network calls target only api.fiscaldata.treasury.gov.

• 🔵 LOW LLM_DATA_EXFILTRATION — Missing allowed-tools Declaration

  The skill does not declare an allowed-tools field in its YAML manifest. While this is optional per the spec, the skill instructs the agent to make outbound HTTP requests to an external API (api.fiscaldata.treasury.gov). Declaring allowed-tools would help constrain the agent's tool usage and make the skill's network access intentions explicit and auditable. File: SKILL.md Remediation: Add 'allowed-tools: [Python]' or equivalent to the YAML frontmatter to explicitly declare that the skill uses Python for HTTP requests, improving transparency and enabling tool restriction enforcement.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Over-Broad Capability Claims in Description

  The skill description claims access to '54 datasets and 182 data tables' and uses extensive keyword baiting (national debt, government spending, revenue, interest rates, exchange rates, savings bonds, Debt to the Penny, Daily Treasury Statements, Monthly Treasury Statements, Treasury securities auctions, etc.). While the skill does appear to legitimately cover these topics, the description is unusually keyword-dense and may be designed to maximize activation frequency across a wide range of fiscal queries. File: SKILL.md Remediation: Reduce keyword density in the description to only what is necessary to describe the skill's core functionality. Avoid exhaustive enumeration of trigger phrases that could cause over-activation.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing allowed-tools Metadata

  The skill does not specify the 'allowed-tools' field in its YAML manifest. While this is an optional field, its absence means there are no declared restrictions on which agent tools (Read, Write, Bash, Python, etc.) can be invoked by this skill. This is informational only. File: SKILL.md Remediation: Add an explicit 'allowed-tools' field to the YAML manifest to document and restrict which agent tools this skill is permitted to use, e.g., allowed-tools: [Read, Python].

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Missing Compatibility Metadata

  The skill does not specify the 'compatibility' field in its YAML manifest. This is a minor documentation gap that reduces transparency about where the skill is intended to operate. File: SKILL.md Remediation: Add a 'compatibility' field to the YAML manifest to document the intended runtime environments.

• 🔵 LOW LLM_DATA_EXFILTRATION — Static Analyzer Flags Potential Cross-File Exfiltration Chain

  The pre-scan static analysis flagged BEHAVIOR_ENV_VAR_EXFILTRATION, BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN, and BEHAVIOR_CROSSFILE_ENV_VAR_EXFILTRATION across the skill package's 5 Python files. However, no Python or Bash script files were provided for direct review in this skill's content. The SKILL.md itself contains no scripts and no referenced external files. The static findings may relate to other skills in the same repository rather than this specific skill. Without access to the flagged Python files, a definitive assessment cannot be made, but the flags warrant attention. File: SKILL.md Remediation: Review the 5 Python files in the broader skill package to identify which files triggered the static analysis flags. Audit any code that reads environment variables (os.environ, os.getenv) in combination with network calls (requests, urllib, http.client) to confirm whether data exfiltration patterns exist. If confirmed, remove or sandbox such code.

• 🔵 LOW LLM_DATA_EXFILTRATION — External URLs Embedded in Skill Instructions

  The SKILL.md references external URLs including a personal website (ahkstrategies.net), a platform (themindbook.app), and two Zenodo DOI links. While these appear to be informational references to the author's research, embedding external URLs in skill instructions creates a minor risk: if the agent is instructed to follow or fetch these links, they could serve as vectors for indirect prompt injection or data leakage. The current instructions do not direct the agent to fetch these URLs, so the risk is low. File: SKILL.md Remediation: Remove or replace external URLs with plain-text references if they are not needed for skill functionality. If kept, ensure the skill instructions never direct the agent to fetch or follow these URLs programmatically.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Over-Broad Activation Triggers in Skill Description

  The skill description contains an extensive list of trigger keywords and phrases designed to maximize activation across a wide range of user queries. Phrases like 'what if...', 'what would happen if...', 'what are the possibilities', 'explore scenarios', 'scenario analysis', 'possibility space', 'what could go wrong', 'best case / worst case', 'risk analysis', 'contingency planning', 'strategic options', 'fork-in-the-road decision', 'stress-test an idea', and 'think through consequences' are all listed as activation triggers. While individually reasonable, the cumulative breadth of these triggers represents capability inflation that could cause the skill to activate in contexts where it may not be the most appropriate tool. File: SKILL.md Remediation: Narrow the activation description to the core use case (structured what-if scenario analysis) rather than listing a broad array of trigger phrases. This reduces the risk of unintended activation and keeps the skill's scope well-defined.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Overly Broad Skill Activation Description

  The skill description is very broad and instructs the agent to trigger 'any time a spreadsheet file is the primary input or output' and to trigger 'especially when the user references a spreadsheet file by name or path — even casually'. This broad activation scope could cause the skill to activate in unintended contexts, potentially processing sensitive files the user did not intend to share with this skill's workflow. File: SKILL.md Remediation: Narrow the activation criteria to require more explicit user intent. Avoid triggering on casual mentions of file paths, as this could lead to unintended file access or processing.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Missing Dependency Version Pins

  The skill relies on several third-party Python libraries (openpyxl, pandas, defusedxml, lxml) without specifying pinned versions in the skill package. Unpinned dependencies are vulnerable to supply chain attacks where a malicious version of a package could be installed. The instructions reference openpyxl.py as a referenced file that was not found, suggesting possible missing or misreferenced dependency documentation. File: SKILL.md Remediation: Pin all dependency versions in a requirements.txt or pyproject.toml file (e.g., openpyxl==3.1.2, pandas==2.1.0, defusedxml==0.7.1, lxml==4.9.3). Include a hash verification mechanism where possible.

• 🔵 LOW LLM_COMMAND_INJECTION — Dynamic LD_PRELOAD Injection via Compiled C Shim

  The soffice.py script dynamically compiles a C source file using gcc and injects it via LD_PRELOAD into LibreOffice processes. While the C source (_SHIM_SOURCE) is hardcoded within the script and appears to be a legitimate socket compatibility shim, this pattern of runtime compilation and LD_PRELOAD injection is a high-risk technique. If the temp directory is writable by an attacker or if the script is modified, this mechanism could be used to inject arbitrary code into LibreOffice processes. The shim intercepts socket(), listen(), accept(), and close() system calls. File: scripts/office/soffice.py Remediation: Consider shipping the precompiled shim as a binary artifact rather than compiling at runtime. If runtime compilation is necessary, verify the integrity of the temp directory and ensure the compiled shim path cannot be hijacked. Add a check that _SHIM_SO does not already exist from a previous (potentially malicious) run before trusting it.

• 🔵 LOW LLM_DATA_EXFILTRATION — Environment Variable Access in soffice.py

  The soffice.py script calls os.environ.copy() to copy the entire environment and passes it to subprocess calls running LibreOffice. While this is a common and generally legitimate pattern for subprocess environment propagation, it means all environment variables (which may include secrets, API keys, tokens, etc.) are passed to the LibreOffice subprocess. The static analyzer flagged this as a potential env var exfiltration chain across files. In context, this appears to be legitimate LibreOffice configuration rather than malicious exfiltration, but it does expose all environment variables to the spawned process. File: scripts/office/soffice.py Remediation: Consider filtering the environment to only pass variables required by LibreOffice rather than copying the entire environment. At minimum, document that this is intentional behavior. If secrets are present in the environment, they will be accessible to the LibreOffice subprocess.

• 🔵 LOW LLM_DATA_EXFILTRATION — Static Analyzer Flags Cross-File Environment Variable Exfiltration Chain

  The pre-scan static analysis detected signals for environment variable access combined with network calls across multiple files (BEHAVIOR_ENV_VAR_EXFILTRATION, BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN, BEHAVIOR_CROSSFILE_ENV_VAR_EXFILTRATION). However, no script files were provided for direct inspection, and the referenced Python files (dask.py, h5py.py, s3fs.py, gcsfs.py, zarr.py, xarray.py) were all reported as 'not found'. This means the actual scripts that triggered these static findings could not be reviewed. The skill package may contain hidden or unreferenced scripts that perform credential harvesting or data exfiltration. Remediation: Conduct a full audit of all 33 files in the skill package, particularly the 5 Python files detected by the file inventory that were not surfaced for review. Inspect any scripts for environment variable reads (os.environ, os.getenv) combined with network calls (requests, urllib, httpx). Do not install or use this skill until all files have been reviewed and the static analysis findings are resolved.

• 🔵 LOW LLM_SKILL_DISCOVERY_ABUSE — Skill Name Impersonates Legitimate Open-Source Library

  The skill is named 'zarr-python' and authored by 'K-Dense Inc.', closely mimicking the well-known open-source Zarr library (zarr-developers/zarr-python). The legitimate Zarr project is maintained by the zarr-developers community, not 'K-Dense Inc.'. This naming pattern could cause users or agents to trust this skill as an official or authoritative source, enabling brand impersonation and capability inflation through association with a trusted project. File: SKILL.md Remediation: Verify the skill author's affiliation with the official zarr-developers project. If this is a third-party skill, rename it to avoid impersonating the official library (e.g., 'zarr-helper-kdense'). Users should only install skills from verified, trusted authors.

• 🔵 LOW LLM_SUPPLY_CHAIN_ATTACK — Unpinned Package Installation Instructions

  The skill instructs users to install packages (zarr, s3fs, gcsfs) without version pinning. Unpinned installations are vulnerable to supply chain attacks where a malicious version of a package could be installed. This is especially concerning for cloud storage packages (s3fs, gcsfs) that handle credentials and sensitive data. File: SKILL.md Remediation: Pin package versions explicitly (e.g., 'uv pip install zarr==2.18.0 s3fs==2024.2.0 gcsfs==2024.2.0'). Use a lockfile or requirements.txt with hashes for reproducible, secure installations.

• ⚪ INFO LLM_ANALYSIS_FAILED — LLM analysis failed

  The LLM analyzer encountered an error and could not complete semantic analysis: Empty response from LLM Remediation: Check your LLM provider configuration (API key, model name, network connectivity). The scan completed with static analysis only — LLM-based threat detection was not performed.