Announcing Beacon: Self-improving memory for coding agents
BeaconIntel
2.9K
← All skills
Skill

alphafold-skill

skill:openai/plugins#alphafold-skill

Submit compact AlphaFold Protein Structure Database API requests for prediction, UniProt summary, sequence summary, and annotation lookups. Use when a user wants AlphaFold metadata or concise structure summaries

SkillsMP
Verdict
Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 23:37 UTC at 0722921

Dispute security verdict

If you believe this verdict is incorrect, submit a dispute and we'll review it.

2
findings
high
highest severity
2
threat classes
5,479
files scanned
51/58
checks satisfied
0
package advisories

Why this verdict

  • suspicious: finding skill:plugins/life-science-research/skills/alphafold-skill:plugins/life-science-research/skills/alphafold-skill/SKILL.md:24:EXFIL
  • suspicious: finding skill:plugins/life-science-research/skills/alphafold-skill:plugins/life-science-research/skills/alphafold-skill/scripts/rest_request.py:140:PERSIST

Security findings 2

Persistence

highContextual riskmedium confidence

rest_request.py's save_raw feature writes the verbatim body of any fetched response to an arbitrary agent-chosen filesystem path while creating parent directories, which combined with the unrestricted destination forms a download-and-drop primitive that could place remote content into persistence locations.

plugins/life-science-research/skills/alphafold-skill/scripts/rest_request.py:140
path.parent.mkdir(parents=True, exist_ok=True)
vector:code
Counter-argument considered

The counter-arguments (raw saving is openly documented and defaults to /tmp) fail because disclosure is not the declared core capability and the raw_output_path destination is unrestricted with parent directories auto-created. Combined with the script's arbitrary-host fetch, this is a concrete network-response-to-filesystem drop chain undeclared by the AlphaFold-summary description, so the finding stands as contextual PERSIST.

Data exfiltration

highContextual risklow confidence

The skill body instructs the agent to drive rest_request.py through a generic REST contract (caller-chosen base_url, method, headers, and JSON/form bodies) that exceeds the declared AlphaFold-only scope and gives the agent a primitive to send arbitrary request data to arbitrary hosts.

plugins/life-science-research/skills/alphafold-skill/SKILL.md:24
Optional fields: `method`, `params`, `headers`, `json_body`, `form_body`
vector:instruction
Counter-argument considered

Strongest counter-case is that the AlphaFold patterns are 'preferred', but the contract itself makes base_url, method, headers, and bodies fully caller-chosen with no host allowlist, and the code even accepts a full URL via path, so the declared AlphaFold-only description does not cover it and no carve-out applies. The stdin instruction plus the session.request sink is a concrete agent-driven chain, so the finding stands.

Open questions 2

What the analysis could not settle from the code alone.

Whether any caller or documented example ever directs base_url or an absolute path at a host other than alphafold.ebi.ac.uk, which would establish a concrete off-host destination for the generic client instead of a latent capability.
Data exfiltration
Whether the full-file decoded unit recovers additional hidden content beyond the four benign comment lines shown for lines 1-276 of rest_request.py.

Coverage gaps 25

Parts of the artifact the static analysis could not fully examine.

context:unanalyzable_binary binary content is only byte-scanned
plugins/codex-security/mcp/helpers.mjs.br.part-000
context:unanalyzable_binary macho content is only byte-scanned
plugins/codex-security/mcp/native/darwin-arm64/unix.node
context:unanalyzable_binary macho content is only byte-scanned
plugins/codex-security/mcp/native/darwin-x64/unix.node
context:unanalyzable_binary elf content is only byte-scanned
plugins/codex-security/mcp/native/linux-arm64-gnu/unix.node
context:unanalyzable_binary elf content is only byte-scanned
plugins/codex-security/mcp/native/linux-arm64-musl/unix.node
context:unanalyzable_binary elf content is only byte-scanned
plugins/codex-security/mcp/native/linux-x64-gnu/unix.node
context:unanalyzable_binary elf content is only byte-scanned
plugins/codex-security/mcp/native/linux-x64-musl/unix.node
context:unanalyzable_binary pe content is only byte-scanned
plugins/codex-security/mcp/native/win32-arm64/windows.node
context:unanalyzable_binary pe content is only byte-scanned
plugins/codex-security/mcp/native/win32-x64/windows.node
context:unanalyzable_binary binary content is only byte-scanned
plugins/codex-security/mcp/server.mjs.br.part-000
context:unanalyzable_binary binary content is only byte-scanned
plugins/codex-security/mcp/server.mjs.br.part-001
context:oversize archive member exceeds 8388608 bytes; truncated, no text
plugins/shopify/skills/shopify-admin/assets/admin_2026-04.json.gz!/admin_2026-04.json
context:decoded_views_exceeded 452 derived view(s) beyond the per-file view cap: decoded:charcode, decoded:rot13, decoded:unicode-escape
plugins/creative-production/mcp/server.bundle.mjs
context:bytes_unavailable yara-x: no bytes to scan
plugins/shopify/skills/shopify-admin/assets/admin_2026-04.json.gz!/admin_2026-04.json
ledger_finding_without_valid_finding run 1: declared-vs-actual.0 SRC:f7541a5fd7a94c34
ledger_finding_without_valid_finding run 1: declared-vs-actual.0 SRC:ba192ab62abdaba0
ledger_finding_without_valid_finding run 1: declared-vs-actual.0 SRC:55552e532e3f2cc5
ledger_finding_without_valid_finding run 1: behavior-chains.0 SRC:f7541a5fd7a94c34
ledger_finding_without_valid_finding run 1: behavior-chains.0 SRC:2714affe1bdc45d7
ledger_finding_without_valid_finding run 1: behavior-chains.0 SRC:ba192ab62abdaba0
ledger_finding_without_valid_finding run 1: behavior-chains.0 SRC:55552e532e3f2cc5
invalid_judge_finding declared-vs-actual.0
invalid_judge_finding behavior-chains.0
invalid_expansion instruction-surface.0
invalid_judge_finding request.0