中文 EN
Start Review
Skill Trust Decision

mirna-target-tools

合法的 miRNA 靶基因预测生物信息学工具，存在依赖版本未锁定的供应链风险，但无恶意行为

Install decision first Source: ClawHub Scanned: Sep 2, 2026
Files 12
Artifacts 6
Violations 2
Findings 3

Why this conclusion was reached

1/4 dimensions flagged
Block
Declared vs actual capability

2 undeclared or violating capabilities were inferred.

Review
Hidden execution and egress

6 lower-risk artifacts were extracted and still need context.

Pass
Attack chain and severe findings

There is no explicit malicious chain in the report.

Review
Dependencies and supply chain hygiene

4 dependency or supply-chain issues need attention.

What drove the risk score up

pip install 无版本锁定 +10

install_dependencies.sh 第26/50行 pip3 install 未指定版本

wget/curl 远程下载 +5

从 GitHub 下载 miRanda 源码，但为标准生信工具

sudo 系统级操作 +5

install_dependencies.sh 使用 sudo apt-get，超出纯文档声明

Most important evidence

Low Supply Chain

依赖项无版本锁定

install_dependencies.sh 和 SKILL.md 中的 pip install 命令未指定依赖版本，可能导致依赖解析不确定性

scripts/install_dependencies.sh:26
建议使用 pip3 install mygene==X.Y.Z matplotlib==X.Y.Z 锁定版本
Low Priv Escalation

系统级安装操作超出文档声明

install_dependencies.sh 使用 sudo apt-get 安装系统包，这属于权限提升操作但文档未声明

scripts/install_dependencies.sh:11
建议在 SKILL.md 中明确声明需要 sudo 权限
Info Supply Chain

从非官方源下载工具

install_dependencies.sh 从 GitHub mirror 下载 miRanda（称原站 down），为可信 GitHub 源但非官方分发

scripts/install_dependencies.sh:23
可接受，但建议记录原始官方源 URL

Declared capability vs actual capability

Filesystem Pass
Declared READ
→
Inferred READ
各脚本读取用户输入文件
Network Pass
Declared READ
→
Inferred READ
annotate_targets.py:52,58 访问 MyGene.info 和 g:Profiler API
Shell Block
Declared NONE
→
Inferred WRITE
miranda_predict.py:29, targetscan_predict.py:24 调用 subprocess
Environment Block
Declared NONE
→
Inferred READ
check_env.py:12 shutil.which() 检测工具

Suspicious artifacts and egress

Medium External URL
https://www.targetscan.org/

references/workflow.md:147

Medium External URL
https://biit.cs.ut.ee/gprofiler/api/gost/profile/

scripts/annotate_targets.py:52

Medium External URL
https://www.targetscan.org/cgi-bin/targetscan/data_download.cgi

scripts/install_dependencies.sh:33

Medium External URL
https://brew.sh/

scripts/install_dependencies.sh:38

Medium External URL
https://cytoscape.org/download.html

scripts/install_dependencies.sh:59

Medium External URL
https://cytoscape.org/

scripts/install_dependencies.sh:71

Dependencies and supply chain

PackageVersionSourceKnown vulnNotes
pandas * pip No 无版本锁定
numpy * pip No 无版本锁定
mygene * pip No 无版本锁定，可选依赖
matplotlib * pip No 无版本锁定，可选依赖

File composition

12 files · 1306 lines
Python 7 files · 801 linesMarkdown 3 files · 412 linesShell 1 files · 72 linesOther 1 files · 21 lines
Files of concern · 3
scripts/annotate_targets.py Python · 251 lines
https://biit.cs.ut.ee/gprofiler/api/gost/profile/
references/workflow.md Markdown · 162 lines
https://www.targetscan.org/
scripts/install_dependencies.sh Shell · 72 lines
依赖项无版本锁定 · 系统级安装操作超出文档声明 · 从非官方源下载工具 · https://www.targetscan.org/cgi-bin/targetscan/data_download.cgi · https://brew.sh/ · https://cytoscape.org/download.html · https://cytoscape.org/
Other files · README.md · SKILL.md · merge_targets.py · plot_enrichment.py · miranda_predict.py · targetscan_predict.py +3

Security positives

代码结构清晰，功能与文档描述一致
无凭证收割、环境变量遍历等恶意行为
无 base64 编码、eval()、反分析等可疑模式
网络请求明确用于生信 API（MyGene.info、g:Profiler）
subprocess 调用外部生信工具符合工具设计意图