Security audit

Materials Lab

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a genuine materials-science research plugin, with Python and Materials Project access that matches its stated purpose.

This skill looks internally consistent with what it claims to do. Before installing, make sure you trust the npm/GitHub source and are comfortable running its Python setup, which installs scientific packages such as mp-api, pymatgen, ASE, and matplotlib. Only provide a Materials Project API key if you need live Materials Project queries; otherwise it can operate in offline/mock mode. Also review the configured workspaceRoot so generated notes, reports, plots, and structures are written where you expect.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: dist/src/cli/process-runner.js:3
Evidence: const child = spawn(command, args, {

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: dist/src/services/python-bridge.js:61
Evidence: const child = spawn(pythonPath, ["-m", "materials_lab.worker"], {

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/cli/process-runner.ts:22
Evidence: const child = spawn(command, args, {

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/services/python-bridge.ts:101
Evidence: const child = spawn(pythonPath, ["-m", "materials_lab.worker"], {

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: dist/src/services/python-bridge.js:66
Evidence: MATERIALS_PROJECT_API_KEY: [REDACTED],

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/services/python-bridge.ts:106
Evidence: MATERIALS_PROJECT_API_KEY: [REDACTED],