mrmrmr

LLM-powered automated Mendelian Randomization for causal discovery in biomedical research

This package appears to implement what it claims, but review these points before use: - Clarify OPENGWAS_JWT: the registry lists it as required but SKILL.md and the CLI treat it as optional. Only provide this token if you need OpenGWAS access. - Inspect and control the LLM endpoint: OPENAI_BASE_URL or LLM_PROVIDER can redirect requests to nonstandard endpoints. Do not set OPENAI_BASE_URL to unknown domains (examples in demo code such as https://api.gpt.ge/v1/ are unexpected). - Review the included source (especially mragent/mragent/LLM.py and agent_tool files) to confirm where data (paper abstracts, extracted pairs, GWAS IDs) are sent — this code will send text to whichever LLM provider you configure. - Be cautious with sensitive or unpublished data: the agent will transmit extracted text and identifiers to external LLMs unless you run a local LLM (ollama) or an isolated proxy. - External file downloads: optional features (MR_MOE model, MRlap supporting files) point to Dropbox/Box — validate those links before downloading and prefer official project releases. - Run first in an isolated environment (container or VM), inspect network calls (or set OPENAI_BASE_URL to a controlled proxy) and verify R package requirements before running with real patient-level or sensitive data. If these points are acceptable and you configure the LLM endpoint and tokens carefully (or use a local LLM), the skill's requirements are broadly proportionate to its purpose.

Type: OpenClaw Skill Name: mrmrmr Version: 1.0.2 The skill bundle contains several high-risk security vulnerabilities that could lead to Remote Code Execution (RCE), though they appear to be unintentional design flaws rather than intentional malice. Specifically, 'mragent/agent_workflow.py' uses the 'eval()' function on GWAS IDs (which are processed from LLM outputs), and 'mragent/agent_tool.py' uses 'os.system()' to execute R scripts constructed via insecure string formatting. Additionally, 'web_demo.py' employs 'subprocess.Popen(shell=True)' and patches 'os.system' in a way that increases the attack surface for command injection. While these patterns are highly dangerous, they are consistent with the stated purpose of automating Mendelian Randomization analysis in a research context, and no evidence of intentional data exfiltration or backdoors was found.