Bmi Bsa Calculator

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:12 AM UTC
• Version: 0.1.0

Overview

The skill is a small local BMI/BSA calculator, but its clinical documentation overstates supported dosing, pediatric, and formula capabilities in ways that could mislead users.

Review before installing, especially if this could be used for real clinical or medication decisions. Treat outputs as unvalidated examples only, remove or ignore requirements.txt, and do not rely on the advertised pediatric, multi-formula, AUC, dose-cap, or reporting features unless the implementation is corrected and independently validated.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Standard-Library Modules Misdeclared as Installable Dependencies

Content

View full analysis

Vulnerability Details

File Location: requirements.txt, lines 1-7
Vulnerability Type: Dependency confusion and unnecessary third-party package installation
Risk Level: Medium

Vulnerable Code

text

# No external dependencies required
# Uses Python standard library only
argparse
json
math
sys
typing

Technical Analysis

The dependency manifest lists argparse, json, math, sys, and typing, even though these are Python standard-library modules. They must not be installed from a third-party package index.

This also directly contradicts the manifest comments and the prerequisite statement in SKILL.md, which state that no external packages are required. If a user or automated deployment system executes the conventional command pip install -r requirements.txt, pip may attempt to resolve these names from the configured package index. Depending on the environment and index contents, this can cause installation failure or install unrelated third-party distributions that happen to use standard-library module names.

The latter behavior creates an avoidable supply-chain attack surface. A malicious or compromised package distribution could execute installation hooks or introduce attacker-controlled code into the Python environment.

Attack Path

1. A user, CI job, container build, or deployment process treats requirements.txt as the authoritative dependency manifest.
2. The process runs pip install -r requirements.txt.
3. Pip queries its configured public or private package index for the listed names.
4. A distribution unrelated to Python's standard-library implementation is resolved for one or more names.
5. The distribution is downloaded and installed with the permissions of the installation process.
6. Malicious installation hooks or subsequently imported package code could execute within that environment.

Successful exploitation depends on package-index availability, resolution behavior, package contents, and the pri ...[truncated 731 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all standard-library module names from requirements.txt.
2. Because the application uses only the Python standard library, either delete requirements.txt or retain only explanatory comments:

text

# No third-party dependencies are required.

3. If external dependencies are introduced later:
   • Use verified distribution names rather than import-module names.
   • Pin reviewed versions.
   • Use hashes, such as pip's --require-hashes workflow.
   • Install only from trusted, explicitly configured indexes.
   • Review transitive dependencies and package installation behavior.
4. Add a CI check that creates a clean environment and verifies that the application runs without installing third-party packages.
5. Keep the dependency manifest consistent with the prerequisites documented in SKILL.md.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill documentation materially overstates clinical capabilities and understates behavior, including claiming support for multiple BSA formulas and pediatric/adult norm handling that static analysis indicates are not actually implemented. In a medical dosing context, this can cause users or downstream agents to rely on incorrect calculations or assumptions, creating patient safety risk; additionally, undocumented file output broadens behavior beyond the declared purpose.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The lifecycle section says planned improvements include features that earlier sections present as already available, which signals inconsistent and unreliable documentation. In a clinical calculator, this inconsistency can mislead operators into using nonexistent pediatric or multi-formula functionality, increasing the chance of wrong dosing or inappropriate interpretation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The implementation materially diverges from the stated skill capabilities: it only computes BSA with the DuBois formula and uses a single adult WHO BMI categorization, despite claiming support for multiple BSA formulas and pediatric/adult norms. In a clinical context, this mismatch can mislead users into believing alternate formulas or age-appropriate interpretations were applied, creating patient-safety risk through incorrect assessment or downstream dosing decisions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The code performs drug dose calculation even though that capability is not clearly disclosed in the manifest description. Hidden or under-described clinical dosing functionality is risky because users, reviewers, or integrators may not apply the heightened scrutiny, guardrails, and validation appropriate for medication-related outputs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill provides calculated drug dosing output without any visible warning that the result is informational only and must not be used as sole medical guidance. Because this is a clinical dosing context, omission of a safety warning materially increases the chance of overreliance on an unvalidated calculation, potentially leading to medication error and patient harm.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The risk and security sections minimize file-system and execution risk by asserting no unauthorized file access and sandboxed execution, even though the skill declares Bash and Write access and supports user-specified output paths. This can cause reviewers or users to underestimate the operational risk surface and approve the skill with insufficient controls.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 60% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

# No external dependencies required
# Uses Python standard library only
argparse
json
math
sys

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 60% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text

# No external dependencies required
# Uses Python standard library only
argparse
json
math
sys
typing

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 60% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · requirements.txt (reported line 5)May include surrounding context.

text

# Uses Python standard library only
argparse
json
math
sys
typing

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 60% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · requirements.txt (reported line 6)May include surrounding context.

text

argparse
json
math
sys
typing

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 60% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · requirements.txt (reported line 7)May include surrounding context.

text

json
math
sys
typing

Static analysis

No suspicious patterns detected.