Security audit

Clinicaltrials Gov Parser

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed ClinicalTrials.gov lookup tool with some reliability and dependency hygiene issues, but no evidence of hidden access, credential use, persistence, exfiltration, or destructive behavior.

Install only in an environment where unpinned Python dependencies are acceptable, or pin and review requests first. Treat the tool as a current ClinicalTrials.gov lookup and summary helper, not a complete status-change monitoring system, unless snapshot comparison is added.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: requirements.txt:1
Finding: Unpinned Third-Party Dependencies Permit Unreviewed Package Resolution
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill advertises network/API functionality and includes executable Python usage, but the manifest does not declare any explicit tool scope such as allowed network access. That creates an authorization and transparency gap: an agent or reviewer cannot reliably enforce what external actions the skill is permitted to take, increasing the chance of unintended outbound requests.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger text is broad enough to match generic requests about tracking, monitoring, or analyzing trials, which can cause the skill to activate in contexts the user did not intend. Overbroad activation increases the risk of unnecessary network access, unintended file operations, and misleading delegation to this skill instead of a safer or more appropriate workflow.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill documentation states that it performs external API calls and read/write operations, but it does not clearly tell users what data leaves the environment or what local files may be created or modified. This lack of disclosure weakens informed consent and increases the chance that sensitive user-supplied search terms, trial lists, or generated reports are transmitted or stored unexpectedly.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The function is advertised as monitoring status changes, but it only fetches the current state of each trial and annotates it with a 'monitored_since' timestamp. Because it never loads prior snapshots or compares historical values, users may wrongly believe they are receiving true change detection, which can lead to missed competitor updates or incorrect intelligence decisions.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The summary report computes a lookback date but does not limit the trial search itself to that period, so the report can imply time-bounded analysis while actually aggregating all matching trials. In a competitive-intelligence context, this can produce misleading reports and false conclusions about recent activity because only 'recent_updates' is date-filtered while headline totals and breakdowns are not.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 96% confidence
Finding: The dependency list is unpinned, so builds may resolve to different versions over time and become non-reproducible. For dataclasses, this mainly creates supply-chain and reliability risk because an unexpected or compromised release could be installed without review, though the package itself is typically only needed on older Python versions.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
dataclasses requests

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 99% confidence
Finding: requests is unpinned, which makes the environment susceptible to silently pulling in different releases, including versions with known security flaws. In a skill that fetches external data from ClinicalTrials.gov or related URLs, dependency drift increases the chance of introducing exploitable HTTP/client-side weaknesses or inconsistent behavior.
Content: Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.
text
dataclasses requests

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 97% confidence
Finding: The manifest does not pin requests, and multiple advisories exist for some requests releases, so the deployed environment could resolve to a vulnerable version without visibility. Because this skill likely performs outbound HTTP requests to monitor trial data, an affected requests version could expose credentials, weaken TLS/request verification, or mishandle malicious URLs depending on runtime usage.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.