Security audit

Digital Twin Patient Builder

Security checks for vulnerabilities and agentic risk

Overview

This skill appears purpose-aligned, but it handles sensitive patient and genomic data and writes medical simulation results without adequate scoping, privacy warnings, or safety controls.

Review this skill carefully before installing. Use only synthetic or properly de-identified data unless you have a controlled environment and permission to process patient information. Avoid enabling or assuming any network/API use until the publisher documents what data leaves the machine. Pin dependencies, restrict input and output paths, and treat all dose recommendations as unvalidated research output requiring qualified medical review.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: requirements.txt:1
Finding: Unpinned and Unnecessary Third-Party Dependencies Create Supply-Chain Exposure
Content: View full analysis
= 1.21.0` at `SKILL.md:96`, but `requirements.txt` does not enforce even that lower bound. No upper bound, exact version, artifact hash, or trusted-index policy is provided. This finding does not establish that the currently published packages are malicious. The vulnerability is the installation process's inability to constrain and authenticate the code it installs. ### Attack Path 1. A user follows the documented prerequisite and runs `pip install -r requirements.txt`. 2. Pip queries the user's configured package index or mirror for `dataclasses`, `enum`, and `numpy`. 3. Because no exact versions or hashes are specified, pip accepts packages selected from the index at installation time. 4. An attacker compromises a relevant package release or package mirror, influences dependen ...[truncated 974 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/main.py:466
Finding: Unbounded and Insufficiently Validated Dose Inputs Permit Resource Exhaustion and Invalid Simulation Results
Content: View full analysis
Remediation: View remediation
MAX_DOSE_COUNT: raise ValueError("Too many dose values") validated = [] for value in raw: if isinstance(value, bool) or not isinstance(value, (int, float)): raise ValueError("Every dose must be numeric") value = float(value) if not math.isfinite(value): raise ValueError("Dose values must be finite") if not MIN_DOSE <= value <= MAX_DOSE: raise ValueError("Dose value is outside the supported range") validated.append(value) return validated ``` ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This skill is designed to process highly sensitive health and genomic data and also claims external API/network access, yet it provides no explicit privacy warning, consent requirement, or data-transmission disclosure. In this context, missing disclosure is dangerous because users may provide regulated patient data without understanding that it could leave the local environment or be logged, retained, or exposed by third parties.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.
md
python scripts/main.py --patient patient_data.json --drug drug_profile.json --doses "[50, 100, 150]"

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill advertises executable behavior that reads and writes files, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization and review gap: users and hosting agents cannot reliably constrain filesystem access, increasing the chance of unintended data access or output being written to unsafe locations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The usage examples show file-based inputs and an optional output path, but they do not warn that results may be written to disk or that the workflow may communicate with external services. For a medical digital-twin skill, this omission raises the risk of accidental storage or transmission of sensitive patient data in places users did not intend or secure appropriately.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file description and most user-facing help/output strings are written in Chinese, which imposes a specific language on users. There is no option to select language or explanation that this is a region-specific tool, so this conflicts with the policy against forced language/locale constraints without opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script processes highly sensitive patient-related genotype, clinical, imaging, and drug-response simulation data, then writes results to a persistent JSON file by default without an explicit warning, consent step, or secure handling controls. In a healthcare context, silent persistence materially increases the risk of privacy leakage, accidental disclosure, insecure storage, or downstream mishandling of regulated health data.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 94% confidence
Finding: The dependency is unpinned, which makes builds non-reproducible and allows different environments to resolve different package versions over time. That increases supply-chain risk because a newly published malicious or vulnerable release could be installed without any code change in the skill.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
dataclasses enum numpy

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 90% confidence
Finding: This entry is unpinned, so installation may pull different versions in different environments, weakening reproducibility and dependency integrity. Even if the package is low risk, leaving it unconstrained creates avoidable supply-chain exposure.
Content: Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.
text
dataclasses enum numpy

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 98% confidence
Finding: An unpinned numpy dependency is more concerning because it is a widely used package with a history of security advisories. Without version pinning, deployments may silently install a vulnerable or unexpected release, creating both security and reliability risk in a medically oriented modeling skill.
Content: Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.
text
dataclasses enum numpy

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 96% confidence
Finding: The manifest does not specify a numpy version, so there is no way to verify whether the installed release is affected by known advisories. In a digital twin patient builder, incorrect or compromised numerical processing could undermine safety-related simulation outputs, making dependency ambiguity more dangerous than in a trivial application.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.