Digital Twin Patient Builder

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:45 AM UTC
• Version: 0.1.0

Overview

This skill appears purpose-aligned, but it handles sensitive patient and genomic data and writes medical simulation results without adequate scoping, privacy warnings, or safety controls.

Review this skill carefully before installing. Use only synthetic or properly de-identified data unless you have a controlled environment and permission to process patient information. Avoid enabling or assuming any network/API use until the publisher documents what data leaves the machine. Pin dependencies, restrict input and output paths, and treat all dose recommendations as unvalidated research output requiring qualified medical review.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1
• Finding: Unpinned and Unnecessary Third-Party Dependencies Create Supply-Chain Exposure<![CDATA[ ## Vulnerability Details **File Location**: `requirements.txt:1-3`; installation instruction at `SKILL.md:182-184` **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium ### Vulnerable Code `requirements.txt:1-3`: ```text dataclasses enum numpy ``` `SKILL.md:182-184`: ```bash # Python dependencies pip install -r requirements.txt ``` ### Technical Analysis All dependencies are specified without exact versions or integrity hashes. Consequently, installation resolves whichever compatible releases are available from the configured package index at installation time. This makes builds non-reproducible and prevents verification that the installed artifacts are the versions reviewed by the project author. The `enum` dependency is unnecessary on supported modern Python versions because `enum` is part of the Python standard library. Likewise, `dataclasses` is part of the standard library beginning with Python 3.7. Installing third-party packages corresponding to standard-library module names unnecessarily increases exposure to package substitution, dependency confusion, package-index compromise, and malicious release risks. The documentation states `numpy >= 1.21.0` at `SKILL.md:96`, but `requirements.txt` does not enforce even that lower bound. No upper bound, exact version, artifact hash, or trusted-index policy is provided. This finding does not establish that the currently published packages are malicious. The vulnerability is the installation process's inability to constrain and authenticate the code it installs. ### Attack Path 1. A user follows the documented prerequisite and runs `pip install -r requirements.txt`. 2. Pip queries the user's configured package index or mirror for `dataclasses`, `enum`, and `numpy`. 3. Because no exact versions or hashes are specified, pip accepts packages selected from the index at installation time. 4. An attacker compromises a relevant package release or package mirror, influences dependen ...[truncated 974 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `enum` because the implementation imports the standard-library `enum.Enum`. 2. Remove `dataclasses` when the project requires Python 3.7 or later. If legacy Python support is genuinely required, declare that support explicitly and conditionally install the reviewed backport using an environment marker. 3. Pin NumPy and every required transitive dependency to reviewed versions. 4. Generate and verify cryptographic hashes for all permitted artifacts. Install with hash enforcement, for example: ```bash python -m pip install --require-hashes -r requirements.txt ``` 5. Declare a supported Python version and keep documentation consistent with the dependency manifest. 6. Use a trusted package index, disallow unexpected extra indexes, and review lockfile changes before deployment. 7. Add automated dependency scanning and scheduled patch review rather than allowing unconstrained upgrades during installation. 8. Avoid installing dependencies with administrative or root privileges. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/main.py:466
• Finding: Unbounded and Insufficiently Validated Dose Inputs Permit Resource Exhaustion and Invalid Simulation Results<![CDATA[ ## Vulnerability Details **File Location**: `scripts/main.py:441-447` and `scripts/main.py:466-468` **Vulnerability Type**: T09: Insecure Skill Coding Practices **Risk Level**: Medium ### Vulnerable Code `scripts/main.py:441-447`: ```python parser.add_argument("--patient", required=True, help="患者数据JSON文件路径") parser.add_argument("--drug", required=True, help="药物配置JSON文件路径") parser.add_argument("--doses", default="[50, 100, 150]", help="剂量列表 (JSON格式)") parser.add_argument("--output", default="simulation_results.json", help="输出文件路径") parser.add_argument("--optimize", action="store_true", help="执行剂量优化") parser.add_argument("--dose-min", type=float, default=50, help="优化时最小剂量") parser.add_argument("--dose-max", type=float, default=200, help="优化时最大剂量") ``` `scripts/main.py:466-468`: ```python doses = json.loads(args.doses) print(f"正在模拟剂量方案: {doses}...") results = twin.simulate_dose_range(doses) ``` Each supplied dose is processed without validation in `scripts/main.py:345-350`: ```python results = [] for dose in doses: result = self.simulate_dose(dose, simulation_days) results.append(result) return results ``` Each result includes a generated concentration profile in `scripts/main.py:323-326`: ```python "concentration_profile": { "time_hours": time_points.tolist(), "concentration": concentration_profile.tolist() } ``` ### Technical Analysis The JSON parsed from `--doses` is passed directly into the simulation without verifying: - That the top-level value is a list. - That the list is nonempty and has a safe maximum length. - That every element is a numeric value rather than a boolean, string, object, or nested collection. - That values are finite and exclude `NaN` and infinity. - That doses are positive and within a documented safe range. The optimization bounds are parsed as floating-point values but are not checked for finiteness, positivity, ordering, or maximum range. Simulation work and output memory increase linearly with t ...[truncated 2598 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Validate that `--doses` parses to a nonempty JSON list. 2. Apply a strict maximum number of dose entries appropriate to the intended workload. 3. Reject booleans, strings, nested values, and other nonnumeric types. 4. Convert accepted values to floats and reject `NaN` or infinity with `math.isfinite`. 5. Require every dose to be positive and within a documented, clinically reviewed range. 6. Validate optimization parameters so that both bounds are finite and positive, `dose_min < dose_max`, and neither exceeds the supported range. 7. Limit the total serialized result size or omit detailed concentration profiles unless explicitly requested. 8. Catch JSON parsing and validation errors and return concise, sanitized error messages. 9. Add tests for oversized arrays, empty arrays, malformed JSON, strings, booleans, negative values, zero, infinity, NaN, reversed optimization bounds, and extreme magnitudes. 10. Clearly state that the model is an unvalidated research simulation and must not be used as clinical dosing guidance without qualified review. A validation helper should enforce constraints before simulation, for example: ```python import math MAX_DOSE_COUNT = 100 MIN_DOSE = 0.01 MAX_DOSE = 1000.0 def validate_doses(raw): if not isinstance(raw, list) or not raw: raise ValueError("Doses must be a nonempty JSON array") if len(raw) > MAX_DOSE_COUNT: raise ValueError("Too many dose values") validated = [] for value in raw: if isinstance(value, bool) or not isinstance(value, (int, float)): raise ValueError("Every dose must be numeric") value = float(value) if not math.isfinite(value): raise ValueError("Dose values must be finite") if not MIN_DOSE <= value <= MAX_DOSE: raise ValueError("Dose value is outside the supported range") validated.append(value) return validated ``` ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: This skill is designed to process highly sensitive health and genomic data and also claims external API/network access, yet it provides no explicit privacy warning, consent requirement, or data-transmission disclosure. In this context, missing disclosure is dangerous because users may provide regulated patient data without understanding that it could leave the local environment or be logged, retained, or exposed by third parties.

Ae1

High

• Category: analysis-evasion

Content

python scripts/main.py --patient patient_data.json --drug drug_profile.json --doses "[50, 100, 150]"

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill advertises executable behavior that reads and writes files, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization and review gap: users and hosting agents cannot reliably constrain filesystem access, increasing the chance of unintended data access or output being written to unsafe locations.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The usage examples show file-based inputs and an optional output path, but they do not warn that results may be written to disk or that the workflow may communicate with external services. For a medical digital-twin skill, this omission raises the risk of accidental storage or transmission of sensitive patient data in places users did not intend or secure appropriately.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The file description and most user-facing help/output strings are written in Chinese, which imposes a specific language on users. There is no option to select language or explanation that this is a region-specific tool, so this conflicts with the policy against forced language/locale constraints without opt-in.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script processes highly sensitive patient-related genotype, clinical, imaging, and drug-response simulation data, then writes results to a persistent JSON file by default without an explicit warning, consent step, or secure handling controls. In a healthcare context, silent persistence materially increases the risk of privacy leakage, accidental disclosure, insecure storage, or downstream mishandling of regulated health data.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

dataclasses
enum
numpy

• Confidence: 94% confidence
• Finding: The dependency is unpinned, which makes builds non-reproducible and allows different environments to resolve different package versions over time. That increases supply-chain risk because a newly published malicious or vulnerable release could be installed without any code change in the skill.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

dataclasses
enum
numpy

• Confidence: 90% confidence
• Finding: This entry is unpinned, so installation may pull different versions in different environments, weakening reproducibility and dependency integrity. Even if the package is low risk, leaving it unconstrained creates avoidable supply-chain exposure.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

dataclasses
enum
numpy

• Confidence: 98% confidence
• Finding: An unpinned numpy dependency is more concerning because it is a widely used package with a history of security advisories. Without version pinning, deployments may silently install a vulnerable or unexpected release, creating both security and reliability risk in a medically oriented modeling skill.

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 96% confidence
• Finding: The manifest does not specify a numpy version, so there is no way to verify whether the installed release is affected by known advisories. In a digital twin patient builder, incorrect or compromised numerical processing could undermine safety-related simulation outputs, making dependency ambiguity more dangerous than in a trivial application.

Static analysis

No suspicious patterns detected.