T08 · Insecure Dependencies
Warning
- Location
requirements.txt:1- Finding
Unnecessary and Unpinned Third-Party Dependencies Create Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
Security audit
Inclusion Criteria Gen
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a local clinical-trial criteria tool, but it needs review because its file access and installation guidance are loosely scoped and inconsistently documented.
Install only in an isolated environment, avoid running pip install -r requirements.txt unless the dependencies are removed or pinned, and invoke the CLI only with trusted paths inside a dedicated workspace. Do not provide PHI, patient-level data, secrets, or confidential protocol material unless your organization has approved local storage and review controls. Treat generated eligibility changes as drafting aids only, not clinical or regulatory decisions.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/main.py:695- Finding
Unrestricted CLI File Paths Allow Arbitrary File Reading and Overwriting
- Content
View full analysis
- Remediation
View remediation
Path: candidate = (WORKSPACE / value).resolve() if candidate != WORKSPACE and WORKSPACE not in candidate.parents: raise ValueError("Path must remain inside the workspace") return candidate ``` 3. Reject absolute user-supplied paths unless explicitly required and separately authorized. 4. Reject symlinks for both input and output files, and validate parent directories to reduce symlink race risks. 5. Refuse to overwrite existing files by default. Use exclusive creation mode (`'x'`) or require an explicit trusted overwrite option. 6. Write output atomically to a temporary file in the same approved directory, apply restrictive permissions, and then rename it into place. 7. Validate input file size and JSON schema before processing to reduce resource-exhaustion and malformed-input risks. 8. If arbitrary paths are an intentional local CLI feature, do not expose them directly to untrusted Agent prompts or remote requests. Apply path authorization in the calling service. 9. Return sanitized errors that do not reveal unintended absolute filesystem paths. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill documents file read/write behavior but does not declare an explicit tool scope such as permissions or allowed-tools. This creates an authorization ambiguity where an agent or reviewer cannot reliably constrain filesystem access, increasing the risk of unintended reads/writes if the implementation is broader than expected.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The documentation describes the skill as a pure-Python local generator/optimizer, yet the risk section also states external API/network access. This inconsistency can mislead operators into approving or running the skill under weaker trust assumptions, while the actual implementation may transmit trial or patient-related data externally.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
Claiming 'Dependencies: None (pure Python)' while also declaring external API/network behavior is a contradictory security signal. Reviewers may incorrectly assume the skill is self-contained and low-risk, which can hide supply-chain, exfiltration, or outbound-communication exposure introduced by undeclared libraries or services.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill explicitly supports file writes and mentions network/API behavior, but it does not describe privacy, retention, or data-handling risks. In a clinical-trial workflow, inputs may contain sensitive protocol details or even regulated health-related data, so lack of disclosure and safeguards increases the chance of accidental exposure or noncompliant processing.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The criterion text "Pregnant or breastfeeding women" imposes a gendered eligibility constraint in natural language that excludes a protected group categorically. In a generic template file with no documented regional, regulatory, or protocol-specific justification, this can constitute an organizational policy concern around inclusive language and participant categorization.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The referenced benchmark data explicitly encourages relaxing eligibility criteria such as renal function, performance status, brain metastases, and age limits by highlighting enrollment gains, but it does not pair those recommendations with trial-specific safety guardrails, scientific justification requirements, or human review constraints. In a clinical trial design skill, this can bias downstream outputs toward broader enrollment at the expense of participant safety, protocol validity, and regulatory compliance.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This code performs a file write of generated study criteria and recruitment metrics, which may contain sensitive protocol-design information. Although it prints a success message afterward, there is no prior user warning or explanatory comment/docstring near the operation disclosing that data will be persisted to disk at a user-specified location.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The optimize path writes derived criteria data to an output file, but the code provides no advance disclosure that potentially sensitive trial information from the input JSON will be stored. A post-write success print is present, but it does not function as a warning before the safety-relevant file write occurs.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This branch persists analysis output based on the supplied criteria file, yet there is no explicit warning or explanatory comment about local storage of potentially sensitive study information. The success message appears only after the write and does not notify the user beforehand.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The benchmark placeholder writes a report containing study-design fields and condition data to an output file. There is no explicit user warning before persisting that information, and the afterward print statement does not meaningfully disclose the storage behavior in advance.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 60% confidence
- Finding
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
- Content
text dataclasses enum
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 60% confidence
- Finding
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
- Content
text dataclasses enum
Static analysis
No suspicious patterns detected.