Medical Device MDR Auditor

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:41 AM UTC
• Version: 1.0.0

Overview

This skill is not designed to steal data, but its MDR audit results can be misleading because it mostly checks filenames and can be routed outside its stated medical-device purpose.

Install only if you treat it as a preliminary local checklist, not a regulatory compliance decision tool. Run it on copies of selected technical-file folders, choose an output path that will not overwrite important files, remove or pin unnecessary dependencies before installation, and have a qualified MDR reviewer verify the underlying documents manually.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unnecessary Unpinned Third-Party Dependencies Duplicate Standard-Library Modules

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1-2; installation instruction at SKILL.md:234-238
Vulnerability Type: Supply-chain exposure through unnecessary, unpinned dependencies
Risk Level: Medium

Vulnerable Code

requirements.txt:1-2:

text

dataclasses
enum

SKILL.md:234-238:

text

# Python dependencies
pip install -r requirements.txt

Technical Analysis

The project declares Python 3.10 or later as its runtime baseline, where both dataclasses and enum are provided by the Python standard library. Nevertheless, the installation instructions direct users to install unpinned third-party packages with the same names.

Because neither versions nor package hashes are specified, package resolution depends on the mutable state of the configured Python package index. This creates unnecessary supply-chain exposure and may also introduce module-shadowing or compatibility problems. Installation hooks in a compromised dependency would execute with the privileges of the user running pip.

No evidence confirms that the currently resolved packages are malicious. The vulnerability is the avoidable and uncontrolled dependency installation surface.

Attack Path

1. A user follows the documented prerequisite instructions.
2. The user runs pip install -r requirements.txt.
3. Pip resolves the unpinned dataclasses and enum package names from the configured package index or mirror.
4. A compromised release, unsafe mirror, or dependency-confusion condition supplies attacker-controlled package content.
5. Package installation logic executes under the installing user's account.
6. The installed modules may subsequently shadow or interfere with the expected standard-library modules.

Impact Assessment

Successful exploitation could execute code with the privileges of the user or build service performing the installation. Depending on that account's permissions ...[truncated 378 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove both entries from requirements.txt; Python 3.10 already includes dataclasses and enum.
2. Remove or revise the pip install -r requirements.txt prerequisite when no external dependencies are required.
3. If third-party dependencies are added later, pin exact versions and verify hashes using a lock file or --require-hashes.
4. Use a trusted package index and prevent unintended fallback to public registries in controlled build environments.
5. Run dependency installation in an isolated virtual environment with minimal filesystem and credential access.
6. Add automated dependency review and vulnerability scanning to the release process.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/main.py:451

Finding

Unvalidated Device Class in Batch Configuration Can Bypass Required-Document Checks

Content

View full analysis

Vulnerability Details

File Location: scripts/main.py:451-456 and scripts/main.py:495-501
Vulnerability Type: Missing configuration validation leading to compliance-check bypass
Risk Level: High

Vulnerable Code

scripts/main.py:451-456:

python

def load_config(config_path: str) -> List[Dict[str, Any]]:
    """Load configuration file"""
    with open(config_path, 'r', encoding='utf-8') as f:
        config = json.load(f)

    if isinstance(config, dict):
        return [config]
    return config

scripts/main.py:495-501:

python

configs = load_config(args.config)
for config in configs:
    checker = MDRChecker(
        input_path=config['input'],
        device_class=config.get('class', 'IIa'),
        verbose=args.verbose
    )
    report = checker.run_audit()

The equivalent command-line argument is constrained at scripts/main.py:476-478:

python

parser.add_argument('--class', dest='device_class',
                   choices=['I', 'IIa', 'IIb', 'III'],
                   help='Medical device classification (I, IIa, IIb, III)')

Technical Analysis

Device classes supplied through the command line are restricted to I, IIa, IIb, or III, but batch configuration values bypass this validation. The configured value is normalized to uppercase in the checker and then used to retrieve requirements:

python

required_docs = self.REQUIRED_DOCUMENTS.get(self.device_class, [])

An invalid class therefore produces an empty required-document list. During document-completeness checks, no document is considered mandatory. Missing documents generate informational findings rather than critical findings, and the final status calculation can classify the audit as COMPLIANT because there are no critical or major failures.

This is a security-relevant integrity flaw because an untrusted or malformed configuration can suppress mandatory reg ...[truncated 1316 chars]

Remediation

View remediation

Remediation Suggestions

1. Define a single canonical set of supported classes and apply it to both command-line and configuration inputs.
2. Reject unsupported classes before constructing MDRChecker:

   python

   VALID_CLASSES = {"I", "IIA", "IIB", "III"}
   
   device_class = str(config.get("class", "")).upper()
   if device_class not in VALID_CLASSES:
       raise ValueError(f"Unsupported device class: {device_class}")
   

3. Normalize classes through an explicit mapping so output remains consistently formatted:

   python

   CLASS_MAP = {
       "I": "I",
       "IIA": "IIa",
       "IIB": "IIb",
       "III": "III",
   }
   

4. Validate the complete JSON structure, including the top-level type, required input field, field types, and rejection of unexpected values.
5. Treat an unknown class as an execution error and never as an empty requirement set.
6. Add regression tests proving that invalid, empty, null, numeric, and incorrectly cased class values cannot produce a compliance report.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/main.py:182

Finding

Filename and File-Size Heuristics Permit Spoofed MDR Compliance Evidence

Content

View full analysis

Vulnerability Details

File Location: scripts/main.py:182-195, scripts/main.py:233-244, and scripts/main.py:347-368
Vulnerability Type: Insufficient document validation and placeholder content parsing
Risk Level: High

Vulnerable Code

scripts/main.py:182-195:

python

found = {}
all_files = list(self.input_path.rglob("*"))

for doc_type, patterns in self.FILE_PATTERNS.items():
    found[doc_type] = []
    for file_path in all_files:
        if file_path.is_file():
            file_name = file_path.name.lower()
            for pattern in patterns:
                if re.search(pattern, file_name, re.IGNORECASE):
                    found[doc_type].append(file_path)
                    self.log(f"find file: {doc_type} -> {file_path}")
                    break

scripts/main.py:233-244:

python

# Check file content integrity (simplified checking)
for file_path in files:
    if file_path.stat().st_size < 1000:  # Less than 1KB may be an empty file or placeholder
        return Finding(
            category=FindingCategory.MAJOR,
            regulation=self._get_regulation_ref(doc_type),
            item=doc_type,
            status=CheckStatus.INCOMPLETE,
            description=f"{doc_type}File may be incomplete（File too small）: {file_path.name}",
            file_path=str(file_path),
            recommendation="Please check file content integrity"
        )

scripts/main.py:347-368:

python

def _read_file_content(self, file_path: Path) -> str:
    """Read file content (supports multiple formats)"""
    try:
        if file_path.suffix.lower() in ['.pdf']:
            return self._extract_pdf_text(file_path)
        elif file_path.suffix.lower() in ['.docx', '.doc']:
            return self._extract_docx_text(file_path)
        else:
            with open(file_path, 'r', encoding='utf-8', errors='ignore') as f:
         
...[truncated 2974 chars]

Remediation

View remediation

Remediation Suggestions

1. Validate each file's signature and actual format rather than trusting its extension or filename.
2. Parse PDFs and DOCX files with maintained, vetted libraries and extract real text and document metadata.
3. Do not treat legacy .doc files as DOCX; either use a safe dedicated parser or report them as unsupported.
4. Replace the fixed file-size threshold with document-specific validation rules.
5. Verify required sections, revision identifiers, approval state, document dates, and traceability information where applicable.
6. Mark unreadable, malformed, encrypted, or unsupported documents as UNKNOWN or INCOMPLETE, never PRESENT.
7. Require positive content evidence before satisfying a mandatory MDR check.
8. Inspect every candidate document instead of relying only on the first matching file for CER and PMS checks.
9. Clearly label the output as an automated preliminary screening rather than a definitive regulatory-compliance determination.
10. Add adversarial tests using padded empty files, misleading filenames, malformed PDFs, renamed binary files, encrypted documents, and files containing irrelevant text.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill presents itself as an MDR compliance auditor, but for common input formats like PDF and Word it performs only filename-based pseudo-analysis. In a medical-device regulatory context, this can mislead users into trusting invalid audit results, potentially causing unsafe or non-compliant documentation to be accepted.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code claims to extract PDF and Word document content, but the handlers only return the filename stem. As a result, downstream content checks treat filenames as document text, producing false compliance assessments for the exact document formats most likely used in technical files.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill advertises and documents local script execution with file read/write behavior, but it does not declare an explicit tool scope such as permissions or allowed-tools. That mismatch increases the risk that an agent or operator may invoke the skill with broader filesystem access than intended, especially because the examples accept user-supplied input and output paths.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The 'When to Use' section expands beyond MDR auditing into generic academic writing and reproducible-output tasks, which can cause the skill to be selected for requests outside its stated regulatory purpose. In an agentic environment, overbroad routing language can trigger unintended execution of the packaged script or use of its instructions on unrelated files, increasing exposure to unnecessary file access and incorrect task handling.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The audit artifact classifies the skill as 'Academic Writing' despite the stated purpose being MDR technical-file auditing for medical devices. This kind of scope mislabeling can cause downstream systems, evaluators, or users to apply the wrong safety expectations and routing logic, increasing the chance that regulated-domain outputs are treated like low-risk generic writing assistance.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The dynamic test scenario explicitly reframes the skill for generic academic writing tasks outside its declared MDR auditing function. In a regulated medical-device context, this scope drift is dangerous because it can normalize off-label use, weaken domain-specific safeguards, and produce outputs that appear authoritative without applying the compliance constraints expected for MDR review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The tool writes directly to the user-supplied output path with normal write mode, which can silently overwrite an existing file. This is a safety and integrity issue because prior reports or unrelated files may be destroyed without confirmation, but it is not a strong security vulnerability absent privilege escalation or path manipulation.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This JSON manifest-like audit result includes the phrase "Use this skill for academic writing tasks that require explicit assumptions, bounded scope, and a reproducible output format," which is a broad natural-language activation description rather than a narrowly scoped trigger. Because it lacks explicit constraints or negative examples, it could match routine academic-writing requests beyond the intended medical-device MDR auditing context.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 60% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

dataclasses
enum

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 60% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

dataclasses
enum

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The script's natural-language interface, help text, status output, and error messages are hard-coded in English and do not provide any locale or language selection. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.