Protocol Deviation Classifier

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:42 AM UTC
• Version: 1.0.1

Overview

The skill looks like a real clinical-trial deviation classifier, but it should be reviewed because its file handling and dependency install path are broader and less bounded than the documentation promises.

Review before installing. Use only in an isolated workspace or virtual environment, avoid running the documented pip install unless dependencies are removed or pinned, and do not process real clinical-trial subject/site data unless output paths are controlled and sensitive fields are redacted or stored securely.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unnecessary and Unpinned Third-Party Dependencies Create a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1-2; installation guidance at SKILL.md:292-298
Vulnerability Type: Unpinned and unnecessary third-party dependencies
Risk Level: Medium

Vulnerable Code

requirements.txt:1-2

text

dataclasses
enum

SKILL.md:292-298

text

## Prerequisites

```text

# Python dependencies
pip install -r requirements.txt

text

### Technical Analysis

The project declares Python 3.8 or later as its runtime, where `dataclasses` and `enum` are already part of the Python standard library. Installing external packages with these names is therefore unnecessary.

Neither dependency is pinned to an exact version or protected with an integrity hash. Running the documented installation command causes pip to retrieve mutable third-party artifacts from the configured package index. Package installation can execute packaging hooks or other package-controlled code with the privileges of the user running pip.

This also conflicts with the statement in `SKILL.md` that the implementation has no third-party dependencies. Even if the installed modules are not ultimately imported because standard-library modules take precedence, package-controlled installation behavior may already have executed.

### Attack Path

1. A user or automated agent follows the documented prerequisite instructions.
2. The agent runs `pip install -r requirements.txt`.
3. Pip resolves the unpinned `dataclasses` and `enum` names against its configured package index.
4. A compromised, replaced, or otherwise unsafe package artifact is downloaded.
5. Package-controlled installation code executes under the account performing the installation.
6. The malicious package can access files, environment variables, credentials, and network resources available to that account.

### Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user or ser
...[truncated 417 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove both entries from requirements.txt; Python 3.8 and later provide dataclasses and enum in the standard library.
2. Remove or revise the documented pip install -r requirements.txt prerequisite if the project has no external dependencies.
3. If third-party dependencies are introduced later, pin exact reviewed versions.
4. Use hash-locked installations, such as pip install --require-hashes, with hashes generated from reviewed artifacts.
5. Restrict installation to a trusted package index and disable unexpected fallback indexes.
6. Install dependencies inside an isolated, unprivileged virtual environment or sandbox.
7. Add dependency auditing and lockfile verification to CI.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/main.py:732

Finding

Unrestricted User-Controlled Input and Output Paths Permit Arbitrary File Access

Content

View full analysis

Vulnerability Details

File Location: scripts/main.py:732-739, scripts/main.py:777-798
Vulnerability Type: Missing file-path validation and output-boundary enforcement
Risk Level: Medium

Vulnerable Code

scripts/main.py:732-739

python

batch_parser.add_argument("-i", "--input", required=True, help="Enter JSON file path")
batch_parser.add_argument("-o", "--output", default="", help="Output file path")
batch_parser.add_argument("--format", choices=["json", "report"],
                          default="json", help="Output format")

# report command
report_parser = subparsers.add_parser("report", help="Generate summary report")
report_parser.add_argument("-i", "--input", required=True, help="Classification results JSON file")

scripts/main.py:777-798

python

# Read input file
with open(args.input, 'r', encoding='utf-8') as f:
    events = json.load(f)

results = classifier.classify_batch(events)

if args.format == "report":
    report = classifier.generate_report(results)
    output = report
else:
    output = [r.to_dict() for r in results]

if args.output:
    with open(args.output, 'w', encoding='utf-8') as f:
        json.dump(output, f, ensure_ascii=False, indent=2)
    print(f"English: {args.output}")
else:
    print(json.dumps(output, ensure_ascii=False, indent=2))

elif args.command == "report":
    with open(args.input, 'r', encoding='utf-8') as f:
        data = json.load(f)

Technical Analysis

The batch and report commands accept input paths directly from command-line arguments and pass them to open() without canonicalization or authorization checks. The batch command similarly accepts an arbitrary output path and opens it in write mode.

No control ensures that resolved paths remain inside an approved workspace. Absolute paths and ../ traversal are accepted. There are also no symlink checks, regular-file checks, overwrite res ...[truncated 2470 chars]

Remediation

View remediation

Remediation Suggestions

1. Define an explicit workspace root and resolve all paths with pathlib.Path.resolve().
2. Verify that each resolved path is the workspace root or one of its descendants before opening it.
3. Reject absolute paths and traversal components when they are not explicitly required.
4. Require input paths to exist, be regular files, and use an approved extension such as .json.
5. Reject symlink inputs and outputs where symlink traversal is unnecessary, or securely validate the final resolved target.
6. Open new output files with exclusive creation mode to prevent silent overwrites, or require explicit confirmation before replacing an existing file.
7. Restrict output to a dedicated workspace subdirectory with least-privilege permissions.
8. Apply input file-size and JSON structure limits to reduce resource-exhaustion exposure.
9. Return sanitized errors without disclosing sensitive absolute paths.
10. Add tests covering absolute paths, ../ traversal, symlinks, existing output files, and destinations outside the workspace.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The declared purpose is narrowly framed as determining whether an incident is a major deviation, but the documented behavior expands into broader classification, batch processing, reporting, interactive modes, and file I/O. This mismatch can mislead reviewers and downstream policy controls, causing the skill to be approved for a narrower use case than it actually supports.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill advertises executable workflows that read inputs and write outputs, but it does not declare any explicit tool scope such as allowed-tools or permissions. In an agent environment, missing scope boundaries increases the chance of unintended file access beyond what a reviewer or orchestrator expects, especially because the documentation explicitly instructs use of local scripts and file paths.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The markdown explicitly states "Chinese Support: Full support for Chinese clinical trial scenarios," which introduces a locale/language-specific constraint. The file does not clearly offer users a language choice or explain that the locale restriction is limited to a justified region-specific compliance context.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file documents a Python API (DeviationClassifier, classify_batch, generate_report) and multiple CLI subcommands (classify, batch, interactive, assess) as if they are provided by scripts/main.py. However, elsewhere the manifest only establishes scripts/main.py as a packaged executable path without showing corresponding implementation details, creating an intent-level contradiction within the skill documentation about what the code is expected to do.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The batch mode writes classification results or reports to any user-supplied output path, and those outputs may contain identifiers or sensitive clinical-trial context such as event IDs, site IDs, subject-related descriptions, and regulatory assessments. In a clinical-trial setting this increases the risk of accidental disclosure, insecure storage, or writing sensitive data into shared or world-readable locations, even though it is not arbitrary code execution.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The security checklist states protections such as path validation, sandboxing, sanitized errors, and prompt-injection protections as if they exist, but the file provides no implementation evidence. This can create false assurance and lead users to trust the skill with sensitive clinical data or local execution under assumptions that are not actually enforced.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 60% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

dataclasses
enum

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 60% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

dataclasses
enum

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The printed string English: {args.output} and multiple hard-coded English UI/output labels indicate an implicit language choice in user-facing text. Under the policy, forcing a specific language without user opt-in can be a locale-policy issue when no language selection or justification is provided.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.