ClawHub
Back to skill

Security audit

Sample Size (Basic)

Security checks for vulnerabilities and agentic risk

Overview

This is a simple local sample-size calculator; the main caution is ordinary dependency hygiene, not malicious behavior.

Install in a virtual environment and consider pinning reviewed numpy and scipy versions or using a lockfile. Treat outputs as planning aids for qualified review, not clinical advice. The reviewed artifact does not read private files, write results to disk, contact the network, or request credentials.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
scipy
Confidence
96% confidence
Finding
The dependency specification for numpy is unpinned, so installs may resolve to different versions over time, including versions with known security defects or breaking changes. In a research-planning skill this mainly creates supply-chain and reproducibility risk rather than direct code-execution by itself, but it still weakens dependency integrity.

Unpinned Dependencies

Low
Category
Supply Chain
Content
numpy
scipy
Confidence
96% confidence
Finding
The dependency specification for scipy is unpinned, allowing package resolution to drift to unexpected versions, including vulnerable or incompatible releases. For a clinical sample-size calculator, reproducibility matters, so unpinned dependencies increase both security and operational risk.

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical
Category
Supply Chain
Confidence
90% confidence
Finding
The file allows installation of numpy without any version restriction, and static analysis indicates multiple historical advisories affecting numpy. While the requirements file does not prove a vulnerable version will be installed, it does permit vulnerable resolutions, making this a real supply-chain exposure.

Known Vulnerable Dependency: scipy — 4 advisory(ies): CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more

High
Category
Supply Chain
Confidence
88% confidence
Finding
SciPy has documented historical vulnerabilities, and because the requirement is unpinned, vulnerable versions remain installable. In this skill's context the package is plausibly legitimate for statistical calculations, so the issue is less likely malicious than an overlooked dependency hygiene problem, but it still exposes users to avoidable risk.

Static analysis

No suspicious patterns detected.