USMLE Case Scenario Generator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:25 AM UTC
• Version: 1.0.0

Overview

The skill's local case generator matches its purpose, but its install instructions pull an unnecessary unpinned package named main, creating avoidable third-party code risk.

Review this skill before installing. The case generator itself appears local and purpose-aligned, but avoid running the documented pip install step unless the dependency file is removed or replaced with a reviewed, pinned dependency. Treat generated clinical content as fictional educational practice, not patient-care advice.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unnecessary Unpinned Third-Party Dependency Creates Supply-Chain Code-Execution Risk

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1
Related Instruction: SKILL.md:232-236
Vulnerability Type: Unnecessary and unpinned third-party dependency
Risk Level: Medium

Complete Code Snippet

requirements.txt:1:

text

main

SKILL.md:232-236:

markdown

## Prerequisites

```text
# Python dependencies
pip install -r requirements.txt

text

### Technical Analysis

The primary requirements file declares the generic, unpinned package `main`, and the skill documentation instructs users or Agents to install it with `pip`.

This dependency is unnecessary for the declared functionality. `scripts/main.py` imports only Python standard-library modules, while `references/requirements.txt:13-20` explicitly states that no external dependencies or installation are required.

Installing a package can execute package-controlled build or installation logic. Because `main` is not version-pinned or hash-verified, the installed artifact depends on the configured package index and its current state. A compromised, substituted, or otherwise unexpected distribution could therefore execute code with the privileges of the user running `pip`. This behavior exceeds the minimum privileges needed for a local, standard-library-only case generator.

### Attack Path

1. A user or automated Agent follows the prerequisite instructions in `SKILL.md`.
2. The Agent runs:

   ```bash
   pip install -r requirements.txt

3. pip resolves the unpinned package named main from the configured package index.
4. The selected distribution performs package-controlled build or installation operations.
5. If that distribution is malicious or compromised, its code executes with the installing process's permissions.
6. The package could then access data and resources available to that user, including the project workspace and user-level files.

This audit did not establish that the currently resolved package is malicious; the vulnerability is the u ...[truncated 1452 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the unnecessary package declaration from requirements.txt:

   text

   # No external dependencies required.
   

   Alternatively, remove the file if the packaging system does not require it.

2. Replace the installation instructions in SKILL.md with:

   markdown

   ## Prerequisites
   
   Python 3.8 or later is required. No external Python packages are needed.
   

3. If third-party dependencies become necessary in the future:

   • Use the exact verified package name.
   • Pin each dependency to a reviewed version.
   • Require cryptographic hashes, such as through pip install --require-hashes.
   • Install only from an approved package index.
   • Review source distributions and build-system dependencies.
   • Run installation and execution in an isolated, least-privileged environment.

4. Add automated dependency checks that fail when undeclared or unnecessary external dependencies are introduced.

5. Correct references/topics.json by converting invalid expressions to valid JSON values, such as strings or numeric arrays, even though this issue is not directly exploitable in the current implementation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This skill generates realistic medical cases, diagnoses, and management recommendations, but it provides no user-facing disclaimer that the output is synthetic educational material and not suitable for real patient care. In the skill context, this increases the risk that users may over-trust generated content or reuse management guidance in real clinical situations, potentially causing harmful medical decisions.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency specification is effectively unpinned and references a moving target ('main') rather than a fixed package version or immutable source revision. This creates a supply-chain risk because future changes to whatever 'main' resolves to can silently alter the environment, introduce malicious code, or break reproducibility during installation.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

main

Static analysis

No suspicious patterns detected.