Security audit

Daily Prospection Intel

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches a commercial-intelligence/reporting purpose, but it asks the agent to use broad private local dossiers and scheduled execution without enough scoping or user control.

Install only if you intend this skill to run commercial prospecting reports for ArcaScience and you are comfortable with it reading any configured external dossiers. Before use, remove or replace the C:\Users\Romai\OneDrive\... paths with a reviewed, workspace-scoped data source, require confirmation for scheduled runs, and treat the generated outreach emails as drafts requiring human review before sending.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:151
Finding: External Personal Workspace Access Bypasses Skill Data Boundaries
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (42)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases are broad enough to match generic user requests such as researching opportunities, creating reports, or running daily intel tasks. Over-broad auto-invocation increases the chance the skill activates in contexts the user did not intend, causing unintended web searches, dossier access attempts, or document generation with commercially sensitive output.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill directs generation of ready-to-send outreach emails and mandates saving a .docx file, but provides no user-facing disclosure or consent step for producing external-facing content or writing files. This can lead to unauthorized creation of persuasive communications, accidental operational use of unreviewed content, and silent file creation in the environment.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly instructs access to absolute local filesystem paths outside the workspace, including user-specific directories on C:\Users\...\GitHub\.... This violates workspace isolation and can enable unauthorized reading of local files, data exfiltration, or unintended disclosure of unrelated sensitive content if an agent has filesystem access.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file contains substantial English-language contract sections, but it also states that notices must be in French and that French law/text controls in case of dispute. That creates a natural-language locale policy concern because participants may interact with the document in English while the binding/required language is fixed to French without an explicit opt-in or user language choice.
Content: No source excerpt is available for this finding.

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · references/sales-package-operations.md (reported line 493)May include surrounding context.
md
> ON THE ONE HAND, > > \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_fiscal references (if > necessary) \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_, > represented by \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_, born on > \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ in

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · references/sales-package-operations.md (reported line 494)May include surrounding context.
md
> ON THE ONE HAND, > > \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_fiscal references (if > necessary) \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_, > represented by \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_, born on > \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ in > \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_,

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · references/sales-package-operations.md (reported line 497)May include surrounding context.
md
> necessary) \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_, > represented by \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_, born on > \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ in > \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_, > nationality:\_\_\_\_\_\_\_\_\_\_\_\_\_, residing at > \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · references/sales-package-operations.md (reported line 499)May include surrounding context.
md
> \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ in > \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_, > nationality:\_\_\_\_\_\_\_\_\_\_\_\_\_, residing at > \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ > hereinafter referred to as \"THE PARTNER\" >

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · references/sales-package-operations.md (reported line 749)May include surrounding context.
md
> Paris, le 20/03/2025 > > on behalf of ARCASCIENCE on behalf of > \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ > > Romain Clément \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ > \_\_\_\_\_\_\_\_\_\_\_\_\_\_

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · references/sales-package-operations.md (reported line 1304)May include surrounding context.
md
AND Mr. / Mrs. \...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\....,\ \ residing at \...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · references/sales-package-operations.md (reported line 1307)May include surrounding context.
md
\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\....,\ \ residing at \...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\... \...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...,\ \ hereinafter referred to as \"**the Expert**.\"

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · references/sales-package-operations.md (reported line 1308)May include surrounding context.
md
\ residing at \...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\... \...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...\...,\ \ hereinafter referred to as \"**the Expert**.\"

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/sales-package-operations.md (reported line 1439)May include surrounding context.
md
Materials to be produced by the\ 500-word preface\ Expert (non-exhaustive list) 200-word biography\ ID photo Materials to be validated by the Expert (non-exhaustive list) Final version of the study\ Selected photos\

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/sales-package-operations.md (reported line 1442)May include surrounding context.
md
Materials to be produced by the\ 500-word preface\ Expert (non-exhaustive list) 200-word biography\ ID photo Materials to be validated by the Expert (non-exhaustive list) Final version of the study\ Selected photos\

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/sales-package-operations.md (reported line 1443)May include surrounding context.
md
Materials to be produced by the\ 500-word preface\ Expert (non-exhaustive list) 200-word biography\ ID photo Materials to be validated by the Expert (non-exhaustive list) Final version of the study\ Selected photos\

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 80% confidence
Finding: Large runs of whitespace-padded table rows can bloat prompts and consume model context unnecessarily. In an agent skill pipeline, this can degrade analysis quality, hide important instructions or data in prompt noise, and contribute to denial-of-service style resource exhaustion through oversized inputs.
Content: Scanner excerpt · references/sales-package-personae.md (reported line 69)May include surrounding context.
md
Roadmap d'innovation basée sur les besoins non couverts | Quels sont les gaps thérapeutiques non couverts où notre approche pourrait apporter une valeur différentielle ? Comment anticiper les futurs standards de soins basés sur les tendances de la recherche ? | Translation gap & predire l'imprevisible | All | | | | | Global | 130.0 | 1.0 | 3.0 | 1.0 | 2.0 | =P23*O23+N23+M23*2 | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

YARA rule 'network_reconnaissance': Network reconnaissance and scanning patterns [hacktools]

Medium

Category: YARA Match
Confidence: 65% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · references/sales-package-personae.md (reported line 286)May include surrounding context.
md
on input.; Legal Counsel (early stage): Assess intellectual property landscape and potential legal risks. | Essential for a deeper dive into the scientific validity, clinical data (pre-clinical and clinical trial phases), and competitive differentiation of specific target assets. This informs the assessment of their potential to address unmet medical needs. | Biotech/Pharma Databases: BioCentury, Fierce Biotech, Cortellis.; Investment Banks: Provide industry insights and potential target lists.; Specialized Consulting Firms: For competitive intelligence and strategic analysis. | Overlooking Key Competitors: Underestimating the strength or pipeline of rival companies.; Misjudging Asset Potential: Incorrectly assessing the clinical efficacy or market adoption of a target asset.; Internal Misalignment: Lack of consensus among internal stakeholders on which targets to pursue. | | | | | | | | | | | | | | | | | Step 3: Initial Outreach & Relationship Building | To establish

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 80% confidence
Finding: Massive repeated whitespace sections materially increase token usage and can crowd out relevant instructions or safety policies from the model context window. In an agent environment, this creates a practical prompt-bloating/DoS risk and makes review of embedded malicious content harder.
Content: Scanner excerpt · references/sales-package-personae.md (reported line 292)May include surrounding context.
md
Step 5: Deal Structuring & Negotiation | To design a mutually beneficial deal structure that aligns with both parties' strategic and financial objectives, and to negotiate the terms of the agreement. | Agreement on key deal terms (e.g., upfront payments, milestones, royalties, governance).; Successful negotiation of a term sheet that reflects the agreed-upon structure.; Preservation of key strategic interests for the company. | 2-4 months (highly variable depending on complexity and negotiation dynamics). | Detailed financial models supporting various deal structures.; Term sheet outlining the principal terms and conditions.; Negotiation strategy and talking points.; Internal approval memos for deal terms. | New Business Development Manager: Leads negotiations, proposes deal structures.; Legal Counsel: Drafts and reviews legal documents, advises on legal implications.; Finance Team: Provides valuation expertise, models financial impact of different terms.; Senior Leadership: Provides strategic guidance and final approval on key terms. | Provides the underlying context for valuing assets (e.g., market potential based on disease prevalence, competitive differentiation based on clinical data), which directly influences financial terms like milestones and royalties. | Legal Firms: Specializing in pharmaceutical M&A, licensing, and collaboration agreements.; Financial Advisors/Investment Banks: Provide valuation analysis and negotiation support. | Impasse in Negotiations: Inability to reach mutually acceptable terms.; Unfavorable Terms: Agreeing to terms that do not adequately protect the company's interests or provide sufficient return on investment.; Legal Complexities: Intricate legal frameworks requiring extensive negotiation.; Valuation Discrepancies: Significant differences in how each party values the asset. | | | | | | | | | | | | | | | | | Step 6: Contracting & Closing | To finalize all legal agreements, secure necessary internal and external ap ...[truncated 26 chars]

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 80% confidence
Finding: This repeated padding is large enough to meaningfully affect LLM context allocation and system performance. An attacker could exploit this pattern to bury malicious instructions or force truncation of later safety-relevant content.
Content: Scanner excerpt · references/sales-package-personae.md (reported line 1300)May include surrounding context.
md
Step 6: Ethical Conduct & Compliance | To ensure all medical and clinical activities adhere to the highest ethical standards, industry codes, and regulatory requirements. | Zero major compliance breaches.; Robust internal policies and procedures for ethical conduct.; Regular compliance training for medical teams.; Strong culture of integrity and transparency. | Ongoing. | Code of Conduct and Ethics Policies.; Compliance Training Programs.; Internal Audit Reports.; Standard Operating Procedures (SOPs) for medical activities.; Disclosure of Conflicts of Interest. | Chief Medical Officer: Sets the ethical tone and ensures compliance.; Compliance Officer: Develops and enforces compliance programs.; Legal Counsel: Advises on legal and ethical frameworks.; Internal Audit: Conducts compliance audits.; Human Resources: Manages training and disciplinary actions. | Informs ethical decision-making, ensures adherence to guidelines for patient consent, data privacy, and responsible research practices as outlined in medical and ethical literature. | Ethics Consulting Firms.; Compliance Training Providers.; Legal Firms specializing in healthcare compliance. | Last-Minute Disagreements: Issues arising during final contract drafting.; Regulatory Approval Delays: Unexpectedly long or complex approval processes from antitrust or healthcare authorities.; Failure of Closing Conditions: Inability to meet pre-agreed conditions for closing. | | | | | | | | | | | | | | | | | Step 7: Talent Management & Medical Leadership Development | To recruit, mentor, and develop top medical talent, building a strong, diverse, and high-performing medical organization. | High retention and engagement of medical talent.; Successful succession planning for key medical roles.; Development of future medical leaders.; A diverse and inclusive medical team. | Ongoing. | Medical Talent Acquisition Strategy.; Individual Development Plans (IDPs).; Mentorship Programs.; Leadership Development Progra ...[truncated 26 chars]

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 80% confidence
Finding: While this block is smaller than some others, it still adds non-functional bulk that can impair prompt efficiency and reduce the signal-to-noise ratio for automated agents. The primary risk is operational degradation rather than direct compromise.
Content: Scanner excerpt · references/sales-package-personae.md (reported line 2306)May include surrounding context.
md
Step 5: Talent Leadership & Organizational Development | To build, mentor, and lead high-performing global teams within the therapeutic area/portfolio, fostering a culture of scientific excellence, collaboration, and accountability. | High employee engagement and retention rates.; Successful development and promotion of talent.; Effective cross-functional and cross-geographical collaboration.; A strong talent pipeline for key leadership roles. | Ongoing. | Organizational Structure Plans.; Talent Development Programs.; Performance Management Frameworks.; Succession Plans.; Employee Engagement Survey Results. | Global Head of TA/Portfolio: Direct leader, mentor, and talent champion.; Direct Reports (e.g., TA Leads, Functional Heads): Manage their teams.; Human Resources: Supports talent acquisition, development, and retention.; Learning & Development Specialists: Design and deliver training programs. | Less direct; however, a strong understanding of medical literature helps the Global Head guide scientific discussions, identify emerging skill needs in the field, and inspire the team with a vision rooted in scientific advancement and patient impact. | | | | | | | | | | | | | | | | | | | Step 6: Stakeholder Engagement & Communication | To effectively engage and communicate with a wide range of internal and external stakeholders, including senior leadership, investors, regulatory bodies, key opinion leaders (KOLs), and patient advocacy groups. | Positive relationships with key stakeholders.; Clear and consistent communication of TA/portfolio progress and challenges.; Successful management of stakeholder expectations.; Strong reputation for scientific leadership and patient focus. | Ongoing. | Stakeholder Engagement Plans.; Communication Strategies (internal/external).; KOL Advisory Board Meeting Minutes.; Investor Presentations.; Public Statements/Press Releases. | Global Head of TA/Portfolio: Primary spokesperson and relationship manager.; Investor Re ...[truncated 26 chars]

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 80% confidence
Finding: A very large cluster of empty padded lines can be abused to inflate processing cost and obscure the true functional content of the skill. In prompt-driven systems, such padding can also increase the chance that important text is truncated or overlooked.
Content: Scanner excerpt · references/sales-package-personae.md (reported line 2469)May include surrounding context.
md
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 80% confidence
Finding: This degree of whitespace padding can produce meaningful token waste and context-window pressure in LLM-based agents. That makes the skill more dangerous operationally because relevant security instructions or outputs may be displaced.
Content: Scanner excerpt · references/sales-package-personae.md (reported line 3313)May include surrounding context.
md
6. Payer Engagement & Negotiations | Secure favorable coverage decisions and reimbursement terms | Positive coverage decisions, acceptable pricing agreements, market access secured | 6-18 months | Payer presentations, reimbursement agreements, managed care contracts, access programs | Market Access Directors, Payer Relations specialists, Commercial teams, Legal | Supporting clinical evidence, economic data, real-world outcomes, treatment guidelines | Access Hope, Maple Health Group, ADVI, The Dedham Group | Coverage restrictions, unfavorable terms, delayed decisions, political pressures | | | | | | | | | | | | | | | | | 7. Market Access Implementation | Execute launch strategy and ensure patient access to treatment | Successful product launch, patient access metrics achieved, revenue targets met | 3-12 months | Launch plans, access programs, patient support services, performance dashboards | Commercial teams, Patient Access specialists, Medical Liaisons, Marketing | Ongoing safety data, real-world effectiveness studies, treatment outcome reports | McKesson, AmerisourceBergen, Cardinal Health, Eversana, IQVIA Commercial | Access barriers, distribution issues, patient affordability, competitive responses | | | | | | | | | | | | | | | | | 8. Post-Launch Monitoring & Optimization | Monitor market performance and optimize access strategies continuously | Sustained market access, performance KPIs met, continuous improvement achieved | Ongoing | Performance reports, access optimization plans, stakeholder feedback, competitive intelligence | Market Access analysts, Commercial Intelligence, Medical Affairs, Account managers | Real-world evidence updates, safety surveillance data, comparative effectiveness studies, treatment patterns | Symphony Health, IQVIA Real World Solutions, Veracyte, Flatiron Health | Market access erosion, competitive threats, safety concerns, policy changes | | | | | | | | | | | | | | | | | | | | ...[truncated 25 chars]

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 80% confidence
Finding: The padding volume here is lower than the largest instances, but it still contributes unnecessary prompt bloat and reduced readability for humans and tools. The effect is mainly reduced reliability and increased processing overhead.
Content: Scanner excerpt · references/sales-package-personae.md (reported line 4319)May include surrounding context.
md
7. Medical Science Liaison Activities | Provide field-based medical support and gather insights from healthcare professionals | Strong HCP relationships, valuable insights collected, medical objectives achieved | Ongoing | Field medical plans, insight reports, congress coverage, investigator meetings, medical support | Medical Science Liaisons, Regional Medical Directors, Medical Affairs Field managers | Current clinical evidence, emerging research, treatment guidelines, clinical practice insights | Ashfield Healthcare, IQVIA Medical Affairs, Trinity Life Sciences, Syneos Health Medical Affairs | Compliance violations, insufficient insights, poor HCP relationships, off-label discussions | | | | | | | | | | | | | | | | | 8. Safety & Risk Management Support | Support pharmacovigilance activities and provide medical oversight of safety signals | Robust safety monitoring, appropriate risk communication, medical input to safety decisions | Ongoing | Safety assessments, risk evaluation reports, medical reviews, safety communications, REMS support | Medical Safety physicians, Medical Directors, Pharmacovigilance specialists | Safety literature, adverse event reports, risk-benefit analyses, clinical safety data | IQVIA Safety, Parexel Safety, Syneos Health Safety, PharmaLex Safety, Amplity Health | Missed safety signals, inadequate risk assessment, poor risk communication, regulatory sanctions | | | | | | | | | | | | | | | | | 9. Medical Affairs Analytics & Insights | Generate actionable insights from medical data and support evidence-based decision making | Data-driven insights delivered, improved decision making, medical objectives achieved | Ongoing | Analytics dashboards, insight reports, competitive intelligence, performance metrics, predictive models | Medical Affairs Analytics specialists, Data Scientists, Medical Information analysts | Competitive publications, clinical trial databases, real-world data sources, medical literature su ...[truncated 25 chars]

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 81% confidence
Finding: Excessive repeated whitespace is dangerous in AI skill contexts because it can hide consequential content in a very large file and force partial ingestion or truncation. This enables prompt-bloat abuse even without executable code.
Content: Scanner excerpt · references/sales-package-personae.md (reported line 4543)May include surrounding context.
md
Step 7: Regulatory & Quality Compliance | To ensure all project activities adhere to relevant regulatory guidelines (e.g., GLP, GCP, GMP) and internal quality standards. | Project activities compliant with all applicable regulations.; Successful internal and external audits.; No significant compliance deviations.; Robust documentation of all processes and results. | Ongoing throughout project lifecycle. | Compliance Checklists.; Audit Reports.; Standard Operating Procedures (SOPs).; Training Records.; Documentation Management System. | Project Leader: Ensures compliance within the project.; Quality Assurance: Provides guidance, conducts audits.; Regulatory Affairs: Advises on regulatory requirements.; All Team Members: Adhere to SOPs and regulations. | Informs the adherence to guidelines for pre-clinical studies (GLP), clinical trials (GCP), and manufacturing (GMP), ensuring that all data generated is robust and acceptable for regulatory submissions. | | | | | | | | | | | | | | | | | | | Step 8: Problem Solving & Decision Making | To identify issues, analyze root causes, and make timely, informed decisions to keep the project on track and resolve challenges effectively. | Timely resolution of project issues.; Data-driven decision-making.; Effective escalation of critical problems.; Minimal re-work due to poor decisions. | Ongoing. | Issue Resolution Logs.; Decision Records.; Root Cause Analysis Reports.; Corrective and Preventive Actions (CAPAs). | Project Leader: Leads problem-solving, makes decisions.; Project Team: Identifies issues, contributes to solutions.; Senior Management: Approves major decisions or provides guidance for complex issues.; External Experts: May be consulted for specialized problems. | Informs problem-solving by providing precedents, alternative approaches, and scientific context from published research or clinical case studies. Helps in evaluating potential solutions. | | | | | | | | | | | | | | | | | | | ...[truncated 26 chars]

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 80% confidence
Finding: This padding creates avoidable overhead and mildly increases the chance of agent confusion or truncation. It is not directly exploitable like code execution, but it is still a valid operational weakness in prompt-based systems.
Content: Scanner excerpt · references/sales-package-personae.md (reported line 5362)May include surrounding context.
md
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |

Static analysis

No suspicious patterns detected.