ClawHub
Back to skill

Security audit

deepevidence循证医学AI助手

Security checks across malware telemetry and agentic risk

Overview

This appears to be a legitimate medical evidence API connector, but it needs Review because it sends sensitive clinical content to an external service with unclear default storage and includes an unnecessary compiled Python bytecode file.

Install only if you are comfortable sending clinical questions, images, and any supplied metadata to DeepEvidence. De-identify patient information, verify your organization has the necessary consent and compliance terms, use no-store behavior where available, and ask the publisher to remove the bundled bytecode and pin dependencies before broad deployment.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (14)

Ae1

High
Category
analysis-evasion
Content
* `SKILL.md`: Root configuration and normative guidelines for the medical assistant.
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Skill ships a __pycache__ directory that normal discovery skips

High
Category
Supply Chain
Content
Python may load .pyc from this directory even when decoy .py sources look clean (PEP 552 UNCHECKED_HASH).
Confidence
95% confidence
Finding
Skill ships Python bytecode (__pycache__/ or .pyc/.pyo). Discovery skips these paths, so malicious bytecode can score SAFE while decoy sources look clean.

Skill ships Python bytecode (.pyc/.pyo) that normal analysis skips

High
Category
Supply Chain
Content
Bytecode is excluded from content analysis; a malicious .pyc can execute while source decoys remain clean.
Confidence
95% confidence
Finding
Skill ships Python bytecode (__pycache__/ or .pyc/.pyo). Discovery skips these paths, so malicious bytecode can score SAFE while decoy sources look clean.

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

Natural-Language Policy Violations

Medium
Confidence
93% confidence
Finding
The file primarily uses English instructional content, but the required failure-handling text for a missing API key is specified only in Chinese. This creates a locale/language constraint for user-facing output without documenting a user choice or justified region-specific limitation.

External Transmission

Medium
Category
Data Exfiltration
Content
Minimal HTTP API example (curl):

```bash
curl https://deepevid.medsci.cn/api/v1/chat/completions \
  -H "Authorization: Bearer $DEEPEVIDENCE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
88% confidence
Finding
The skill is designed to transmit user prompts and potentially sensitive clinical content to an external third-party API endpoint. In a medical context, this creates real confidentiality and compliance risk if users include patient-identifiable or otherwise sensitive data, even though the file includes warnings to avoid logging and PII misuse.

External Transmission

Medium
Category
Data Exfiltration
Content
### Text Request Example

```bash
curl https://deepevid.medsci.cn/api/v1/chat/completions \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $DEEPEVIDENCE_API_KEY" \
  -d '{
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The script sends user queries, image URLs, and optional metadata such as user_name, user_email, case_info, and conversation identifiers to a remote medical API without an explicit runtime consent or warning at execution time. In a clinical context, this increases the risk of accidental transmission of sensitive health information or PII, especially when operators may pass patient-related content on the command line.

Scope Creep

Low
Category
Excessive Agency
Content
## Emergency / urgent-care boundary (MUST)

This skill is **not** for emergency triage or first-aid instructions. If the user describes or asks about (including but not limited to):

- **Chest pain/pressure, suspected stroke/MI, trouble breathing, altered consciousness**
- **Poisoning/overdose, severe allergic reaction, uncontrolled bleeding**
Confidence
70% confidence
Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Natural-Language Policy Violations

Low
Confidence
91% confidence
Finding
The reference includes user-facing example content in Chinese, which effectively steers usage toward a specific language. Because the document does not explicitly offer a language choice or justify a Chinese-only scope, this is a natural-language locale policy concern under the stated rules.

Natural-Language Policy Violations

Low
Confidence
88% confidence
Finding
This user-facing example again fixes the interaction language to Chinese with no accompanying statement that language is selectable or that the skill is region-specific. Under the policy rules, forcing or implicitly defaulting to a specific language without opt-in can be a violation.

Natural-Language Policy Violations

Low
Confidence
90% confidence
Finding
Both Python and Node.js examples show Chinese user messages, and the surrounding documentation does not state that language is user-selectable or that the API is limited to Chinese-language use. This creates a locale-specific default in public-facing guidance.

Unpinned Dependencies

Low
Category
Supply Chain
Content
openai>=1.0.0
Confidence
92% confidence
Finding
The dependency is only lower-bounded (openai>=1.0.0), so builds may resolve to different future versions with behavioral, API, or security changes. This weakens reproducibility and can unexpectedly pull in a compromised or incompatible release through the normal package supply chain.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
def _status_code_from_exc(exc: Exception) -> Optional[int]:
    for attr in ("status_code", "http_status"):
        v = getattr(exc, attr, None)
        if isinstance(v, int):
            return v
    resp = getattr(exc, "response", None)
Confidence
50% confidence
Finding
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.