Security audit

academic-figures

Security checks across malware telemetry and agentic risk

Overview

This is mostly a local charting skill, but it also includes under-disclosed medical lab PDF extraction and an overstated de-identification claim.

Install only if you intend to use both the charting scripts and the included local utilities. Use an isolated virtual environment, review dependencies before running setup_env.py, and do not process real medical PDFs unless you explicitly intend to and have independently handled privacy/de-identification requirements.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill documents shell execution plus file read/write behavior (`python3 scripts/...`, generating outputs, auditing PDFs) but declares no permissions boundary. That creates a transparency and least-privilege problem: users and the platform may treat it as a harmless docs-only/chart skill while it can execute local code and modify files.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared purpose is publication figure generation, but the documented file set and guidance add medical PDF parsing and desensitization functionality for Chinese hospital lab reports. This hidden scope expansion is dangerous because it introduces processing of sensitive health data under a misleading, lower-risk description, which can cause users to invoke the skill on PHI without understanding its true data-handling behavior.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The manifest markets the skill as a local chart generator, while the documentation also includes extraction of Chinese hospital lab-report PDFs into JSON. This inconsistency undermines informed consent and safe routing because a user or orchestrator may select the skill for benign plotting while inadvertently exposing medical documents to an unrelated parser.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: A Chinese hospital lab-report PDF extractor is outside the justified scope of a publication-figure generator. Even if local-only, adding unrelated document extraction increases the attack surface and raises privacy risk because the skill can now ingest sensitive clinical records that users would not expect this tool to process.

Intent-Code Divergence

Low

Confidence: 88% confidence
Finding: The documentation initially frames the skill as generating figures from JSON/CSV data, but later lists a PDF lab-report extractor with a different operational intent. This is a real scope-integrity issue, though lower severity than TP4, because it can mislead users about what data types and workflows the skill supports.

Description-Behavior Mismatch

Medium

Confidence: 86% confidence
Finding: The skill is presented as a local academic figure generator, but the documentation also includes a separate PDF lab-report extraction capability. That scope expansion increases the attack surface and may cause the agent to process sensitive medical PDFs under a skill users would reasonably invoke only for chart rendering, creating a risk of unintended access to health data.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: Documenting `extract_lab_pdf.py` inside a figure-generation skill is a scope mismatch that can lead to confused-deputy behavior. An agent selecting this skill for visualization tasks could be induced to read and transform unrelated clinical PDF content, exposing sensitive information or performing actions the user did not clearly request.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The file implements extraction of structured data from hospital lab PDFs, which is materially unrelated to the skill manifest advertising local academic figure/chart generation. This capability expands the skill into handling sensitive medical documents without clear user-facing justification, creating risk of unexpected PHI processing and hidden data-handling behavior.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: The code parses sensitive medical reports and extracts clinical indicators from them, yet the manifest describes a figure-generation tool rather than a medical-document processing utility. That mismatch is dangerous because users may invoke or install the skill without understanding it can process health data, undermining informed consent, privacy expectations, and security review boundaries.

Intent-Code Divergence

Medium

Confidence: 99% confidence
Finding: The docstring claims automatic stripping of patient names, IDs, and hospital names, but the implementation only deletes the filename from the output object. This can lead operators to falsely believe exported JSON is de-identified when in reality extracted text-derived fields and dates from medical reports may still constitute sensitive personal or health information.

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: The setup script automatically installs packages into the user's Python environment without an explicit confirmation step. That behavior exceeds simple local figure rendering and can unexpectedly modify the system or user environment, which is risky in a skill users may run with trust and little review.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The script invokes pip to modify the Python environment as part of setup, which introduces supply-chain and environment-integrity risk. In a skill context, automatic package installation can lead users to run code that fetches and installs dependencies without careful review, increasing exposure if indexes, mirrors, or package resolution are compromised.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The trigger list includes very broad everyday terms such as '画图' and '数据可视化', which can cause accidental invocation outside the intended publication-figure workflow. Overbroad activation increases the chance that the agent routes unrelated user tasks or sensitive data into this skill unexpectedly, especially given the skill’s additional file-processing capabilities.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.