cn-med-oa

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:07 AM UTC
• Version: 2.0.0

Overview

The skill mostly matches its stated purpose, but it needs review because it disables HTTPS certificate checks by default and writes unescaped HTML reports from untrusted citation data.

Install only after reviewing the security tradeoffs. Before using network features, set CN_MED_OA_VERIFY_SSL=1 or wait for the default to be fixed. Treat generated HTML reports as untrusted if claims or remote metadata could be attacker-controlled, and prefer JSON output until HTML escaping is added. If you install PyMuPDF, use a virtual environment and a pinned reviewed version.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/cn_med_oa.py:28

Finding

TLS certificate verification is disabled by default

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/verify_cn_refs.py:249

Finding

Unescaped data permits stored HTML injection in verification reports

Content

View full analysis

%s%s%s%s%s%s%s" % ( VERDICT_ZH.get(v, v), (i.get("title") or "")[:44], (a.get("title") or "")[:44], "%.2f" % r.get("confidence", 0), "、".join((i.get("authors") or [])[:3]) or "-", pdfs, gaps)) cls = {"correct": "c1", "mismatch": "c2", "partial": "c3", "invalid": "c4", "unconfirmed": "c5"} cards = "".join('

%s %d

' % (cls[k], VERDICT_ZH[k], n[k]) for k in ("correct", "mismatch", "partial", "invalid", "unconfirmed")) return (_HTML_HEAD + "

中文文献引用验证报告 verify_cn_refs v" + VER + " · 来源: " + str(src) + "

" + '

' + cards + '

合计 ' + str(total) + "

" + "判定声称标题实际标题(维普)置信度声称作者PDF缺口" + "\n".join(rows_html) + "" + _HTML_FOOT) ``` ### Technical Analysis The report generator concatenates dynamic values directly into an HTML document without context-appropriate escaping. The affected values include: - Titles and authors from user-provided claims or manifests. ...[truncated 1956 chars]

Remediation

View remediation

``` 5. Avoid allowing scripts, remote images, frames, plugins, or network connections in generated reports. 6. Add tests containing payloads such as HTML tags and quoted attributes in titles, authors, API metadata, and source paths. Verify that the output contains encoded entities rather than executable markup. ]]>

T08 · Insecure Dependencies

Warning

• Location: README.md:20

Finding

Optional third-party dependency is installed without version or integrity pinning

Content

View full analysis

Remediation

View remediation

``` 2. Generate and verify cryptographic hashes for all supported distributions, then install with: ```bash python -m pip install --require-hashes -r requirements-pdf.txt ``` 3. Document the reviewed package index and avoid untrusted mirrors or additional package sources. 4. Use a virtual environment instead of installing into the system Python environment. 5. Add automated dependency scanning and review dependency updates before changing the lock file. 6. Keep the dependency optional, and clearly state that users should not install it with administrator privileges. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The documented behavior materially overstates or misstates the implementation, including verification features, dependency claims, and output guarantees. Security-relevant mismatches like this can cause downstream agents or users to trust validation, provenance, or dependency assumptions that are not actually enforced, leading to unsafe automation decisions or supply-chain surprises.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill advertises no explicit tool scope while describing capabilities that require network access, filesystem writes, and environment-variable use. In an agent ecosystem, missing permission declarations can cause the skill to run with broader ambient privileges than users or orchestrators expect, weakening least-privilege controls and making unintended data access or external requests harder to govern.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger phrases are broad enough to match common requests like finding references or downloading papers, which increases the chance of unintended activation. Because this skill performs network retrieval and file download/write actions, accidental invocation can lead to unreviewed external access, unnecessary downloads, quota exhaustion, or surprising behavior in unrelated conversations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The module docstring presents the skill as a Chinese-only connector and all usage/help text is written exclusively in Chinese, which imposes a specific language/locale on users. Under the policy rule, locale or language constraints should either be optional or clearly justified as region-specific; this file does not explicitly state such a user-facing justification or offer alternatives.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest states the skill is 'zero-dependency pure standard library', yet both extract_pages and pdf_first_pages_text import fitz, which is an external PyMuPDF dependency. These functions implement advertised behaviors such as PDF text-based page extraction and volume/issue cross-checking, so this is a real manifest-to-code mismatch rather than an incidental detail.

Content

No source excerpt is available for this finding.

Tainted flow: 'path' from os.environ.get (line 559, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/cn_med_oa.py (reported line 605)May include surrounding context.

python

def save_manifest(result, save_dir):
    os.makedirs(save_dir, exist_ok=True)
    path = os.path.join(save_dir, "cn_refs.json")
    with open(path, "w", encoding="utf-8") as f:
        json.dump(result, f, ensure_ascii=False, indent=2)
    return path

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring, CLI descriptions, console output, and HTML report language are all fixed in Chinese, and the generated HTML explicitly sets lang="zh". Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill title, description, and examples are entirely presented as Chinese-only operation for Chinese medical literature, with no indication that users may choose another language or that the locale restriction is an explicit opt-in. Under the policy, forcing a specific language without user choice can be a natural-language policy violation unless clearly justified and documented.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The description frames the skill entirely around Chinese-language literature retrieval and Chinese citation verification, and even provides fixed Chinese trigger behavior. There is no language-choice or opt-in wording indicating that users can select another language or locale before the skill applies these constraints.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The top-level documentation says the data source is the Weipu OA platform, suggesting a Weipu-only connector. However, to_vancouver inspects providerSource and emits cnki_uri when it finds a CNKI link, so the code exposes another provider reference despite the narrower wording in the documentation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The report template sets the document language to Chinese and all report labels are Chinese-only. This reinforces a fixed locale behavior without presenting a user choice or a clearly stated mandatory regional justification in the file.

Content

No source excerpt is available for this finding.