Security audit

cn-med-oa

Security checks across malware telemetry and agentic risk

Overview

The skill mostly matches its stated purpose, but it needs Review because it can download files after broad triggers and disables HTTPS certificate verification by default.

Review before installing. Use it only for explicit Chinese medical OA literature tasks, set CN_MED_OA_VERIFY_SSL=1, keep downloads to a bounded directory, and verify each paper's license or terms before storing, sharing, or reusing full text. Avoid letting it run automatically on vague reference-finding prompts.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill advertises and documents capabilities to access environment variables, write files, and make network requests, but does not declare permissions or provide an explicit capability boundary. In an agent environment, this creates a mismatch between operator expectations and actual behavior, increasing the risk of unauthorized outbound requests, local file persistence, or misuse of environment-derived configuration.

Intent-Code Divergence

High

Confidence: 96% confidence
Finding: _cache_get_meta returns json.loads(row[1]), but row[1] is the timestamp column rather than the cached JSON payload, so cache reads always fail and are silently suppressed by the broad exception handler. This breaks the intended caching control plane, causing repeated network requests and reducing reliability/rate-limit protections; in this skill's context, that can lead to excessive upstream requests and easier exhaustion of quotas or triggering of remote anti-abuse controls.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The trigger phrases are intentionally broad, including common requests like '找参考文献', '开放获取', and '帮我下载这篇中文文献', and the text says the skill should trigger even on short, ambiguous prompts. Over-broad activation can cause the wrong skill to run, leading to unintended network access, downloads, file creation, and citation processing without clear user intent.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The document operationalizes automated retrieval and downloading of third-party PDF content and text extraction while only briefly mentioning OA scope and rate limits, but it does not provide a clear user-facing compliance warning about copyright boundaries, permitted reuse, or downstream redistribution risks. In a skill explicitly designed to help users download papers, this omission can encourage misuse at scale, especially if users assume that '免登录、免费' implies unrestricted copying, storage, or republication.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The code allows TLS certificate verification and hostname checks to be disabled via CN_MED_OA_VERIFY_SSL, and the default is actually insecure because verification is off unless the variable is explicitly set to 1. In a downloader that fetches metadata and PDFs over HTTPS, this enables man-in-the-middle tampering of search results and downloaded documents, potentially delivering malicious or falsified content without any user-visible warning.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/cn_med_oa.py:40