Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent Chinese medical literature search, download, and citation-checking tool, with expected network and local file writes for that purpose.
Install only if you are comfortable sending medical-literature search terms to Weipu OA and Yiigle and storing downloaded PDFs plus citation metadata locally. Use an explicit output directory, review broad trigger use in automated agents, and avoid setting WEIPU_OA_BASE unless you intend to redirect requests.
This finding reflects the same core issue in another direction: the suite-level description implies complete retrieval/download behavior, while parts of the documented chunk are narrower and verification-focused. Such ambiguity can mislead operators into invoking the skill in contexts they did not intend and weakens auditing of what each component actually does.
This finding reflects the same core issue in another direction: the suite-level description implies complete retrieval/download behavior, while parts of the documented chunk are narrower and verification-focused. Such ambiguity can mislead operators into invoking the skill in contexts they did not intend and weakens auditing of what each component actually does.
Referenced artifact was not completely inspected
| `scripts/cn_med_oa.py` | 检索 + PDF 下载 + Vancouver 元数据 + 相关性守门 |
Referenced artifact was not completely inspected
| `scripts/cn_med_oa.py` | 检索 + PDF 下载 + Vancouver 元数据 + 相关性守门 |
Referenced artifact was not completely inspected
| `scripts/cn_med_oa.py` | 检索 + PDF 下载 + Vancouver 元数据 + 相关性守门 |
Referenced artifact was not completely inspected
| `scripts/cn_med_oa.py` | 检索 + PDF 下载 + Vancouver 元数据 + 相关性守门 |
Referenced artifact was not completely inspected
| `scripts/cn_med_oa.py` | 检索 + PDF 下载 + Vancouver 元数据 + 相关性守门 |
Referenced artifact was not completely inspected
| `scripts/cn_med_oa.py` | 检索 + PDF 下载 + Vancouver 元数据 + 相关性守门 |
Referenced artifact was not completely inspected
| `scripts/cn_med_oa.py` | 检索 + PDF 下载 + Vancouver 元数据 + 相关性守门 |
Referenced artifact was not completely inspected
| `scripts/cn_med_oa.py` | 检索 + PDF 下载 + Vancouver 元数据 + 相关性守门 |
Referenced artifact was not completely inspected
| `scripts/cn_med_oa.py` | 检索 + PDF 下载 + Vancouver 元数据 + 相关性守门 |
The document claims SSL verification is always enforced and cannot be disabled, but elsewhere it exposes an environment switch that can disable certificate verification. This contradiction is security-relevant because operators may rely on the stronger claim while the runtime can be downgraded to insecure TLS, enabling interception or tampering of downloaded content and metadata.
The section "用什么词搜索？（速查）" instructs users to search using Chinese medical phrases and provides only Chinese query formulations, culminating in guidance to use the tool with '你的词'. This imposes a specific language/locale expectation in the skill's natural-language instructions without an explicit opt-in or alternative language choice.
The skill advertises file, cache, environment-variable, and network capabilities but does not declare an explicit tool/permission scope. In an agent ecosystem, missing scope boundaries can cause the runtime or reviewers to underestimate what the skill is allowed to access, increasing the risk of over-broad file or network use.
The natural-language description defines the skill entirely around Chinese queries and explicitly states it should trigger on Chinese-language requests, while also providing fixed English trigger phrases for the same Chinese-focused behavior. There is no indication that users can choose language or locale behavior, which creates a locale/language policy concern.
The trigger list contains broad phrases like generic requests to find references or download papers, which can cause accidental activation outside a clearly consented workflow. Over-broad activation is dangerous in a skill with network and file-write behavior because it may initiate external queries or downloads when the user intended only a conversational response.
The security declaration says network access is limited to two domains, but other parts of the manifest reference additional external endpoints such as CNKI links and rs.yiigle/medjournals-related services. Inconsistent egress claims undermine trust boundaries and can hide where data or requests may actually flow.
The skill metadata materially understates the network reach of the code: it claims a 维普OA-focused connector, but the implementation also searches and attempts downloads from Yiigle. In an agent environment, this can bypass user or platform expectations about which third-party services are contacted and what content sources are used, weakening consent, auditing, and policy enforcement.
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
os.makedirs(save_dir, exist_ok=True)
safe = re.sub(r'[\\/:*?"<>|·\s]+', "_", title)[:80].strip("_") or art_id
path = os.path.join(save_dir, f"yiigle_{art_id}_{safe}.pdf")
open(path, "wb").write(pdf)
return path, hashlib.sha256(pdf).hexdigest()
except Exception:
return None, None
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
os.makedirs(save_dir, exist_ok=True)
safe = re.sub(r'[\\/:*?"<>|\s]+', "_", name_hint or title or pid)[:80].strip("_")
path = os.path.join(save_dir, "%s_%s.pdf" % (safe, pid))
with open(path, "wb") as f:
f.write(raw)
sha = hashlib.sha256(raw).hexdigest()
_quota_consume()
The skill description advertises a built-in verify_cn_refs citation verifier, but this file does not implement that verifier capability. In security terms, capability mismatch is dangerous because downstream users or orchestrators may trust citation-validation guarantees that are not actually enforced, leading to false assurance and potentially unsafe automation decisions based on unverified references.
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
def save_manifest(result, save_dir):
os.makedirs(save_dir, exist_ok=True)
path = os.path.join(save_dir, "cn_refs.json")
with open(path, "w", encoding="utf-8") as f:
json.dump(result, f, ensure_ascii=False, indent=2)
return path
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
lines.append("")
os.makedirs(save_dir, exist_ok=True)
path = os.path.join(save_dir, "cn_refs.ris")
open(path, "w", encoding="utf-8").write("\n".join(lines))
return path, n
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
lines.append("")
os.makedirs(save_dir, exist_ok=True)
path = os.path.join(save_dir, "cn_refs.ris")
open(path, "w", encoding="utf-8").write("\n".join(lines))
return path, n
This Python file contains natural-language descriptions, CLI help text, console output, and HTML report strings that force Chinese as the interaction language. Under the stated policy, language-specific behavior without user opt-in or clear documented justification is a natural-language policy violation.