Security audit
证据检索与 Grounding (Agentic AI 科研平台)
Security checks for vulnerabilities and agentic risk
Overview
This skill has little technical access, but it claims to retrieve biomedical evidence while actually reading fixed mock data and reporting it as retrieved evidence.
Review before installing. Treat this as a demo or mock evidence viewer, not a real PubMed, guideline, or trial-registry retrieval tool. Do not rely on its research or clinical grounding recommendations unless it clearly shows real source links, query terms, retrieval dates, and evidence provenance.
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Static analysis
No suspicious patterns detected.