Security audit

研究问题解析 (Agentic AI 科研平台)

Security checks for vulnerabilities and agentic risk

Overview

The skill is a small demo-style parser, but it can mislead users because it advertises parsing their research question while actually reading a fixed local mock file and sending status events to a local endpoint.

Install only if you understand this appears to be a demo workflow, not a true research-question parser. It reads a hard-coded local JSON file and reports start/completion status to a localhost service, so review or change those instructions before using it with real clinical research questions or sensitive workflows.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The skill advertises that it will parse the user's natural-language clinical research question, but the documented implementation instead reads a fixed local mock file and displays that content. This is a security-relevant integrity issue because it can mislead users and downstream agents about what data is actually being processed, causing incorrect handling of user input and unintended disclosure of local file contents.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill is presented as a local parsing/structuring utility, but it also performs HTTP POST requests to a local service without disclosing that network transmission occurs. Hidden reporting behavior expands the skill's privilege and data-flow surface, and could leak operational metadata or be repurposed to exfiltrate sensitive information if the reporting endpoint is compromised or mapped to another service.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill reads a local file from a fixed path without warning the user that local workspace data will be accessed. Undisclosed local data access is dangerous because users may believe only their prompt is being processed, while the skill can instead reveal or depend on contents from the host environment.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The markdown includes HTTP reporting calls but does not warn that status information is being transmitted. Even though the sample payload appears limited, hidden transmission violates transparency expectations and creates a channel that could later carry user-derived or sensitive metadata.

Static analysis

No suspicious patterns detected.