王琦中医体质学术助手

• Outcome: Review
• Latest audit: Jul 15, 2026 · 12:55 AM UTC
• Version: 1.3.0

Overview

Review before installing: the skill is a coherent academic/RAG tool, but some maintenance scripts can send document or query text to configurable or hard-coded API endpoints and can overwrite local index or skill files without clear consent.

Install only if you are comfortable with a research tool that runs local scripts, stores configuration and indexes, and may send PDF text, card text, or queries to the configured LLM/embedding endpoint. Before using maintenance commands, set BASE_URL and EMBEDDING_BASE_URL explicitly to trusted services, avoid sensitive patient or proprietary documents, do not commit .env files, and back up any existing ChromaDB collections or Claude skill files.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (38)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill instructs the agent to use external files, RAG/ChromaDB, and CLI-style maintenance workflows such as adding PDFs, building indexes, and validating content, which imply file read/write, environment access, and likely networked components, yet no permissions are declared. This mismatch is dangerous because it can cause the platform to grant or infer broader capabilities than users expect, reducing transparency and weakening sandboxing and review controls.

Description-Behavior Mismatch

Low

• Confidence: 84% confidence
• Finding: The README presents the system as local-first/local-only, yet the environment variables point to arbitrary OpenAI-compatible API endpoints for both chat and embeddings. This can mislead operators into sending sensitive prompts, extracted PDF content, or future clinical data to remote services, creating confidentiality and compliance risk.

Intent-Code Divergence

Medium

• Confidence: 79% confidence
• Finding: The README states a safety boundary of academic use only, but the roadmap explicitly plans ingestion of consultation records. That inconsistency can weaken user expectations and governance controls, especially if operators later load real patient records under the assumption that the project remains purely educational.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The card’s body discusses 多发性大动脉炎, but the metadata tags it under 失眠 and 抑郁症. In a medical knowledge skill, this can misroute retrieval, contaminate analytics, and surface incorrect disease-specific guidance to users or downstream systems, creating a meaningful patient-safety and knowledge-integrity risk.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The record describes a single-case clinical experience, yet the metadata labels it as 横断面研究. This misclassification can distort evidence grading, filtering, and user trust by making anecdotal material appear to have a different methodological strength than it actually does.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The script is described as building a 'local' vector index, but it sends full card contents to a separately configured embedding API via the OpenAI-compatible client. This creates a data exposure risk because users may reasonably assume indexing stays entirely on-host, while sensitive or proprietary knowledge cards are transmitted to another service.

Context-Inappropriate Capability

Low

• Confidence: 80% confidence
• Finding: The code falls back from EMBEDDING_API_KEY/EMBEDDING_BASE_URL to generic API_KEY/BASE_URL variables, broadening the credential scope beyond this script's purpose. That increases the chance of unintentionally reusing higher-privilege or unrelated credentials and sending data to the wrong endpoint.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: When --use-llm is enabled, the extractor initializes an OpenAI-compatible client and later submits PDF-derived text, abstracts, conclusions, and clinical content to a configurable remote endpoint. That creates a real data-exfiltration/privacy risk because locally supplied documents may contain copyrighted, unpublished, or sensitive clinical material, while the skill description emphasizes local knowledge-card extraction rather than outbound sharing.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The script reads API credentials from environment variables and connects to an arbitrary configurable base_url, defaulting to a raw IP HTTP endpoint. This expands trust to potentially untrusted infrastructure and risks leaking both credentials and document content, especially because the endpoint is not strongly authenticated or constrained to HTTPS.

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: The module docstring states this is a 'pure retrieval interface' that does not call an LLM, but the implementation sends user queries to an external embedding API via an OpenAI-compatible client. Even if embeddings are not text generation, this still transmits user input off-box and changes the trust/privacy model, which can mislead integrators into using it for sensitive queries under false assumptions.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The smoke test goes beyond validation and performs a write into the user's Claude skills directory by auto-copying SKILL.md. Even if intended as convenience, unexpected modification of user configuration/state is risky because it can overwrite local changes, propagate unreviewed content into an active skill path, and normalize side effects in a script that users expect to be read-only.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The quickstart includes realistic plaintext API key examples inside a `.env` block without any warning not to reuse, commit, or share secrets. Even though the values appear illustrative, this normalizes secret-in-documentation patterns and can lead users or downstream agents to paste real credentials into files, logs, screenshots, or model prompts.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The trigger list includes very broad terms like “体质” and “知识卡”, which can match many unrelated conversations and workflows. Over-broad activation is risky because it can unexpectedly route users into a skill that has maintenance and data-handling behaviors, increasing the chance of unintended file operations, misleading medical-style responses, or context hijacking.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The explicit activation section repeats broad common terms without contextual constraints, so the skill may activate in ordinary domain discussions rather than only when the user intends to use this specific assistant. In this skill, accidental activation is more concerning because the content includes operational instructions for PDF ingestion, index construction, and data analysis, not just harmless reference text.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation shows API key configuration examples and states that secrets are stored in `.wangqi-skill/.env`, but it does not warn users to avoid committing that file, exposing it in screenshots, or using real production keys in shared environments. In a skill that encourages local installation and CLI-based configuration, this omission increases the likelihood of credential leakage through source control, backups, logs, or copied command history.

Natural-Language Policy Violations

Low

• Confidence: 97% confidence
• Finding: The JSON embeds personal contact email addresses in the article abstract/body text and correspondence section, with no indication that they were intentionally retained, consented for redistribution in this skill, or redacted. Even if the emails were published in the original paper, repackaging them into a searchable assistant knowledge base increases exposure and enables scraping, spam, and unwanted contact.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script sends extracted PDF text to an LLM endpoint configured by `BASE_URL`, which may be remote, without explicit disclosure or consent at runtime. PDFs can contain sensitive academic, clinical, or proprietary content, so silent transmission to an external API creates a confidentiality and compliance risk, especially in a medical knowledge-management context.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The embedding step transmits semantic chunks derived from the PDF to an embedding API, again configured via environment variables, without clear disclosure. Even if only chunks are sent, they may still contain sensitive clinical notes, unpublished research findings, or personally identifiable information, creating data leakage risk.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The embedding batch function submits raw text content to a configured HTTP API, but the script provides no explicit runtime consent or warning that document contents leave the process boundary. In a knowledge-base maintenance workflow, this can leak sensitive research, clinical notes, or proprietary content to an unintended service.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script unconditionally deletes any existing ChromaDB collection with the target name before rebuilding it, without user confirmation or backup. This can cause destructive data loss if the wrong collection name or persist directory is supplied, especially in shared or reused environments.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script sends knowledge-card text to a configured embedding endpoint via the OpenAI-compatible client, but it does not provide any explicit warning, consent step, or safeguard around outbound transmission. If users index sensitive PDFs, case data, or proprietary research, they may unknowingly disclose data to a remote service, especially because the tool supports configurable external base URLs.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The Milvus path unconditionally drops an existing collection before rebuilding, which can destroy previously indexed data without user confirmation. In a knowledge maintenance workflow, this creates an avoidable integrity and availability risk because a mistyped collection name or rerun can wipe stored indexes immediately.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The ChromaDB rebuild logic automatically deletes an existing collection and suppresses errors, making destructive behavior easy to trigger and harder to detect. This is dangerous because the script is explicitly meant for knowledge-base maintenance, so accidental reruns or incorrect parameters can silently erase an existing vector index and disrupt downstream retrieval.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The LLM extraction path sends chunks of source text to the remote model without an in-context consent prompt or transmission warning at the point of use. In a knowledge-base maintenance workflow, operators may reasonably expect local PDF parsing only, so silent outbound transfer of document content increases privacy, compliance, and confidentiality risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The health check prints the first 20 characters of environment variables, including API_KEY and potentially other sensitive credentials. Even partial secret disclosure materially weakens secrecy, especially in logs, terminals, CI output, or shared screenshots, and can aid credential guessing, correlation, or accidental full exposure if prefixes are meaningful.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_resource_identifier

Plaintext HTTP endpoint targets a CGNAT/Tailscale-range address.

Critical

• Code: suspicious.exposed_resource_identifier
• Location: scripts/extract_knowledge_cards.py:884