Security audit

医学文献ppt生成skill

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its stated PPT-generation purpose, but it has material concerns around embedded API credentials, debug files that can expose user tokens, and hardcoded medical content that can mislead users.

Review before installing. Use only in a controlled workspace, avoid supplying personal or paid InfoX-Med credentials unless the debug-token issue is fixed, and manually verify every generated medical claim and figure source before presenting. The skill should remove embedded credentials, redact debug artifacts, narrow search modes, and eliminate hardcoded paper-specific content before broad use.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The skill metadata explicitly requires failing when the target paper cannot be fully retrieved and requires prioritizing original paper figures, but this code instead fabricates fallback result and mechanism slides from text when figures are unavailable. In a medical research presentation workflow, this can silently produce misleading PPT content that appears evidence-backed despite lacking the required source figures, undermining scientific integrity and potentially leading to false or unsafe conclusions.

Description-Behavior Mismatch

Medium

Confidence: 83% confidence
Finding: The script implements broad literature-discovery workflows (guidelines, meta-analyses, RCTs) rather than being narrowly constrained to locating a single user-specified paper for PPT generation. In an agent setting, this capability expansion can cause unintended external searches, broader data transmission, and behavior that exceeds the declared skill scope, making misuse and privacy surprises more likely.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The free-search CLI accepts arbitrary query and filter expressions, enabling unrestricted use of the external search API well beyond the manifest's stated purpose of finding one known paper and generating slides from it. In an agent environment this broadens operational scope, increases risk of excessive outbound requests and unintended query leakage, and undermines least-privilege design.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The renderer hardcodes paper-specific scientific claims and keywords on the title slide instead of deriving them from the supplied deck data. In a skill that is supposed to generate PPTs for arbitrary medical papers and must not fabricate content, this can silently inject false or misleading scientific statements into outputs, undermining integrity and potentially causing users to present incorrect biomedical conclusions.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: When --debug-out is used, the script writes both the selected credential and all derived token candidates to disk in cleartext. That creates a durable secret disclosure path: anyone with access to the output files, logs, artifacts, or shared workspace can recover valid API credentials and reuse them against the InfoX-Med service.

Missing User Warnings

Medium

Confidence: 99% confidence
Finding: The code embeds a default InfoX-Med API token directly in source and automatically uses it for outbound requests. Hardcoded credentials are dangerous because they can be extracted from the repository, reused by unauthorized parties, abused to consume paid quotas or impersonate the application, and are difficult to rotate safely once exposed.

Missing User Warnings

High

Confidence: 99% confidence
Finding: A hardcoded default API token is embedded in the code and automatically used for authenticated external requests. This exposes a credential to anyone with code access, enables unauthorized reuse of the associated account or quota, and creates supply-chain risk if the skill is redistributed or logged.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The script fetches remote image URLs and follows redirects automatically without user disclosure, host allowlisting, or network restrictions. In this skill context, slide JSON may carry attacker-influenced URLs, enabling external network access, IP leakage, tracking, or retrieval from unexpected internal or sensitive endpoints if executed in a privileged environment.

Static analysis

No suspicious patterns detected.