临床研究知情同意书审查

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:43 AM UTC
• Version: 1.0.0

Overview

The skill is a disclosed Chinese-language aid for reviewing clinical-trial informed consent forms, with no hidden persistence, credential use, network execution, or destructive behavior found.

Installers should treat this as an assistant for drafting or checking ICF review reports, not as final legal, medical, IRB, or regulatory approval. Expect Chinese-language output and verify conclusions with qualified human reviewers, especially before making clinical-trial or ethics-committee decisions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · REFERENCES/FDA_Informed_Consent_Guidance_2023.md (reported line 588)May include surrounding context.

md

procedures to be followed, and identification of any procedures which are experimental.
(21 CFR 50.25(a)(1))

A clear statement that the clinical investigation involves research is important to make prospective
subjects aware that, although preliminary data (bench, animal, pilot studies, literature) may exist, the
purpose of the subject’s participation is primarily to contribute to research (for example, to evaluate the
safety and effectiveness of the test article or to evaluate a different dose or route of administration of an

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

声明描述的是一个能够对知情同意书进行实质性法规审查并产出结构化报告的技能；但提供的代码只是一个说明性/教学性的 shell 脚本，通过 echo 和 read 展示步骤、参考文件和示例命令。它没有解析 ICF 内容、没有根据 GCP/ICH-GCP/FDA/中国法规执行检查、没有进行任何自动化合规判断，也没有生成审查结果文件。虽然脚本内容与 ICF 审查主题相关，但其实际行为只是流程导航，与声明的核心能力存在实质差异，因此应判定为描述与行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

声明的核心能力是法规与伦理层面的ICF内容审查，而代码实际只执行文档格式转换和简单清理，没有任何审查逻辑、规则比对、条款检查、报告生成或IRB/合规分析能力。虽然PDF转Markdown可能是审查流程的前置辅助步骤，但当前代码块的主要且唯一可见功能与声明的主要用途存在实质性差异，因此应判定为描述与行为不匹配。

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script only converts a PDF to Markdown and performs light text cleanup, but the skill metadata promises a comprehensive ICF compliance, ethics, and regulatory review. This mismatch is security-relevant because users may rely on the skill for regulated clinical-review decisions while receiving no substantive validation, creating a dangerous false sense of assurance in a high-stakes medical/regulatory context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file is entirely framed as a Chinese-language report template, including the title and all section content, with no indication that users may choose another language or that the skill is restricted to a Chinese-speaking or China-specific workflow. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The entire checklist is written only in Chinese, including headings and review criteria, and the file does not state that the skill is intended exclusively for a Chinese-speaking or China-specific workflow. Under the policy, forcing a specific language without user opt-in or clear documented justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The description and all invocation/output instructions are written only in Chinese, and the skill does not state that users may choose another language for interaction or output. Under the language/locale policy, a skill should not implicitly force a specific language unless it offers opt-in choice or clearly documents a justified locale-specific constraint.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger 检查ICF is short and underspecified compared with the rest of the trigger list. It does not clarify whether the skill should activate only for full informed-consent compliance review versus any casual request to 'check' an ICF, which increases the chance of unintended invocation.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · REFERENCES/FDA_Informed_Consent_Guidance_2023.md (reported line 2040)May include surrounding context.

md

as guardian or in loco parentis78 (21 CFR 50.56(b)(1) and (2)).  The advocate must be an individual who
has the background and experience to act in, and agrees to act in, the best interest of the child for the
duration of the child's participation in the clinical investigation (21 CFR 50.56(b)(3)).  The appropriate
expertise for an advocate should include, but is not limited to, education and/or experience in pediatric
medicine, law, child advocacy, foster parenting, behavioral sciences, or child psychology.  The advocate
should be adequately informed about the potential risks and benefits of the proposed clinical
investigation, and about how the intervention is likely to affect the individual child.  The advocate must

Static analysis

No suspicious patterns detected.