REDCap Data Dictionary Generator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:07 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a local REDCap CSV generator, but it overstates what it can do and instructs sending clinical-derived CSV files through Feishu without clear consent or safeguards.

Review carefully before installing. Use it only for local, user-approved REDCap CSV generation from supported DOCX inputs, manually validate the output against the source document, disable or avoid Feishu sending unless you explicitly approve the recipient and data handling, and run it in an isolated environment with pinned dependencies and restricted log access.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:29

Finding

Unpinned Third-Party Dependencies Create a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:29-41 and SKILL.md:205
Vulnerability Type: Unpinned package installation
Risk Level: Medium

Vulnerable Code

yaml

requires:
  bins: ["python3", "pip"]
  python_pkgs: ["python-docx", "lxml", "markitdown"]
install:
  - id: "python-docx"
    kind: "pip"
    package: "python-docx"
  - id: "lxml"
    kind: "pip"
    package: "lxml"
  - id: "markitdown"
    kind: "pip"
    package: "markitdown"

bash

pip install python-docx lxml markitdown

Technical Analysis

The Skill installs python-docx, lxml, and markitdown from the package index without specifying reviewed versions or cryptographic hashes. Dependency resolution will therefore select whichever versions satisfy the unconstrained package names at installation time.

No evidence indicates that the currently named packages are malicious. However, the dependency configuration does not guarantee that the packages installed in the future are the same artifacts that were reviewed. A compromised package release, package-index account, mirror, or dependency could introduce arbitrary installation-time or import-time code.

The same unsafe installation recommendation is repeated in scripts/generate_datadict.py:9 and scripts/generate_datadict.py:88.

Attack Path

1. An attacker compromises a listed package, one of its transitive dependencies, the package publisher account, or a package mirror used by the environment.
2. The attacker publishes a malicious version that remains compatible with the unconstrained installation request.
3. A user or Agent installs the Skill dependencies with the documented pip install command.
4. Package installation hooks or subsequently imported package code execute the malicious payload.
5. The payload receives the permissions of the account or environment performing installation or running the Skill.

Impact Assessment

Su ...[truncated 466 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to a specifically reviewed version, for example through an exact-version requirements file.
2. Generate a lock file that also fixes all transitive dependency versions.
3. Require cryptographic hashes for downloaded distributions, such as by using pip install --require-hashes.
4. Download dependencies only from an explicitly configured, trusted package repository or an internally controlled mirror.
5. Review and update locked dependencies through a controlled process that includes vulnerability and provenance checks.
6. Install and execute the Skill in an isolated virtual environment or container under a non-privileged account.
7. Keep dependency declarations in SKILL.md and installation guidance in the scripts synchronized with the same locked dependency manifest.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/process_upload.py:332

Finding

Generated Clinical Form Content Is Unconditionally Written to Standard Output

Content

View full analysis

Vulnerability Details

File Location: scripts/process_upload.py:332-335
Vulnerability Type: Sensitive information exposure through application logs
Risk Level: Medium

Vulnerable Code

python

# 输出 CSV 内容预览
csv_content = generate_csv(fields)
print("\n=== CSV 内容预览 ===")
print(csv_content[:2000])  # 显示前2000字符

Technical Analysis

Every successful execution generates an in-memory copy of the CSV and writes its first 2,000 characters to standard output. The preview is unconditional and does not require a diagnostic or preview flag.

Because the input is intended to contain clinical trial CRFs, protocols, questionnaires, and potentially identifying field definitions, extracted labels and choices may contain confidential clinical or personal information. Standard output is commonly captured by Agent transcripts, CI/CD systems, container logs, shell history tooling, centralized monitoring systems, or orchestration platforms. These destinations may have broader access controls and longer retention periods than the generated output file.

The 2,000-character limit reduces the volume exposed but does not prevent disclosure. CSV headers and the first records may be particularly likely to include identifiers or sensitive form content.

Attack Path

1. A user processes a DOCX document containing confidential clinical, protocol, or identifying content.
2. The parser converts extracted fields into CSV data.
3. The normal execution path calls generate_csv(fields) for a second time and prints the first 2,000 characters.
4. The runtime environment captures standard output in a persistent transcript or logging system.
5. A user, administrator, service, or attacker with access to those logs can read the exposed document content without requiring access to the original DOCX or generated CSV file.

Impact Assessment

Exploitation does not grant code execution, additional system privileges, or direct a ...[truncated 365 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the unconditional CSV preview from the normal execution path.
2. Add an explicit opt-in option such as --preview, defaulting to disabled.
3. Display only structural metadata, such as the number of generated fields and form names, instead of field labels or values.
4. If content preview is essential, redact fields classified as identifiers and require explicit user confirmation before printing.
5. Send diagnostic output through a configurable logging framework with secure defaults rather than directly to standard output.
6. Document that debug and preview output may contain sensitive clinical information.
7. Configure execution environments to restrict log access, minimize retention, and prevent forwarding sensitive output to third-party logging services.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

声明描述的是一个较通用、功能丰富的 REDCap 数据字典生成器，可处理 Word/Excel 文档并具备智能识别与多种高级 REDCap 功能。但实际代码只处理 DOCX，且明显针对特定问卷模板：第一部分题目完全硬编码，第二和第三部分依赖 doc.tables[0]/doc.tables[1] 的固定位置读取，第四部分也硬编码。代码确实会输出 REDCap 标准列顺序的 CSV，并支持 radio、checkbox、Likert、频率量表这些基础类型，因此与核心方向部分一致；但宣称的多个关键能力并未实现，尤其是 Excel、OCR、CDISC 自动命名、分支逻辑、计算字段、文件上传字段，以及“智能识别”也与实际的模板化实现不符。因此该描述对代码能力有明显夸大，构成不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared purpose overstates the implemented functionality. The script’s actual primary purpose is still related to generating a REDCap CSV from a Word document, so it is in the same general domain, but many advertised capabilities are absent in this code chunk. The implementation is limited to local DOCX parsing and CSV generation using simple heuristics. There is no Excel handling, no OCR, no substantive branching logic extraction, no real calculation parsing, and no CDISC-specific variable naming logic. Because the description presents these as core supported features, the mismatch is material rather than a minor implementation detail.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The advertised capabilities materially exceed what the implementation provides, creating a dangerous trust gap for users who may rely on unsupported features such as OCR, branching logic, calculated fields, file uploads, and intelligent structure recognition. In this healthcare/research context, overclaimed automation can lead users to deploy incomplete or incorrect data dictionaries, undermining study correctness and compliance.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code does not actually perform general CRF/protocol conversion; instead it emits a largely hard-coded questionnaire structure and only reads limited content from two DOCX tables. In a clinical data-capture workflow, this can silently generate incorrect REDCap dictionaries that do not match the source document, causing data integrity failures, misconfigured studies, and potentially unsafe research operations.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence

Finding

The skill documentation describes behavior that implies writing generated CSV output, but it does not declare any explicit tool scope such as permissions or allowed-tools. Missing capability declarations weaken reviewability and containment because a host may permit broader file-write behavior than users or reviewers expect.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The instructions tell the agent to send generated CSV files via Feishu even though no corresponding network capability is declared and no data-transmission safeguards are documented. Because REDCap dictionaries derived from CRFs/protocols may contain sensitive study structure or even identifiers if the source is mishandled, undocumented external transmission creates a real risk of unauthorized data disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill text instructs transmission of generated CSV files through Feishu but omits a user-facing warning that data may leave the local environment. In this healthcare-adjacent context, even metadata or generated dictionaries can contain sensitive labels, identifiers, or protocol details, so failing to disclose outbound sharing meaningfully increases privacy and compliance risk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The module docstring says it converts Word documents to REDCap dictionaries, but the implementation mostly ignores document content and outputs a predefined schema. This is dangerous because it misleads operators into believing the generated CSV reflects the uploaded source, increasing the chance of silent data-model mismatch.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code file contains natural-language strings that effectively force a specific language for usage and operation. Under the policy, locale-specific language is a violation unless the skill offers user choice or clearly documents that it is intentionally region-specific.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill description says it converts Word/Excel CRF or protocol documents into REDCap CSV, implying both document families are handled. In this file, parsing is implemented only by opening the input with Document(docx_path), and there is no code path for Excel formats such as XLS/XLSX/CSV source spreadsheets.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The description highlights automatic image OCR for scoring forms and support for branching logic, calculated fields, and file upload fields. In this file, fields are extracted only from document paragraphs and table text; branching logic and validation columns are always left blank, and there is no image processing or OCR code at all.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill's natural-language instructions and examples are effectively fixed to Chinese, and there is no indication that users may choose another language or that the locale constraint is required for a China-specific compliance context. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This is a natural-language locale policy issue because the file presents its purpose, installation guidance, and operational messaging in a single language only. There is no indication that the skill is region-specific or that users can opt into Chinese output, which may conflict with organizational language-choice expectations.

Content

No source excerpt is available for this finding.