Security audit

Clinical Trial Registry Search / 临床试验注册检索专家

Security checks across malware telemetry and agentic risk

Overview

The skill performs public clinical-trial searches, but it ships a reusable third-party endpoint token and has inconsistent disclosures about which searches send query terms to that endpoint.

Install only if you are comfortable sending public search terms such as drug names, diseases, sponsors, or registration numbers to the disclosed Coze endpoint and using the bundled shared token. Avoid entering confidential protocol, patient, sponsor-internal, or account data. Use --keep-meta if you need retained JSON/Markdown audit files, and prefer env/CLI token overrides over local token persistence.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (50)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill documentation materially understates and contradicts actual network behavior, especially around third-party routing, additional sources, document downloads, and the use of an embedded bearer credential. That creates a trust-boundary failure: users may supply queries under the assumption of local/public-only handling when the skill can send data to an external service and exercise broader capabilities than advertised.

Description-Behavior Mismatch

High

Confidence: 88% confidence
Finding: The manifest says the ISRCTN public API is dead, but the implementation documents live retrieval through a unified external endpoint. Even if the data is public, hiding a fallback third-party retrieval path obscures data flow and expands the skill's effective network surface beyond what users are told.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The manifest says the ISRCTN public API is dead, but the implementation documents live retrieval through a unified external endpoint. Even if the data is public, hiding a fallback third-party retrieval path obscures data flow and expands the skill's effective network surface beyond what users are told.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The manifest says the ISRCTN public API is dead, but the implementation documents live retrieval through a unified external endpoint. Even if the data is public, hiding a fallback third-party retrieval path obscures data flow and expands the skill's effective network surface beyond what users are told.

Description-Behavior Mismatch

Medium

Confidence: 98% confidence
Finding: The file contains an embedded blob that is automatically decoded into a Bearer token, which means the package distributes usable credential material to every installer despite the manifest framing the endpoint as requiring a token. XOR+base64 is only obfuscation, not protection, so anyone with the package can recover and reuse the shared token to access the third-party service, consume quota, impersonate the skill, or pivot into any trust placed on that token.

Scope Creep

Medium

Confidence: 93% confidence
Finding: The module provides a function that writes token material to a predictable local file path, increasing the chance of credential persistence outside intended secret-management controls. Although it writes an obfuscated blob and attempts chmod 600, this is still recoverable secret material on disk and may be exposed through backups, multi-user environments, malware, or accidental inclusion in support bundles.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The comments assert that legacy .dat files are read-only fallback and 'absolutely never written,' but the module includes store_token() that writes exactly such files. This inconsistency is security-relevant because operators and reviewers may believe no local secret persistence occurs, while the code still enables it, undermining trust, review accuracy, and safe deployment assumptions.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The reference introduces a third-party commercial API path and additional output/automation behaviors that expand data flow and trust boundaries beyond the skill metadata. This can mislead operators about where data may be sent and what artifacts may be created, undermining informed consent and security review even if the data is described as public.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: This directly contradicts the manifest's claim that ChiCTR data is parsed locally with no egress by documenting a unified remote endpoint for ChiCTR queries. The danger is unauthorized outbound transmission of user queries to a third party under a false local-only privacy model, which is especially serious because users may choose the skill specifically to avoid external disclosure.

Intent-Code Divergence

High

Confidence: 96% confidence
Finding: The reference states EU CTR supports keyword search, while the manifest says EU CTIS only supports retrieve-by-number and not search. Such capability drift matters because it changes what data can be sent externally and may cause broader-than-expected querying against a remote service, invalidating user expectations and prior approval assumptions.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The procedure expands supported sources beyond the declared skill metadata by introducing WHO ICTRP as an external workflow source. That creates a trust-boundary mismatch: operators and users may believe only the declared public/direct sources are used, while the skill may actually send query terms to an additional third-party endpoint, affecting data egress, quota use, and compliance review.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The procedure says EU-CTR can be searched directly, but the manifest states EU CTIS is retrieve-by-number only and does not support search. This can cause the agent to claim or attempt unsupported retrieval behavior, leading to incorrect results, broken workflows, or unexpected fallback logic that changes where user queries are sent.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The procedure documents external-workflow querying of ChiCTR, ISRCTN, and DRKS even though the manifest says ChiCTR is local user-paste parsing and ISRCTN's public API is unavailable. This is dangerous because it can induce unintended outbound requests to undeclared or nonfunctional third-party endpoints, misrepresent data handling, and create privacy, reliability, and supply-chain risk.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The procedure states Excel is the final artifact and that JSON/Markdown intermediates are deleted by default, while the skill metadata presents JSON/Markdown as primary outputs. This inconsistency can mislead users about what artifacts will persist, causing loss of expected outputs and weakening auditability or downstream automation that depends on JSON/Markdown.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The unit documentation is internally contradictory: it labels ChiCTR as 'preview-only by default (no network)' while also stating it uses a Tier-2 external workflow endpoint. This can mislead operators and downstream agents about whether user queries will leave the environment, creating an informed-consent and data-egress risk even if the payload is limited to public search terms.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The ISRCTN unit similarly claims 'preview-only by default (no network)' but also documents routing through a remote external workflow endpoint. This inconsistency can cause accidental external transmission of user-supplied search terms under the false assumption that no network access occurs.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The DRKS unit presents the same contradiction between 'preview-only/no network' and actual use of a remote external workflow. In security-sensitive automation, misleading network semantics weaken user consent and policy enforcement, especially for agents that decide actions from docs alone.

Intent-Code Divergence

High

Confidence: 88% confidence
Finding: The architecture section says to 'NEVER use Playwright / a headless browser,' but later notes state Playwright Chromium is confirmed working for the CDE detail browser. This contradiction undermines trust in the stated security boundary and can lead maintainers or autonomous agents to enable browser automation in environments where it was supposed to be prohibited, increasing attack surface and policy drift.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The skill metadata says ChiCTR is handled by user-pasted public pages parsed locally with no egress, but the code routes ChiCTR retrieval through an external workflow endpoint. That mismatch can cause public query terms or user-supplied content to leave the local environment contrary to the declared trust boundary, which is especially concerning in a security-sensitive agent ecosystem because users rely on the manifest for data-flow decisions.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The manifest documents CDE access via an external workflow with a Bearer token, but the code introduces a separate direct commercial API path using --cde-api-key that is not declared in the skill metadata. This creates an undisclosed outbound integration and credential-handling path, increasing the chance of unauthorized data egress, secret misuse, or policy violations because operators may approve the skill under incomplete assumptions.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The code explicitly falls back to an embedded bearer token shipped inside the package (`config/keys.py`) for a third-party workflow endpoint. Shipping a reusable authenticated token in client code is a credential exposure issue and also enables silent authenticated egress to an external service, defeating the 'public-only' safety posture if the package is copied, inspected, or reused by unauthorized parties.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The module is designed to route searches for registries without clean APIs through an external workflow service, including sources the skill description says should be local-only or constrained. That creates additional third-party data egress and trust expansion beyond the advertised behavior, which is especially risky because the endpoint is authenticated and can receive user-supplied query content at scale.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The implementation directly automates the CDE site with Playwright even though the skill metadata and module comments state CDE is blocked by anti-bot controls and should be accessed through an external workflow. This creates a behavior-policy mismatch: users may believe only a tokenized third-party workflow is used, while the code actually attempts browser scraping against a protected site, which can bypass declared operational constraints and cause undisclosed outbound access to CDE.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The docstring claims the default path is a Coze workflow via another component, but the actual code falls back to local Playwright scraping. This misleading documentation can defeat security review, consent, and data-flow expectations because operators may approve the skill assuming one network path while the code uses a different one.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The wrapper explicitly routes ChiCTR queries to a unified external endpoint, which contradicts the skill metadata stating ChiCTR should be handled only by user-pasted public pages parsed locally with no egress. This creates an undeclared data flow and capability expansion: users and reviewers may believe ChiCTR handling is local-only, while in practice queries are sent off-box and may use shared bearer-authenticated infrastructure.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.