Security audit

Clinical Trial Sample Size & Power / 临床试验样本量与检验效能专家

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real clinical-trial calculator, but it can send cloud requests more readily than its safe-preview wording suggests and can fetch extra URLs supplied by the remote service.

Review before installing. Use --dry-run explicitly for previews, assume normal compute commands may send trial-design parameters, locale, and a stable hostname hash to the cloud endpoint, and avoid using confidential protocol details unless you are comfortable with extracted design parameters leaving the machine. The publisher should align the safe-preview docs with the actual CLI behavior and restrict response-followed URLs to trusted hosts.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (43)

Tainted flow: 'repro' from os.environ.get (line 780, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Content: repro = parsed.get("repro") if isinstance(repro, dict) and repro.get("url") and not repro.get("r"): try: with urllib.request.urlopen(repro["url"], timeout=timeout) as r: repro["r"] = r.read().decode("utf-8") except Exception: # noqa: BLE001 repro["_repro_fetch_failed"] = True
Confidence: 94% confidence
Finding: The code performs a secondary outbound fetch to `repro["url"]` supplied by the remote service response without validating host, scheme, or path. That creates a server-response-driven request primitive that can be abused for SSRF, unexpected egress to attacker-controlled infrastructure, tracking, or retrieval of maliciously large content; the earlier outbound authorization gate only covers the initial Coze endpoint, not these follow-on URLs.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The skill's headline description frames it as a cloud sample-size calculator, but the file also defines secondary behaviors: bug-report exfiltration to a separate endpoint, local document conversion, and local simulation/verification logic. That mismatch can mislead users and reviewers about what data flows and code paths actually exist, increasing the risk of uninformed consent and unsafe use of uploaded documents or telemetry-related features.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The README states that only trial design parameters are sent and that the skill never touches original data, but it also discloses transmission of `query_origin`, a SHA-256 hash of the host name. Even if hashed, this is still an extra device-derived identifier and contradicts the narrower disclosure, creating a privacy and transparency issue and enabling cross-request correlation by the remote service.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: Automatically collecting and transmitting a host-derived hash for a sample-size calculator is not clearly necessary for the stated function. A stable identifier allows server-side tracking, correlation of usage over time, and potential organizational fingerprinting, which is especially sensitive in a clinical-trial context where even metadata about activity may be confidential.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The manifest states that only trial-design parameters leave the machine, but later sections define a bug-report workflow that can send data to a different external endpoint. Even if sanitized and consent-gated, this contradicts the stated data-boundary guarantee and can cause users to underestimate outbound data exposure.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The file embeds a reusable bearer token for a remote bug-report endpoint and explicitly states it is shipped with the skill. Even if obfuscated with XOR+base64, the secret is trivially recoverable from the code and can be reused by anyone who obtains the package to send unauthorized reports, abuse the endpoint, or impersonate legitimate clients.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The adapter derives persistent identifiers from the host name (query_origin as sha256(hostname), and session_hash from hostname plus date). Although hashed, these values are stable pseudonymous identifiers that enable cross-report tracking of a user's machine or environment and are unrelated to the core clinical calculation function, creating unnecessary privacy and telemetry risk.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: This code performs remote submission of bug reports to an external endpoint, including descriptive free text and pseudonymous identifiers, but the skill metadata provided does not disclose that network exfiltration capability. In an agent setting, undisclosed outbound data flows are dangerous because users may assume the skill is purely local/sample-size related while it can transmit conversation-derived content off-platform.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The module description states that a public bearer token is embedded with the skill and used by default. Shipping usable credentials inside distributable client code exposes that capability to anyone who can read the package, enabling unauthorized use of the cloud compute backend, quota theft, and possible access to data or functions beyond what users were told the skill needs.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The code derives a stable machine identifier from the host name and transmits it on every request. Even though hashed, it remains a persistent pseudonymous device identifier that enables cross-session tracking and correlation unrelated to sample-size calculation, increasing privacy risk and potentially violating user expectations or policy disclosures.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: This logic fetches an external manifest URL from the service response and uses it to reconstruct content locally, but that secondary network behavior is not reflected in the described single cloud-compute service interaction. Because the client trusts response-supplied URLs, the remote service can cause additional hidden egress to arbitrary locations, expanding the attack surface beyond the declared endpoint.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The file embeds a recoverable credential and explicitly provides logic to decode, select, and use it at runtime. Even if described as a 'public shared credential,' distributing a live bearer token inside a broadly installable skill enables unauthorized reuse of the external compute service, quota theft, abuse attribution to the publisher, and loss of control over downstream service access.

Intent-Code Divergence

Low

Confidence: 84% confidence
Finding: The documentation attempts to normalize the embedded token as something that 'must be preserved,' while the implementation still handles it as a secret via decoding, precedence rules, and file storage APIs. This mismatch is risky because it encourages developers to retain a live credential in source control and deployment artifacts, increasing the chance of accidental trust expansion and long-term exposure.

Context-Inappropriate Capability

Medium

Confidence: 81% confidence
Finding: The documented inclusion of `office_to_md.py` adds document-conversion capability outside the stated purpose of sample-size and power calculation, increasing attack surface without clear justification. File parsing and format conversion are historically risky areas, and even if the tool only converts to Markdown, accepting user-uploaded office documents can expose the environment to malicious files or unexpected data handling paths.

Context-Inappropriate Capability

Low

Confidence: 88% confidence
Finding: The fallback path stores a local report plus author email when there was no coze call, which expands data retention beyond the core analytical function and creates avoidable privacy risk on the user’s machine. Even if data does not leave the machine, local persistence can expose sensitive study context or contact details to other users, backups, or endpoint compromise.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The file gives conflicting statements about whether the skill is in 'SAFE PREVIEW' by default, whether requests are only shown, and whether natural-language triggers can cause actual compute on the Coze engine without an explicit `--yes`. In a cloud compute skill that can send remote requests and execute R code, this ambiguity can cause users or downstream agents to trigger real computation or data transmission when they believe they are only previewing behavior.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: Commands labeled as 'Preview R Code (dry-run)' omit the documented `--dry-run` flag, so the examples do not match the stated safety model. Users may copy-paste a command they believe is preview-only, but depending on actual defaults/backend behavior, it may execute code or issue a remote compute request instead.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The later execution notes say default behavior is to execute R code and return results, which directly conflicts with earlier claims of default SAFE PREVIEW and execution gated by specific triggers or flags. Contradictory operational documentation around remote execution materially increases the chance of unintended code execution, request submission, or disclosure of sensitive trial parameters to the cloud service.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The template instructs the agent to hide reproducible R code by default unless the user explicitly asks for it, which conflicts with the skill metadata stating that full reproducible R code is returned by default. This creates a specification inconsistency that can silently reduce transparency, auditability, and reproducibility in a regulated clinical-trial workflow, causing users to rely on unverifiable numeric outputs.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: This repeated instruction reinforces hiding the reproducible R code by default, again contradicting the declared behavior of the skill. Repetition increases the chance the runtime agent follows the template over the manifest, leading to systematic omission of code needed for independent verification, compliance review, and error detection in clinical sample-size calculations.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: This localization file exposes functionality far beyond the declared sample-size/power-calculation purpose, including registry search, FAERS reporting, keyword expansion, workbook generation, and advisory flows. Such capability mismatch is a supply-chain and transparency risk: operators may enable or trust the skill for a narrow purpose while it contains hidden or undocumented workflows that can process different data and trigger additional networked behavior.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The messages describe outbound requests to a Coze endpoint and remote answer-refinement for a tool advertised primarily as a computation service. Hidden or weakly disclosed outbound transmission increases the risk of unauthorized data egress, especially in clinical-trial contexts where prompts may contain sensitive protocol, sponsor, or unpublished study details despite the reassuring text claiming such data is not sent.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The docstring promises structured detection of incomplete parameter extraction via `missing` and `needs_llm_fallback`, but the implementation never populates `missing` and only triggers fallback in the very narrow case of zero hints and no numbers. In a clinical trial sample-size tool, this can silently accept partial or misparsed inputs and lead downstream components to compute with incomplete parameters, producing misleading statistical outputs without warning.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The skill documents activation and execution through broad natural-language phrases such as asking for calculation help and then saying 'please compute directly'. Because these triggers overlap with ordinary conversation, a user or another prompt in the session could unintentionally invoke remote computation or data transmission without a clear, structured consent boundary. This is more concerning here because the skill uses a remote coze service and transmits trial-design parameters plus metadata off-device.

Vague Triggers

Low

Confidence: 87% confidence
Finding: Using 'help me figure it out' as an example trigger is overly broad because it is common conversational language unrelated to deliberate tool invocation. In a multi-skill or agentic environment, this can cause accidental routing into the skill, leading to unnecessary questioning, remote-preview generation, or eventual unintended egress if the flow continues. The domain context lowers direct harm somewhat because the tool claims to use aggregate design parameters rather than patient-level data, but the remote-service behavior still makes accidental activation a real concern.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/compute_backend.py:155