Meta Analysis / 医学Meta分析

• Outcome: Review
• Latest audit: Aug 29, 2026 · 3:03 AM UTC
• Version: 2.2.30

Overview

The skill is broadly coherent as a cloud-backed meta-analysis tool, but it ships recoverable shared bearer tokens and exposes high-impact remote data/reporting paths that users should review before installing.

Install only if you are comfortable sending meta-analysis summary data and a hostname-derived hash to the listed Coze cloud endpoints. Do not use it for confidential, regulated, unpublished, or individual-patient data unless you have approval for cloud processing. The publisher should remove embedded shared bearer tokens, separate bug-report admin actions from client reporting credentials, and tighten persistence/fallback wording before this would be a straightforward benign install.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (60)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The skill markets itself primarily as a meta-analysis tool, but the manifest also discloses substantial additional behaviors: sending analysis data to remote endpoints, literature probing, PDF retrieval, document conversion, and remote bug reporting. That mismatch can cause users to invoke the skill without fully understanding the outbound data flows and auxiliary capabilities, increasing the risk of unintended data disclosure or over-broad execution.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The README advertises live Cochrane/PubMed hit-count probing as part of the skill workflow, which extends behavior beyond local/meta-analysis computation into external literature retrieval. That creates unbounded outbound requests driven by user prompts and broadens both the data-exposure and capability surface in ways not tightly aligned to the stated purpose.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: PDF batch downloading from DOI lists introduces two high-risk capabilities unrelated to core meta-analysis: arbitrary external network access and file writes to the local environment. Even if intended for convenience, this materially increases the chance of misuse, copyright/compliance issues, retrieval of untrusted content, and accidental exfiltration or storage of sensitive materials.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The README assures users that original datasets and individual-level data are never accessed except under explicit cloud IPD use, while the same skill advertises IPD meta-analysis and automatic cloud execution elsewhere. This creates a materially misleading data-handling boundary that could cause users to submit sensitive clinical data under incorrect assumptions about where processing occurs.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The manifest frames the skill as a meta-analysis tool, but the README expands behavior to external literature probing, topic gating, and related retrieval workflows. Capability drift increases the chance that users trigger networked operations they did not expect, weakening informed consent and widening the effective attack and privacy surface.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: Bulk PDF downloading is unrelated to core statistical meta-analysis and introduces outbound network access plus local file writes. That combination can be abused for unreviewed content acquisition, copyright/policy violations, storage abuse, or retrieval of malicious files under the guise of analysis support.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The document promises 'no local fallback' and 'cloud-only computation' but later says a local answer may be delivered when the cloud is unavailable. Security-sensitive users may rely on one statement while the implementation or operator follows the other, creating ambiguity about where data is processed and what safeguards apply.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: Contradictory security documentation is dangerous because operators and users cannot reliably predict data-handling behavior during failures. In a skill that transmits research data to cloud services, inconsistent fallback statements weaken informed consent and can lead to unauthorized processing paths.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The adapter derives persistent host-linked identifiers from the machine hostname and automatically includes them in every bug report. Even though the values are hashed, they are still stable pseudonymous identifiers unrelated to performing meta-analysis and can enable cross-session/device correlation, which creates unnecessary privacy and telemetry risk if reports are sent externally.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: This file implements outbound network transmission to a remote endpoint and local file writing for bug reports, behavior not described in the skill manifest. Hidden egress paths are security-relevant because they expand the data flow surface, can surprise users, and may transmit user-supplied free-text descriptions containing sensitive material despite attempted sanitization.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The code explicitly transmits user-supplied analysis data to remote Coze and S3 endpoints, while the skill’s user-facing metadata only describes local meta-analysis functionality and does not clearly disclose outbound data transfer. Even if the payload is intended to exclude PII, this is still a data egress behavior that can expose sensitive research data, unpublished results, or regulated datasets to third-party infrastructure without informed user expectation.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The module derives a stable remote identifier from the local machine hostname and sends it as query_origin for attribution and rate limiting. Although hashed, this creates a persistent pseudonymous fingerprint that supports cross-session tracking and may reveal infrastructure identity patterns, which is unnecessary for the stated purpose of performing statistical meta-analysis.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The script prints bearer token material to stdout, including a visible prefix and suffix. Even partial token disclosure can leak sensitive credential structure into CI logs, terminal scrollback, shared screenshots, or centralized log systems, increasing the chance of credential compromise or aiding targeted abuse.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file ships recoverable bearer tokens inside the skill and provides code to decode and return them at runtime. Even if described as 'public' or obfuscated, anyone with the package can extract and reuse the tokens to access the external Coze workflows, creating unauthorized service use and hidden external capability beyond the manifest’s analysis-focused description.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: This module implements a general secret retrieval framework with CLI, environment, file, and embedded-secret fallbacks, which is broader than necessary for a meta-analysis skill. That design increases the chance of concealed credential use and makes it easier for the skill to operate with shipped or harvested secrets rather than explicit user-provided authentication.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The comments attempt to normalize publishing the token by calling it a public credential and only obfuscated, but the implementation reconstructs usable bearer tokens directly from bundled blobs. This can mislead reviewers and users into underestimating the security consequences while still exposing a live authentication artifact.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The CLI path writes `last_run.json` containing the full analysis result into `adapters/output` inside the skill directory, despite comments asserting outputs should go to the user's workspace. Because results may include inline SVG, R code, notes, and potentially sensitive input-derived data, this creates an unintended local persistence location that can expose data to other users, tooling, packaging mistakes, or later runs.

Description-Behavior Mismatch

High

• Confidence: 92% confidence
• Finding: The design gives a client-side analysis skill access to a shared endpoint that supports governance operations beyond end-user bug submission, including record retrieval, update, download, and deletion. Even though the document says only an author-side skill should call them, the same public endpoint and shared token model create a privilege-boundary problem: if those capabilities are reachable from distributed skill code or copied integrations, users or downstream agents may invoke administrative actions outside the skill’s stated purpose.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: Administrative retrieval, export, and deletion of bug-report records are powerful data-management capabilities unrelated to a meta-analysis skill’s user-facing function. If exposed through a shared endpoint protected only by a static token, an attacker could enumerate reports, exfiltrate metadata, tamper with triage state, or delete evidence, affecting confidentiality, integrity, and auditability.

Description-Behavior Mismatch

Medium

• Confidence: 85% confidence
• Finding: The document introduces external data egress to Feishu storage and outbound notifications, which materially expands the skill’s behavior beyond the manifest’s analysis-only description. This mismatch increases user surprise and weakens informed consent, and if descriptions include sensitive study details despite guidance, those records are persisted and distributed to third-party systems.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The documentation explicitly states that the skill's default computation path is cloud-based and sends summary statistics to a remote Coze endpoint, which conflicts with the user's likely expectation from the manifest that this is an R-based reproducible analysis skill. Even if only aggregate statistics are transmitted, this is a material data-flow disclosure issue because users may provide sensitive research data under the assumption of local processing.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The text says confidential document content is left to the user to decide whether to send out of domain and that the skill does not proactively block it, while also documenting cloud transmission behavior. In a meta-analysis workflow, uploaded studies, manuscripts, or unpublished review materials can contain confidential or restricted content, so permitting outbound transfer without enforced safeguards creates a real confidentiality risk.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The guide expands the skill into topic selection and upstream systematic-review decision support that is outside the stated meta-analysis computation scope. Scope expansion increases the chance of unauthorized behaviors, misleading users about what the skill is allowed to do, and routing users into adjacent functions with different data, safety, and validation requirements.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The documented capability list includes AI-assisted screening, PDF full-text download, and figure digitization, which materially exceed a computation-focused meta-analysis skill. These features introduce acquisition and processing of external content and files, increasing attack surface, data handling risk, and the likelihood of users triggering behaviors they did not expect from this skill.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Batch downloading full-text PDFs from DOI lists is a network and file-acquisition capability unrelated to the core purpose of statistical meta-analysis. Such functionality can be abused for large-scale external retrieval, ingestion of untrusted files, copyright-sensitive collection, or pivoting the skill into a downloader rather than an analyzer.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.