统计分析与论文框架 (Agentic AI 科研平台)

对候选队列执行描述性统计与组间比较，生成感染率对比、描述统计表、结果摘要与论文框架草案。当用户需要做统计分析或生成论文框架时触发。

Security Scan

The skill's stated purpose (statistical analysis and paper-outline drafting) is reasonable, but the runtime instructions reference a hard-coded local data path and a localhost reporting endpoint that were not declared, creating an incoherence and potential privacy/operational concern.

Purpose & Capability

The skill's name and description match a stats-and-paper-drafting task, but the SKILL.md requires reading a specific file (/home/ubuntu/workspace/demo/mock_data/analysis.json) and posting status to http://localhost:5001/api/report. The registry metadata declared no required config paths or endpoints—this mismatch is unexplained and disproportionate to the claimed functionality.

Instruction Scope

The runtime instructions explicitly tell the agent to read a local filesystem path and to send POST requests to a localhost HTTP service. These actions are outside the declared requirements and could access sensitive data or interact with local services without the user being aware. The instructions do not specify fallback behavior, authorization, or user confirmation.

Install Mechanism

No install spec and no code files (instruction-only) — lowest install risk because nothing is written to disk by an installer.

Credentials

The skill declares no environment variables or credentials (reasonable for a local demo). However, it performs network calls to a local endpoint and reads a hard-coded path despite not declaring these as required config; this should have been made explicit so users can judge access scope.

Persistence & Privilege

always:false and no indication the skill modifies agent/system configuration or demands permanent presence. Autonomous invocation is allowed (platform default) but not combined with other high-privilege settings.

What to consider before installing

Before installing or running this skill, confirm these points: (1) The SKILL.md reads a specific file path (/home/ubuntu/.../analysis.json). Make sure that path is correct for your environment and does not point to sensitive data; ask the author to make the data path configurable rather than hard-coded. (2) The skill posts start/completion messages to http://localhost:5001/api/report — verify that this local service is expected and trustworthy, or request an option to disable reporting. (3) Because the skill is instruction-only and has no provenance or homepage, ask the publisher for source/ownership information and a sample of the expected input JSON format. (4) For safety, run the skill in an isolated/test environment with non-sensitive sample data first. (5) If you need to use your own datasets, insist on a configurable data path and explicit permission prompts so the agent won't read arbitrary files.

统计分析与论文框架 Skill

何时使用

当用户需要单独执行统计分析或论文框架生成时使用，例如：

• 「做一下初步统计分析」
• 「比较不同方案的感染率」
• 「帮我生成论文框架」

如果是完整任务流程的一部分，则由 task-planner 调度。

执行步骤

1. 上报开始

curl -s -X POST http://localhost:5001/api/report \
  -H "Content-Type: application/json" \
  -d '{"skill":"stats-analyzer","display_name":"统计分析与论文框架","status":"running","message":"正在进行描述性统计、组间比较与论文框架生成..."}'

2. 读取数据并输出

读取 /home/ubuntu/workspace/demo/mock_data/analysis.json，向用户展示：

• 分析标题与总体样本量、主要终点、对比分组
• 感染率对比（表格）：各方案的样本量和感染率
• 描述统计表：各方案的平均年龄、男性占比、平均手术时长、平均住院天数
• 高风险亚组预览：如果数据中有相关字段
• 关键发现摘要：逐条列出
• 注意事项
• 论文框架：
  • 建议论文标题
  • 章节列表
  • 摘要草稿（如果数据中有）

3. 上报完成

curl -s -X POST http://localhost:5001/api/report \
  -H "Content-Type: application/json" \
  -d '{"skill":"stats-analyzer","display_name":"统计分析与论文框架","status":"completed","message":"统计分析完成，已生成论文框架草案"}'