Pharma Csv Pro

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:32 AM UTC
• Version: 1.0.0

Overview

The skill is a local CSV analyzer, but it materially overstates regulated pharmaceutical compliance capabilities that the included code does not implement.

Review this skill carefully before using it for pharmaceutical quality or regulatory decisions. It appears safe from hidden persistence or malicious code execution, but its compliance and reporting claims exceed the included implementation; use it only as an unvalidated local analysis helper unless the methods, specifications, outputs, and LIMS integrations are independently reviewed and controlled.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This skill makes strong pharmaceutical and regulatory claims—such as OOT detection, GMP-compliant reporting, and USP/EP/ChP checks—that the underlying behavior reportedly does not truly implement. In a pharma QC and regulatory context, users may rely on these claims for batch release, stability decisions, or submissions, creating a serious integrity and compliance risk if incomplete or inaccurate analysis is mistaken for validated domain logic.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md

python3 scripts/pharma_analyzer_pro.py data/batch_records.csv --compliance USP

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md

python3 scripts/pharma_analyzer_pro.py data/batch_records.csv --compliance USP

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md

python3 scripts/pharma_analyzer_pro.py data/batch_records.csv --compliance USP

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md

python3 scripts/pharma_analyzer_pro.py data/batch_records.csv --compliance USP

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md

python3 scripts/pharma_analyzer_pro.py data/batch_records.csv --compliance USP

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md

python3 scripts/pharma_analyzer_pro.py data/batch_records.csv --compliance USP

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill advertises commands that generate outputs such as PDF reports, which implies file-writing capability, but it does not declare any explicit tool scope or permissions. This weakens least-privilege controls and can cause the agent runtime or reviewer to underestimate what the skill may write to disk, increasing the risk of unintended file creation or overwrite in regulated environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation includes sample code that sends batch-analysis results to an external LIMS endpoint using a bearer token, but it does not warn users that potentially sensitive pharmaceutical/QC data is being transmitted off-host or discuss secure credential handling. In a regulated GMP/LIMS context, users may copy this example directly, causing unintended data disclosure, insecure token practices, or noncompliant integrations.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 87% confidence

Finding

The example performs an outbound HTTP POST to a LIMS API with batch identifiers, parameter names, values, and timestamps. While this is legitimate functionality, it is still a true external-transmission risk because the skill targets regulated pharmaceutical data and the example lacks safeguards or warnings about approval, minimization, or secure handling of transmitted content.

Content

Scanner excerpt · references/advanced-usage.md (reported line 76)May include surrounding context.

'status': 'OOS', 'timestamp': result['analysis_timestamp'] } requests.post(lims_api_url, json=payload, headers=headers)

text

### Automated Pipeline

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The module docstrings, CLI help text, status messages, and generated markdown report are written in Chinese only, which imposes a language choice on users without opt-in. The policy specifically calls for flagging locale or language constraints when the skill does not offer a user-selectable language or document a justified regional limitation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The compliance function advertises USP/EP/ChP-specific checking but applies identical hard-coded assay limits for every selected standard. In regulated pharmaceutical workflows, this can produce materially incorrect compliance conclusions and misleading submission artifacts, especially where standards, products, or methods require different acceptance criteria.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The tool and manifest claim OOS/OOT detection, but the implementation only flags out-of-specification values against fixed limits and never performs out-of-trend analysis. In a pharmaceutical/regulatory context, this can mislead users into believing stability or QC trend excursions are being detected when they are not, creating a compliance and quality risk rather than a code-execution flaw.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The CLI/help text and report language claim 'OOS/OOT' detection even though only OOS detection is implemented. This is primarily an integrity and user-deception issue that can cause operators to rely on nonexistent analytical coverage, which is more concerning in GMP and regulatory use than in casual data tooling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This code writes the generated report to a user-specified path, which is a file-modifying operation. Although the CLI argument name implies output behavior and a success message is printed afterward, there is no explicit warning, confirmation, or comment near the write path about creating or overwriting a file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.