unisound-clinical-trial-design

• Outcome: Review
• Latest audit: Jul 16, 2026 · 8:39 PM UTC
• Version: 1.0.2

Overview

This skill appears purpose-built for clinical trial design, but it requires sending sensitive study-design details to a disclosed remote medical model API without enough privacy or scoping detail.

Review before installing. Use this only if you are approved to send clinical trial design details and any extracted document contents to the listed remote API provider. Prefer JSON inputs with minimized fields, avoid untrusted office/PDF/image files unless run in a constrained environment, and avoid passing long-lived API keys directly in command history where possible.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if not office_bin:
        raise PreprocessError("libreoffice/soffice not found for office document conversion.")
    with tempfile.TemporaryDirectory(prefix="med-skill-preprocess-") as tmp_dir:
        proc = subprocess.run(
            [office_bin, "--headless", "--convert-to", "txt:Text", "--outdir", tmp_dir, str(path)],
            stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, check=False,
        )

• Confidence: 74% confidence
• Finding: proc = subprocess.run( [office_bin, "--headless", "--convert-to", "txt:Text", "--outdir", tmp_dir, str(path)], stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if not office_bin:
        raise PreprocessError("libreoffice/soffice not found for xls conversion.")
    with tempfile.TemporaryDirectory(prefix="med-skill-preprocess-") as tmp_dir:
        proc = subprocess.run(
            [office_bin, "--headless",
             "--convert-to", "csv:Text - txt - csv (StarCalc):44,34,76,1",
             "--outdir", tmp_dir, str(path)],

• Confidence: 75% confidence
• Finding: proc = subprocess.run( [office_bin, "--headless", "--convert-to", "csv:Text - txt - csv (StarCalc):44,34,76,1", "--outdir", tmp_dir, str(path)],

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

pass
    pdf_to_text = shutil_which("pdftotext")
    if pdf_to_text:
        proc = subprocess.run(
            [pdf_to_text, "-layout", str(path), "-"],
            stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, check=False,
        )

• Confidence: 72% confidence
• Finding: proc = subprocess.run( [pdf_to_text, "-layout", str(path), "-"], stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, check=False, )

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill advertises executable behavior including file I/O, shell access, environment access, and network transmission, but does not declare permissions or clearly constrain those capabilities. In a clinical-trial context, users may provide sensitive trial protocols or patient-related materials, so undeclared capabilities materially increase the risk of unexpected data access, local system interaction, or exfiltration.

Context-Inappropriate Capability

Medium

• Confidence: 82% confidence
• Finding: The skill uses external desktop/CLI conversion tools for office, PDF, and OCR processing without clear need from the narrow skill description, unnecessarily increasing attack surface. In a security review, this matters because these tools parse complex attacker-controlled files and can introduce code-execution or denial-of-service risk if not isolated.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill states that user input is forcibly sent to an internal medical model API, but it does not present a clear privacy or data-transmission warning in the user-facing description. Because inputs may include confidential drug-development plans, protocol drafts, or regulated clinical materials, users could unknowingly transmit sensitive information to a remote service.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill sends detailed clinical trial design inputs—including indication, intervention, population, endpoints, and visit schedule—to an external API endpoint. In a pharmaceutical R&D context, this data can contain highly sensitive proprietary study-design information, and this file provides no user-facing disclosure, consent flow, or data-minimization controls before transmission.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/run.py:214