ClawHub
Back to skill

Security audit

unisound-clinical-trial-statistics

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent clinical-statistics purpose, but it also sends sensitive trial summaries to a remote model and can execute an unverified external preprocessor.

Install only if you trust the remote medical-model endpoint, are authorized to send trial-derived data there, and can run the skill in a contained environment. Avoid untrusted Office/PDF/image inputs, prefer JSON/CSV/XLSX, and review any AI-generated clinical interpretation with a qualified statistician.

A.I.G

Vulnerability Patterns
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T07 · Tool Hijacking and Spoofing

Error
Location
scripts/run.py:263
Finding

Unauthenticated External Preprocessor Module Execution

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/run.py:128
Finding

Prompt Injection Through Attacker-Controlled Clinical Trial Fields

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (16)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared purpose is narrow clinical-trial statistics, but the documented behavior includes broad document ingestion, conversion, OCR, and text extraction across many formats. That mismatch widens the attack surface far beyond simple statistical processing, enabling risky parsing of untrusted files and use of external utilities that may expose the runtime to malformed-document exploits or unauthorized processing of unrelated sensitive content.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill advertises capabilities that imply file I/O, shell execution, environment access, and network access, but it does not declare any explicit tool scope or permission boundaries. In a clinical-trial context, this creates an opaque trust boundary: sensitive trial data may be read, transformed, transmitted, or written without clear least-privilege constraints, increasing the chance of unintended exfiltration or dangerous tool use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly sends data to a model API but does not provide a clear privacy or data-handling warning, despite processing clinical-trial records that may include highly sensitive regulated data. Users may unknowingly transmit confidential subject, protocol, or endpoint information to a remote service without understanding retention, jurisdiction, or access implications.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest describes a capability for clinical trial data statistics, specifically referencing descriptive statistics and group comparison. This file instead implements broad ingestion and text/table extraction for pdf/doc/docx/xls/xlsx/csv/txt/json/images, which is a generic document-processing capability rather than statistical analysis support itself.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill introduces generic document-conversion and OCR capability via external binaries, which materially increases attack surface for a statistics-focused tool. In this context, broader ingestion of arbitrary office, PDF, and image files is more dangerous because users may submit untrusted research artifacts, causing the host to process attacker-controlled documents with heavyweight parsers.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
79% confidence
Finding

This code feeds attacker-supplied office documents into LibreOffice conversion, which has a long history of parser and document-processing attack surface. Even without shell injection, invoking a large external parser on untrusted files can expose the host to denial-of-service or exploitation of vulnerabilities in the converter, and this preprocessing utility broadens the skill beyond its core statistics purpose.

Content

Scanner excerpt · scripts/preprocess.py (reported line 111)May include surrounding context.

python
if not office_bin:
        raise PreprocessError("libreoffice/soffice not found for office document conversion.")
    with tempfile.TemporaryDirectory(prefix="med-skill-preprocess-") as tmp_dir:
        proc = subprocess.run(
            [office_bin, "--headless", "--convert-to", "txt:Text", "--outdir", tmp_dir, str(path)],
            stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, check=False,
        )

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
79% confidence
Finding

This invokes LibreOffice on untrusted XLS files for conversion, exposing the environment to a complex external file parser. The main risk is not command injection but unsafe processing of adversarial documents, which can lead to crashes, resource exhaustion, or exploitation of converter vulnerabilities.

Content

Scanner excerpt · scripts/preprocess.py (reported line 126)May include surrounding context.

python
if not office_bin:
        raise PreprocessError("libreoffice/soffice not found for xls conversion.")
    with tempfile.TemporaryDirectory(prefix="med-skill-preprocess-") as tmp_dir:
        proc = subprocess.run(
            [office_bin, "--headless",
             "--convert-to", "csv:Text - txt - csv (StarCalc):44,34,76,1",
             "--outdir", tmp_dir, str(path)],

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

Running pdftotext on untrusted PDFs creates exposure to parser bugs and decompression/resource-exhaustion issues in external PDF tooling. The command is not shell-injectable as written, but processing arbitrary attacker-controlled PDFs still expands the attack surface of the skill host.

Content

Scanner excerpt · scripts/preprocess.py (reported line 153)May include surrounding context.

python
pass
    pdf_to_text = shutil_which("pdftotext")
    if pdf_to_text:
        proc = subprocess.run(
            [pdf_to_text, "-layout", str(path), "-"],
            stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, check=False,
        )

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The OCR path automatically sets Tesseract language selection to "chi_sim+eng" when those language packs are available. This imposes a specific language/locale preference in behavior without any user opt-in or documented justification, which matches the language-policy violation criteria.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/preprocess.py (reported line 171)May include surrounding context.

python
cmd = [tesseract_bin, str(path), "stdout"]
    if lang_arg:
        cmd.extend(["-l", lang_arg])
    proc = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, check=False)
    if proc.returncode != 0 or not proc.stdout.strip():
        raise PreprocessError(f"Image OCR failed: {proc.stderr.strip() or 'no text returned'}")
    return proc.stdout

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/preprocess.py (reported line 178)May include surrounding context.

python
def detect_tesseract_langs(tesseract_bin: str) -> Sequence[str]:
    proc = subprocess.run(
        [tesseract_bin, "--list-langs"],
        stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, check=False,
    )

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Natural-language strings in the module description, CLI description, and system prompt are written to require Chinese-language behavior, including a fixed instruction to output Markdown in that language context. The file does not provide any language or locale opt-in/out mechanism, which can violate language-choice policy for general-purpose skills.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The code performs a remote chat-completions API call that is not obviously required for the core task of descriptive statistics computation. This expands the attack surface and creates data egress, dependency, and availability risks that are out of scope for a purely local statistics utility.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill sends trial-derived statistical results and metadata (for example trial_id, population, group labels, sample size, and endpoint summaries) to an external LLM service for interpretation, despite presenting itself as a local clinical-trial statistics helper. In a clinical context, even derived data can be sensitive or regulated, and this creates a confidentiality and compliance risk if operators assume processing remains local.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

Clinical trial data and metadata are embedded into a prompt and transmitted externally without any user-facing warning in this file. In regulated medical/pharma workflows, undisclosed external sharing can violate confidentiality expectations, contractual controls, or data-handling requirements even if the transmitted content is partially aggregated.

Content

No source excerpt is available for this finding.

Ssd 1

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Untrusted fields such as trial_id, population, and potentially group labels are interpolated directly into the LLM prompt, allowing an attacker to embed natural-language instructions that can influence the model's interpretation output. Although this does not lead to code execution here, it can corrupt clinical analysis narratives, suppress limitations, or produce misleading conclusions in a sensitive medical decision-support context.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/run.py:275