unisound-clinical-trial-statistics

• Outcome: Review
• Latest audit: Jul 17, 2026 · 12:34 AM UTC
• Version: 1.0.2

Overview

This skill is a disclosed clinical-trial statistics helper that reads user-selected inputs, optionally converts documents, and sends computed statistics to a named medical LLM API, with no hidden persistence or unrelated data access found.

Install only if your organization permits sending clinical-trial statistics and study metadata to the documented hivoice.cn medical model endpoint. Prefer JSON/CSV/XLSX inputs when possible, avoid untrusted legacy documents or PDFs unless conversion runs in a sandbox, and de-identify trial data before use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if not office_bin:
        raise PreprocessError("libreoffice/soffice not found for office document conversion.")
    with tempfile.TemporaryDirectory(prefix="med-skill-preprocess-") as tmp_dir:
        proc = subprocess.run(
            [office_bin, "--headless", "--convert-to", "txt:Text", "--outdir", tmp_dir, str(path)],
            stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, check=False,
        )

• Confidence: 77% confidence
• Finding: proc = subprocess.run( [office_bin, "--headless", "--convert-to", "txt:Text", "--outdir", tmp_dir, str(path)], stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if not office_bin:
        raise PreprocessError("libreoffice/soffice not found for xls conversion.")
    with tempfile.TemporaryDirectory(prefix="med-skill-preprocess-") as tmp_dir:
        proc = subprocess.run(
            [office_bin, "--headless",
             "--convert-to", "csv:Text - txt - csv (StarCalc):44,34,76,1",
             "--outdir", tmp_dir, str(path)],

• Confidence: 77% confidence
• Finding: proc = subprocess.run( [office_bin, "--headless", "--convert-to", "csv:Text - txt - csv (StarCalc):44,34,76,1", "--outdir", tmp_dir, str(path)],

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

pass
    pdf_to_text = shutil_which("pdftotext")
    if pdf_to_text:
        proc = subprocess.run(
            [pdf_to_text, "-layout", str(path), "-"],
            stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, check=False,
        )

• Confidence: 66% confidence
• Finding: proc = subprocess.run( [pdf_to_text, "-layout", str(path), "-"], stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, check=False, )

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares no permissions, yet its documented behavior includes file reads/writes, shelling out to local tools, network access, and likely environment/appkey handling. This creates a transparency and governance gap: users and platforms cannot accurately assess or constrain what the skill can do, which is especially risky for clinical trial data and document ingestion pipelines.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The stated purpose is narrow clinical-trial statistics support, but the skill also performs broad document ingestion, OCR/text extraction, external tool execution, and sends content to a remote model API. That mismatch can mislead users into providing sensitive source documents under the assumption of local statistical processing, increasing the chance of unintended disclosure or unsafe execution paths.

Description-Behavior Mismatch

Medium

• Confidence: 72% confidence
• Finding: The module is a broad, generic document-ingestion utility handling PDFs, Office docs, JSON, images, and spreadsheets, which exceeds the narrowly stated clinical-trial statistics purpose. This scope expansion is dangerous because it unnecessarily increases the reachable attack surface and the kinds of untrusted content the skill will process.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The code invokes external office, PDF, and OCR binaries that are not obviously required for statistical analysis and that process attacker-controlled files. In the context of a clinical-trial statistics skill, these extra dependencies increase the chance of host compromise, data exposure, or denial of service without clear functional necessity.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill sends clinical trial analysis context and computed statistics to an external LLM service for interpretation, which creates a data exfiltration path outside the local statistical workflow. In a clinical-trial setting, even partially processed data can contain sensitive proprietary or regulated information, and the code provides no visible minimization, consent, tenancy validation, or contractual/privacy safeguards before transmission.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The skill explicitly routes input data to an external medical LLM endpoint but does not provide a clear user warning that clinical trial records, extracted document text, and OCR-derived image content may leave the local environment. In a pharma/clinical setting, this omission is dangerous because source material may contain confidential, regulated, or sensitive study data that users would reasonably expect to remain local unless clearly told otherwise.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The code transmits clinical trial content to an external API without any visible user-facing warning, consent flow, or data-handling notice in the skill itself. Because this skill processes clinical trial data, undisclosed transfer can violate confidentiality expectations, internal policy, or legal/regulatory obligations even if the transfer is only for narrative interpretation.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/run.py:275