生物医药资产估值（Biopharma Asset Valuation）

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:07 AM UTC
• Version: 1.0.0

Overview

The skill fits its biopharma valuation purpose, but it has unsafe report-generation behavior and under-scoped handling of real transaction data, so it should be reviewed before installation.

Install only if you trust the publisher and can run it in an isolated workspace. Treat generated HTML as untrusted unless inputs are sanitized, avoid opening or sharing reports from untrusted inputs, keep outputs confined to a dedicated directory, and review the real transaction dataset and valuation formula assumptions before relying on results.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/run.py:82

Finding

Unsanitized Drug Name Permits Output Path Traversal

Content

View full analysis

Remediation

View remediation

str: value = re.sub(r"[^A-Za-z0-9_-]+", "_", str(value)).strip("_") return value[:100] or "unknown" output_root = Path(out_dir).resolve() safe_drug_name = safe_filename_component(drug_name) md_path = (output_root / f"bd_valuation_{safe_drug_name}_{ts}.md").resolve() if output_root not in md_path.parents: raise ValueError("Output path escapes the configured output directory") ``` 4. Apply the same validation to Markdown, HTML, and PPT output. 5. Add regression tests using traversal strings, absolute-path syntax, Windows separators, Unicode separators, and excessively long names. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/valuation_html.py:224

Finding

Persistent HTML and Script Injection in Generated Reports

Content

View full analysis

BD 管线估值报告 v31.0 三层验证版

💊 {p['drug_name']} 🎯 {p['target']} 🏥 {p['indication']} 📊 {p['clinical_stage'].replace('_',' ').upper()} 🌍 {p['market']} 🤝 受让方: {p.get('licensee','待定') or '待定'} 📅 {today}

``` Other affected interpolation contexts include the document title and factor summary: ```python BD估值报告 - {p['drug_name']} ``` ```python

靶点热度

{fs['tgt_mult']}×

{p['target']}

``` ```python {'

⚠️ ' + fs['cliff_warning'] + '

' if fs.get('cliff_warning') else ''} ``` ### Technical Analysis The HTML generator uses a Python formatted string and directly inserts user-controlled or externally sourced values into HTML text and title contexts. No HTML escaping or sanitization is applied. Fields capable of reaching these contexts include: - `drug_name` - `target` - `indication` - `clinical_stage` - `market` - `licensee` - Values propagated into factor warnings and summaries An attacker can terminate the surrounding element and inject a new element with an executable event handler. For example, a malicious field value containing an image element with an `onerror` handler would be emitted as active markup rather than text. The generated HTML is persistent: the payload remains in the saved report and executes when a recipient opens it. ### Attack Path 1. An attacker controls a field in t ...[truncated 1295 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/valuation_html.py:11

Finding

Generated Reports Execute Remote CDN JavaScript Without Integrity Verification

Content

View full analysis

``` ### Technical Analysis Every generated HTML report loads and executes JavaScript from jsDelivr when opened with network access. The package version is pinned, but the report does not provide a Subresource Integrity hash and does not enforce a restrictive Content Security Policy. Consequently, the browser trusts the response returned by the external CDN at viewing time. The reviewed project therefore does not completely determine the code that executes inside the generated report. This also conflicts with the module documentation describing the report as a self-contained HTML file without external dependencies. ### Attack Path 1. The Skill generates an HTML valuation report. 2. A user opens the report while connected to a network. 3. The browser requests the ECharts script from the configured CDN. 4. The browser executes the returned response without cryptographic integrity validation. 5. If the CDN, delivery path, referenced artifact, or upstream package is compromised, attacker-controlled JavaScript executes in the report context. ### Impact Assessment A compromised remote dependency could: - Read and alter report content - Falsify displayed valuation data - Exfiltrate report information over the network - Insert phishing or malicious interface elements - Access browser-origin data available to the report - Affect every generated report opened while the compromised dependency is served The execution occurs in the browser context rather than directly with Python process or operating-system privileges. ]]>

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:239

Finding

Documentation Recommends Installing an Unpinned Optional Dependency

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (27)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md

8. **真实数据优先**：可比交易章节必须优先使用 `references/real_deals_1394.json` 中的真实成交数据，MCP数据作为补充

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md

8. **真实数据优先**：可比交易章节必须优先使用 `references/real_deals_1394.json` 中的真实成交数据，MCP数据作为补充

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md

8. **真实数据优先**：可比交易章节必须优先使用 `references/real_deals_1394.json` 中的真实成交数据，MCP数据作为补充

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

md

8. **真实数据优先**：可比交易章节必须优先使用 `references/real_deals_1394.json` 中的真实成交数据，MCP数据作为补充

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill instructs reading local files, writing output files, and executing a Python script, but the manifest does not declare any explicit tool scope or allowed-tools boundary. That increases the risk of over-broad file and execution capabilities being granted implicitly, making accidental or unsafe file access and local command execution harder to govern or audit.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description states the skill values assets using 'rNPV与可比交易' and considers development cost and time. However, the operative workflow defines the final valuation as '总交易额 = 峰值销售额 × PS倍数 × PoS' and its steps do not include a real rNPV cash-flow model, discounting, or explicit development-cost modeling. This is a substantive mismatch between the advertised methodology and the documented behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instruction requires the report to be written from a professional BD manager perspective and specifies the report structure entirely in Chinese, effectively constraining output language. There is no indication that the user may choose another language or opt in to Chinese output, which is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill directs the agent to read a user-uploaded local transaction database containing real deal records without any explicit privacy notice, minimization rule, or handling constraint. In a business-development context, those records may contain commercially sensitive information, so unrestricted ingestion and reproduction could lead to confidentiality breaches or over-disclosure in generated outputs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs writing JSON to a session path and then invoking a local Python script, but it does not clearly warn the user about local file writes and command execution. In an agent environment, silent write-and-execute behavior increases the risk of unsafe automation, path misuse, or unintended script execution, especially if later inputs influence file contents or script arguments.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The v31.0 notes state the valuation formula changed to 'r-NPV × 50% + P/Peak × 30% + 可比交易 × 20%'. But the main execution flow's Step 8 still instructs users to compute '总交易额 = 峰值销售额 × PS倍数 × PoS'. These two descriptions are not merely incomplete; they actively prescribe conflicting valuation logic.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The file explicitly states it comes from real user-uploaded transaction data, yet there is no accompanying consent, handling basis, retention policy, or privacy justification. Even if the listed fields appear commercial rather than directly personal, storing and redistributing user-supplied real-world data without documented governance can create privacy, confidentiality, and compliance exposure.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest describes a skill for valuing biopharma assets using rNPV and comparable transactions for pharmaceutical licensing and negotiation. This record is explicitly labeled as an AI pathology platform acquisition and '非药物资产' (non-drug asset), which is not directly justified by the stated purpose and broadens the skill's comparison set beyond biopharma assets.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest describes a skill for biopharma asset valuation using rNPV plus comparable transactions for licensing, out-licensing, and negotiation preparation. This file's records include numerous entries labeled with or described as 投资, 项目收购, 企业收购, royalty purchase, distribution, supply, platform technology, and collaboration deals, which are not straightforward asset-licensing comparables and materially broaden the behavioral scope of the skill's reference base.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The dataset schema and metadata are presented almost entirely in Chinese field names and values, such as "用户上传真实BD交易数据库" and fields like "交易名称" and "受让方", with no indication of alternative language support or user choice. This creates a natural-language locale constraint that may conflict with a policy requiring language or locale choice unless explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The module description and subsequent user-facing strings indicate the skill is designed to operate in Chinese, and the script emits Chinese-only status and summary text. There is no option for users to select another language or any documented justification that this is a region-specific tool, which conflicts with the language/locale policy criteria.

Content

No source excerpt is available for this finding.

Tainted flow: 'md_path' from os.environ.get (line 88, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 95% confidence

Finding

The output directory is taken from an environment variable or CLI argument and combined with an unsanitized user-controlled drug_name to form the output filename. If drug_name contains path separators or traversal sequences, os.path.join will write outside the intended directory, enabling arbitrary file overwrite in locations writable by the process; the environment-controlled out_dir increases attacker control further.

Content

Scanner excerpt · scripts/run.py (reported line 89)May include surrounding context.

python

# ── MD 报告 ──
    md_path = os.path.join(out_dir, f"bd_valuation_{drug_name}_{ts}.md")
    with open(md_path, "w", encoding="utf-8") as f:
        f.write(result["markdown_report"])
    print(f"[OK] MD报告: {md_path}")

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This code file embeds its primary documentation and generated report structure entirely in Chinese, including the module heading and report sections, indicating a fixed language choice. Because there is no visible mechanism for user language selection or documented regional justification, this is a natural-language locale policy concern under the rule for forced language without opt-in.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The report text and formula state that r-NPV incorporates PoS, but the actual calculation of rnpv_b omits the pos variable entirely. In a biopharma asset valuation skill, this creates a materially misleading financial output: users may rely on understated or overstated deal values and negotiation ranges while believing development risk has been probability-adjusted.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code claims the HTML report is self-contained and has no external dependencies, but it loads ECharts from a public CDN at runtime. This creates a supply-chain and integrity risk: if the CDN is unavailable, blocked, or serves tampered content, opening the generated report executes untrusted JavaScript in the viewer's browser.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The description states the skill produces a professional report in Chinese ("BD管线估值系统，十章节专业报告输出"). This is a natural-language locale policy concern because it imposes a specific language/output locale without documenting user choice, opt-in, or a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The MCP tool list documents 'Step 5 | ls_patent_search | 专利分析'. In the actual step-by-step flow, Step 5 is '销售峰值计算', while patent-related content only appears later in the report outline and is not part of the described Step 5 operations. This is a direct documentation-to-procedure inconsistency.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The display name and short description are in Chinese, while the default prompt is in English. This imposes inconsistent language behavior in user-facing text without any explicit opt-in or language-selection guidance, which can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The manifest frames the skill around valuing drug assets using peak sales, probability of success, development costs, timelines, comparable transactions, and deal structures for BD licensing scenarios. This entry is a generic-drug company acquisition, and the note itself says its reference value is limited, indicating a capability to use out-of-scope comparables not well justified by the stated purpose.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

For a skill whose stated purpose is valuation based on peak sales, probability, costs, timing, comparable transactions, and deal structure, maintaining a massive general-purpose BD deal repository enables broader competitive intelligence and transaction surveillance. That capability may be useful, but it is not justified as a narrowly scoped implementation detail of rNPV/comparable valuation alone.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.