Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent local decision-support tool for clinical-evaluation route selection, but users should treat its regulatory output as advisory and avoid the unpinned curl-based install shortcut.
Install from the reviewed package when possible. If following the README curl command, pin the URL to a trusted commit and verify the file before running it. Treat route recommendations as planning support only; final submission strategy should be reviewed by qualified regulatory or clinical professionals against current official guidance.
The document is written entirely in Chinese and presents itself as the agent-facing operating instructions, but it does not mention any option to use another language or explain that the skill is intentionally limited to a Chinese-language/regional context. Under the policy, forcing a specific language without opt-in is a natural-language locale violation.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
mkdir -p ~/.claude/skills/clin-eval-route-picker/scripts
curl -fsSL https://raw.githubusercontent.com/zhaoxinghua09-cell/agent-skills/main/skills/clin-eval-route-picker/scripts/clin_eval_route_picker.py -o ~/.claude/skills/clin-eval-route-picker/scripts/clin_eval_route_picker.py
python ~/.claude/skills/clin-eval-route-picker/scripts/clin_eval_route_picker.py --help
The README instructs users to download executable code directly from a remote raw.githubusercontent.com URL into a persistent local skill directory and then run it. This creates a supply-chain risk: if the upstream repository, branch, or network path is compromised, malicious code could be stored for future sessions and executed with the user's privileges.
mkdir -p ~/.claude/skills/clin-eval-route-picker/scripts
curl -fsSL https://raw.githubusercontent.com/zhaoxinghua09-cell/agent-skills/main/skills/clin-eval-route-picker/scripts/clin_eval_route_picker.py -o ~/.claude/skills/clin-eval-route-picker/scripts/clin_eval_route_picker.py
python ~/.claude/skills/clin-eval-route-picker/scripts/clin_eval_route_picker.py --help
The skill can activate not only on the explicit trigger phrase but also on broad, natural-language descriptions of user uncertainty. That increases the chance of unintended invocation in a regulated medical-device compliance workflow, where an automated route-selection tool may be used without the user consciously opting into it.
The English description presents deterministic route selection and operational next steps, but does not clearly warn that the output is not definitive regulatory or clinical advice. In a medical-device submission context, this can create overreliance on the tool's recommendation and lead teams to proceed down the wrong regulatory pathway or make unsupported submission decisions.
The Chinese usage/process section similarly omits a clear warning that the tool's output may influence regulated submission decisions and therefore requires human review. Because the content explicitly instructs users how to act on rc values, readers may treat the recommendation as authoritative and bypass necessary expert validation in a high-stakes compliance setting.
The file’s natural-language comments and output strings are written entirely in Chinese, including the tool description and user-facing guidance. There is no indication that users can choose another language or opt in to Chinese-only behavior, which can violate language/locale choice expectations.
The natural-language content in this file is entirely Chinese, including the usage description and file guidance, with no indication that users or agents may choose another language. This can violate a language/locale policy when a specific language is imposed without documented opt-in or justification.
The manifest describes a clinical evaluation route picker for choosing among exemption, equivalent-device, and clinical-trial paths. However, the NMPA output always injects an AI-specific regulatory note at L126 regardless of whether --ai-samd is set, expanding the behavior beyond the claimed route-selection scope into unrelated advisory content for non-AI devices.
No suspicious patterns detected.