SaMD软件医疗器械专家

• Outcome: Pass
• Latest audit: Nov 6, 2026 · 11:18 AM UTC
• Version: 1.0.3

Overview

This medical-device documentation skill has proportionate local behavior, but its bundled security assurances are inconsistent and should not be relied on.

Use this as a documentation aid and check current official sources before making regulatory decisions. Treat the bundled audit, scores, and ownership fingerprint as unreliable evidence for this exact package. Running the optional checker overwrites security_results.json in the selected directory. These assurance defects do not reveal hidden or high-impact behavior in the inspected files.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · 安全审计报告.md (reported line 28)May include surrounding context.

md

| 风险维度 | 检查结果 | 判定 |
|---|---|---|
| 命令执行 | 包内无任何自动执行的脚本命令（curl/wget/bash/pip/npm 均 0 命中） | ✅ 无风险 |
| 远程脚本下载执行 | 无 `curl \| bash`、base64 解码执行等模式 | ✅ 无风险 |
| 网络请求 | 外链全部指向官方域（health.ec.europa.eu / www.cmde.org.cn / www.fda.gov / www.imdrf.org），无任何自动网络行为 | ✅ 无风险 |
| 文件系统操作 | 无删除/移动/写盘指令 | ✅ 无风险 |
| 凭据访问 | 无读取 API key / token / 环境变量行为；敏感扫描 0 命中 | ✅ 无风险 |

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: file_read, file_write.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · medical-device-samd_security_test.py (reported line 117)May include surrounding context.

python

result = {
        "skill": "medical-device-samd",
        "version": re.search(r"^version:\s*[\"']?([\w.]+)", sk.split("---")[1], re.M).group(1),
        "timestamp_local": __import__("datetime").datetime.now().isoformat(timespec="seconds"),
        "scope": "本地闭环 · 零真实凭据 · 可重复",
        "dimensions": dims,
        "overall": round(overall, 2),

The package-cleanliness check excludes Python caches while claiming to verify their absence.

Low

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The cleanliness check explicitly skips pycache entries but reports that caches are absent, allowing packages containing them to receive a clean score. This is a security-assurance integrity defect rather than demonstrated code execution; the medical-device context makes misleading assurance particularly undesirable, although this test does not validate device safety.

Content

No source excerpt is available for this finding.