Skills/ClawHub/ct-safety

ct-safety@1.0.0

CAUTION· install only

Publisher claims: "Screen drug–event safety signals via disproportionality analysis (PRR / ROR / IC / EBGM with 95% CIs) on FDA FAERS, with Safety Signal Score (0–100, T1–T4). Sources: FDA FAERS, FDA Label, China NMPA PV bulletins, DailyMed SPL, RxClass MED-RT, openFDA enforcement recalls, Hong Kong ADR Alerts. / 基于 FDA FAERS 筛查药物-事件安全信号，计算 disproportionality（PRR / ROR / IC / EBGM，含 95% CI）与安全信号评分（0–100，T1–T4）。数据源：FDA FAERS、FDA 标签、中国 NMPA 药物警戒通报、DailyMed 说明书、RxClass MED-RT、openFDA 召回执法、香港 ADR 警报。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher medstatstar · publishing for 105 daysInstalls 1,095Last detonated 25 min ago
What would fix thisWatchDispute verdict

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-15 and scored it 74/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Hidden zero-width characters detected. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathsSKILL.md:174 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…rovide via CLI `--api-key`, env `OPENFDA_API_KEY` (recommended), or skill-root `.env` (git-ignored; plaintext or `obf:` XOR+base64 per ct-base §5) — never paste key…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsadapters/fetch_faers.py:69 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# naive scanners or accidentally copied when a .env is moved around.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Hidden zero-width characters detectedscripts/ct_safety.py:1168 · Hidden zero-width characters detected — may conceal contentlines.append("> **该分数不与 dispropor­tionality 统计信号混算，也不喂入 PRR / ROR / IC / EBGM**"Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
HIGH
Access to sensitive file pathsadapters/fetch_fda_label.py:33 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Skill root (parent of the scripts/ dir). Used to locate a local .env thatFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsadapters/fetch_faers.py:65 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# A skill-root .env may store either a plaintext key OR an `obf:`-prefixedFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsadapters/fetch_fda_label.py:43 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# naive scanners or accidentally copied when a .env is moved around.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsadapters/fetch_faers.py:90 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files3. A ``.env`` file at the skill root (``OPENFDA_API_KEY=...``)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedscripts/hardware_id.py:140 · Python subprocess execution detectedout = subprocess.check_output(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Access to sensitive file pathsadapters/fetch_faers.py:59 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Skill root (parent of the scripts/ dir). Used to locate a local .env thatFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Destructive file system command detectedscripts/export_xlsx.py:71 · Destructive file system command detected# All palette / format / layout / chart logic lives in scripts/excel_style.pyFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsscripts/fetch_reports.py:463 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"Also read from env OPENFDA_API_KEY or skill-root .env (git-ignored). "Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedscripts/r_libs.py:299 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File type combined with upload actionscripts/faers_dedup.py:42 · File type combined with upload action — agent may exfiltrate local data filespython faers_dedup.py --input cases.json --output deduped.jsonFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathsscripts/ct_safety.py:1291 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"Also read from env OPENFDA_API_KEY or skill-root .env (git-ignored). "Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsadapters/fetch_fda_label.py:36 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files_DOTENV = os.path.join(_SKILL_ROOT, ".env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsadapters/fetch_fda_label.py:64 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files3. A ``.env`` file at the skill root (``OPENFDA_API_KEY=...``)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commandscripts/ct_safety.py:597 · Process kill command — agent can terminate processes_WALL_BUDGET = 150 # seconds; break the event loop past this to stay < tool killFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsadapters/fetch_faers.py:62 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files_DOTENV = os.path.join(_SKILL_ROOT, ".env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsadapters/fetch_fda_label.py:39 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# A skill-root .env may store either a plaintext key OR an `obf:`-prefixedFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05

Cost to the agent

Instructions loaded
≈4,702 tok
2 files · 86 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

6 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim medstatstar: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. Hidden zero-width characters detected≈ +4 on the totalKeep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
  4. Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  5. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  6. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim medstatstarPropose a patch to the maintainer