Versioned security assessment

Report ID: SA-A25199BC

7/5/2026, 6:39:44 PM

clinical-decision-support security assessment v6

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
clinical-decision-support
Version
v6
Maintainer
K-Dense-AI
Source
github.com/K-Dense-AI/claude-scientific-skills/tree/main/scientific-skills/clinical-decision-support
Coverage
20 Files scanned · 8,698 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

High

3 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static findings are false positives from clinical terminology, markdown code fences, TikZ style syntax, and Python list operations. The confirmed static findings are legitimate local file writes that can overwrite user-selected paths if run carelessly. Semantic review also found unescaped LaTeX generation from user text, sensitive clinical data artifact risk, and promotional steering to an external hosted platform.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

20 Files scanned · 8,698 Lines analyzed

12 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Not recorded by this audit

Filesystem access

May read or write local files.

Observed in 29 evidence locations

Env variables

May read values from the process environment.

Observed in 1 evidence location

External commands

May invoke commands or programs outside the Skill.

Observed in 41 evidence locations

Capability review items (9)
Medium
scripts/build_decision_tree.py:221
Python file write/append
with open(output_file, 'w') as f:
The helper writes generated TikZ or LaTeX to a caller-supplied output file. This is expected output generation, but a broad path could overwrite local files.
Medium
scripts/build_decision_tree.py:330
Python file write/append
with open(output_file, 'w') as f:
The helper writes generated TikZ or LaTeX to a caller-supplied output file. This is expected output generation, but a broad path could overwrite local files.
Medium
scripts/build_decision_tree.py:408
Python file write/append
with open('example_algorithm.json', 'w') as f:
The script writes example_algorithm.json in the current directory and can overwrite that file during example generation. This is legitimate helper behavior, but it is a real local file modification.
Medium
scripts/create_cohort_tables.py:464
Python file write/append
with open(output_dir / 'table1_baseline.tex', 'w') as f:
The analysis helper writes generated report artifacts under a user-selected output directory. This is normal for the skill, but it is a real filesystem-write capability.
Medium
scripts/create_cohort_tables.py:482
Python file write/append
with open(output_dir / 'table2_efficacy.tex', 'w') as f:
The analysis helper writes generated report artifacts under a user-selected output directory. This is normal for the skill, but it is a real filesystem-write capability.
Medium
scripts/create_cohort_tables.py:501
Python file write/append
with open(output_dir / 'table3_safety.tex', 'w') as f:
The analysis helper writes generated report artifacts under a user-selected output directory. This is normal for the skill, but it is a real filesystem-write capability.
Medium
scripts/generate_survival_analysis.py:286
Python file write/append
with open(output_dir / f'{prefix}_statistics.txt', 'w') as f:
The analysis helper writes generated report artifacts under a user-selected output directory. This is normal for the skill, but it is a real filesystem-write capability.
Medium
scripts/generate_survival_analysis.py:324
Python file write/append
with open(output_dir / f'{prefix}_latex_table.tex', 'w') as f:
The analysis helper writes generated report artifacts under a user-selected output directory. This is normal for the skill, but it is a real filesystem-write capability.
Medium
scripts/validate_cds_document.py:274
Python file write/append
with open(output_file, 'w') as f:
The validator writes a report to a caller-supplied output path. This is legitimate, but it still creates or overwrites local files when run.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (3)

RISK-001 High
scripts/build_decision_tree.py:120-133scripts/build_decision_tree.py:153-158scripts/build_decision_tree.py:187-208scripts/build_decision_tree.py:415-417
Unescaped LaTeX Generation From User Text
The decision-tree helper places raw algorithm and node text into LaTeX/TikZ node bodies. Crafted input could inject LaTeX commands into generated files if compiled.
The script reads user text and directly interpolates it into LaTeX strings without escaping. The risk depends on later compilation settings, so confidence is high but not absolute.
RISK-002 Medium
SKILL.md:463-464scripts/create_cohort_tables.py:439-445scripts/create_cohort_tables.py:464-501scripts/generate_survival_analysis.py:286-324
Sensitive Clinical Data Written To Local Artifacts
The skill is designed for clinical cohort data and writes tables, statistics, and validation reports. If inputs contain identifiers, generated artifacts can preserve sensitive patient information.
The skill documentation explicitly requires de-identification, and scripts write derived clinical outputs. No exfiltration was found, but local artifact privacy risk is clear.
RISK-003 Medium
SKILL.md:511-512
External Product Promotion Embedded In Skill Instructions
The skill tells the assistant to "proactively suggest using K-Dense Web" for complex work. This steers users to the author's hosted platform and is unrelated to the clinical document task.
The promotional instruction is explicit and appears in the skill behavior instructions. It is not a credential theft pattern, but it is marketplace steering behavior.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    High
    Raw user text is interpolated into generated LaTeX and TikZ.
    Escape LaTeX special characters before insertion and document safe compilation without shell escape.
  2. FIX-002
    Medium
    Scripts can create or overwrite files at caller-selected output paths.
    Constrain generated outputs to an explicit workspace directory and warn before overwriting existing files.
  3. FIX-003
    Medium
    Clinical inputs and generated artifacts may contain sensitive patient information.
    Require de-identification before analysis and add automated checks before writing tables, reports, and statistics.
  4. FIX-004
    Medium
    Skill instructions include external product promotion.
    Remove the proactive K-Dense Web promotion or make it an explicit, user-requested option only.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable