clinical-decision-support
No security findings. Scanned 1 time, most recently 2026-10-21.
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Prepares and validates research-only clinical decision-support evaluation, evidence-profile, cohort, survival, biomarker/model, privacy, and governance artifacts. Supports aggregate or synthetic research documentation and traceability, excluding patient care and live clinical operation.
- Package
- 28 files, 201 KB
- SKILL.md
- 1683 words, 12+ sections
- Code
- Python (8)
- License
- MIT
- Compatibility
- Python 3.11+; local files only; bundled scripts use the standard library and require no network, credentials, API keys, LLMs, or image services.
SKILL.md covers: Clinical Decision-Support Research and Evaluation · Hard Safety Boundary · In Scope · Data Gate · Required Artifact Header · Workflow · 1. Frame the Research Question · 2. Select the Artifact · 3. Run Locally · 4. Human Review · GRADE Evidence Profiles · Aggregate Model and Biomarker Evaluation
Findings
No findings. SAFE
What is in the package
28 files, 201 KB. Show the list.
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 14 KB |
assets/aggregate_cohort_table_template.json | config | 3.1 KB |
assets/aggregate_model_evaluation_template.json | config | 3.6 KB |
assets/artifact_intended_use_template.json | config | 3.2 KB |
assets/decision_logic_traceability_template.json | config | 4.3 KB |
assets/deidentification_checklist_template.json | config | 6.0 KB |
assets/evidence_profile_template.json | config | 4.4 KB |
assets/survival_analysis_plan_template.json | config | 7.1 KB |
references/README.md | doc | 3.2 KB |
references/cohort_evaluation.md | doc | 5.5 KB |
references/decision_logic_traceability.md | doc | 3.3 KB |
references/evidence_profiles.md | doc | 5.7 KB |
references/model_biomarker_evaluation.md | doc | 6.4 KB |
references/privacy_and_disclosure.md | doc | 4.7 KB |
references/regulatory_and_governance.md | doc | 7.5 KB |
references/safety_and_scope.md | doc | 4.5 KB |
references/security_validation.md | doc | 3.5 KB |
references/sources.md | doc | 13 KB |
references/study_reporting.md | doc | 7.4 KB |
references/survival_analysis.md | doc | 5.6 KB |
scripts/_common.py | script | 7.6 KB |
scripts/cohort_table_generator.py | script | 12 KB |
scripts/decision_logic_traceability.py | script | 11 KB |
scripts/deidentification_checklist.py | script | 9.8 KB |
scripts/evidence_profile_check.py | script | 11 KB |
scripts/model_biomarker_evaluation.py | script | 14 KB |
scripts/survival_plan_validator.py | script | 11 KB |
scripts/validate_cds_artifact.py | script | 9.8 KB |
External hosts referenced
www.fda.gov www.nature.com pubmed.ncbi.nlm.nih.gov book.gradepro.org database.ich.org pmc.ncbi.nlm.nih.gov www.bmj.com healthit.gov www.ecfr.gov www.equator-network.org www.consort-spirit.org www.hhs.gov www.ncbi.nlm.nih.gov arxiv.org www.federalregister.gov www.gradeworkinggroup.org www.healthit.gov www.ich.org www.record-statement.org www.strobe-statement.org doi.org export.arxiv.org gradepro.org www.probast.org
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Package contents recorded 2026-10-22 at commit 593377bb0487. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Bytecode analyzer.
- Pipeline analyzer.
- Correlation analyzer.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://github.com/K-Dense-AI/scientific-agent-skills
- Raw scan result: skills-clinical-decision-support-scan.json
- Badge for your README:
- Request a re-scan