Skill Trust Decision

meta-analysis

Name: meta-analysis Trust Review Report
Item: meta-analysis
Rating: 78
Author: ClawSafe

The skill is a legitimate meta-analysis tool with declared network access to Coze cloud endpoints for R computation. Primary concern is XOR+base64 obfuscated API tokens embedded in source code (trivial to reverse, but intentionally published as shared public credentials per 2026-08-17 user authorization). No malicious behavior, no shell execution, no credential harvesting, no data exfiltration beyond declared analysis data sent to Coze.

Install decision first Source: ClawHub Scanned: Sep 1, 2026

Files 79

Artifacts 39

Violations 0

Findings 3

Why this conclusion was reached

0/4 dimensions flagged

Pass

Declared vs actual capability

Declared resources and inferred behavior are broadly aligned.

Review

Hidden execution and egress

39 lower-risk artifacts were extracted and still need context.

Pass

Attack chain and severe findings

There is no explicit malicious chain in the report.

Review

Dependencies and supply chain hygiene

1 dependency or supply-chain issues need attention.

What drove the risk score up

Obfuscated credentials in source code +15

XOR+base64 obfuscated Coze API tokens embedded in coze_token.py (OBFUSCATION_KEY=b'meta-analysis-coze-obf-v1-9f2c') and bug_report.py (_OBFUSCATION_KEY=b'ct-bugreport-coze-obf-v1-3c9e'). The code itself states 'This is OBFUSCATION, NOT real encryption' — trivially reversible by anyone with the source. However, tokens are user-authorized shared credentials (2026-08-17), scoped to specific workflow endpoints, not elevated secrets.

Public token distribution in published skill +5

SKILL.md declares 'public shared credentials published with skill' in coze_token.py docstring. Token distribution model is documented and user-authorized, reducing intent concern.

Declared network access +-5

Network access fully declared in SKILL.md permissions block (network:'required', outbound to coze + Europe PMC + bugreport). No hidden exfiltration.

Filesystem scope confined to working directory +-3

SKILL.md declares filesystem:'writes only to the current working directory (meta_analysis/ and output/)'. No writes outside declared scope.

Most important evidence

Medium Obfuscation

Reversible obfuscation of API tokens in source code

adapters/coze_token.py embeds XOR+base64 obfuscated Coze API tokens (meta_analysis_coze, ct_meta2_coze) and adapters/bug_report.py embeds ct_bugreport_coze token with hardcoded keys. The code explicitly states 'This is OBFUSCATION, NOT real encryption' and acknowledges the key is published with the script. While the tokens are user-authorized shared credentials (2026-08-17), the obfuscation pattern is weak by design. Anyone with the skill source can decode tokens in seconds.

adapters/coze_token.py:15

Remove EMBEDDED_SECRETS blobs. Implement env-only token loading (COZE_META_TOKEN env var) as the sole path. Coze-side workspace-level scoping should prevent cross-tenant abuse of shared tokens.

Low Sensitive Access

Filesystem writes outside declared output directories not found

Filesystem writes are confined to declared meta_analysis/ and output/ subdirectories of the working directory. No writes to ~/.workbuddy/ or other sensitive paths. The DEFAULT_TOKEN_PATH (~/.workbuddy/skills/meta-analysis/config/coze.dat) exists in code but is only used as an optional local override path (store_token), not auto-created or auto-read on normal execution.

adapters/coze_token.py:65

No action needed — path is optional and not auto-created. Consider documenting that this path is not used by default.

Low Supply Chain

cairosvg dependency not pinned in requirements.txt

requirements.txt comments cairosvg as 'optional, only when PNG output is requested' and says 'pip install cairosvg'. This is an acceptable opt-in model for an optional feature. No other third-party dependencies are declared.

requirements.txt:1

No action needed. Consider pinning cairosvg version if it becomes a hard dependency in future versions.

Declared capability vs actual capability

Filesystem Pass

Declared WRITE

→

Inferred WRITE

SKILL.md permissions.filesystem: 'writes only to the current working directory'

Network Pass

Declared READ

→

Inferred READ

SKILL.md permissions.network: 'required (all computation via coze cloud R engine)'; literature_probe.py makes GET to Europe PMC; bug_report.py makes POST to ct-bugreport.coze.site

Shell Pass

Declared NONE

→

Inferred NONE

No subprocess/shell execution found in any Python file

Environment Pass

Declared NONE

→

Inferred READ

coze_client.py reads COZE_META_ENDPOINT, COZE_META_TOKEN, COZE_META_TIMEOUT, COZE_META_MIN_INTERVAL, COZE_META_DEDUP_WINDOW; i18n.py reads LANG/LANGUAGE/LC_* env vars — all documented and appropriate

Skill Invoke Pass

Declared NONE

→

Inferred NONE

No dynamic skill invocation found

Clipboard Pass

Declared NONE

→

Inferred NONE

No clipboard access found

Browser Pass

Declared NONE

→

Inferred NONE

No browser/WebFetch access found

Database Pass

Declared NONE

→

Inferred NONE

No database access found

Suspicious artifacts and egress

Medium External URL

https://www.ebi.ac.uk/europepmc/webservices/rest/search

AGENTS.md:47

Medium External URL

https://keepachangelog.com/en/1.0.0/

CHANGELOG.md:3

Medium External URL

https://semver.org/

CHANGELOG.md:3

Medium External URL

https://ct-meta.coze.site/run

CHANGELOG.md:80

Medium External URL

https://example.invalid/run

CHANGELOG.md:80

Medium External URL

https://ct-meta2.coze.site/run

CHANGELOG.md:571

Medium External URL

https://ct-bugreport.coze.site/run

CHANGELOG.md:749

Medium External URL

https://ct-meta.coze.site/run（2026-08-26

adapters/coze_client.py:15

Medium External URL

https://ct-meta2.coze.site/run，token

adapters/coze_client.py:18

Medium External URL

https://ct-meta.coze.site/run）执行云端

adapters/coze_client.py:26

Medium External URL

https://ct-meta.coze.site/run（如被旧配置覆盖，

adapters/coze_client.py:346

Medium External URL

https://ct-meta.coze.site/run（已发布的

adapters/coze_integration_test.py:4

Dependencies and supply chain

Package	Version	Source	Known vuln	Notes
cairosvg	`*`	pip (optional)	No	Optional only for PNG output mode; not a hard dependency
coze_token (embedded)	`obf-v1`	bundled	No	XOR+base64 obfuscated; key hardcoded in coze_token.py. Not a traditional dependency — embedded credential.

File composition

79 files · 15148 lines

Markdown 46 files · 7794 linesPython 21 files · 6096 linesJSON 9 files · 1220 linesOther 1 files · 21 linesText 1 files · 17 lines

Files of concern · 5

adapters/coze_token.py Python · 158 lines

Reversible obfuscation of API tokens in source code · Filesystem writes outside declared output directories not found

adapters/config.json JSON · 7 lines

CHANGELOG.md Markdown · 1284 lines

https://keepachangelog.com/en/1.0.0/ · https://semver.org/ · https://ct-meta.coze.site/run · https://example.invalid/run · https://ct-meta2.coze.site/run · https://ct-bugreport.coze.site/run · [email protected]

adapters/rendering.py Python · 1048 lines

http://www.w3.org/2000/svg

adapters/coze_client.py Python · 850 lines

https://ct-meta.coze.site/run（2026-08-26 · https://ct-meta2.coze.site/run，token · https://ct-meta.coze.site/run）执行云端 · https://ct-meta.coze.site/run（如被旧配置覆盖，

Other files · build_request.py · README.md · excel_style.py · README_zh-CN.md · drug_name_map.json · bug_report.py +1

79 files · 786.6 KB · 15148 lines

Markdown 46f · 7794LPython 21f · 6096LJSON 9f · 1220LOther 1f · 21LText 1f · 17L

├─ ▾ 📁 adapters

│ ├─ 📝 README.md Markdown 89L · 5.5 KB

│ ├─ 🐍 __init__.py Python 6L · 242 B

│ ├─ 🐍 bug_report.py Python 351L · 19.3 KB

│ ├─ 🔑 config.json ⚠ JSON 7L · 161 B

│ ├─ 🐍 coze_client.py Python 850L · 39.9 KB

│ ├─ 🐍 coze_integration_test.py Python 267L · 11.5 KB

│ ├─ 🔑 coze_token.py ⚠ Python 158L · 8.4 KB

│ ├─ 🐍 literature_probe.py Python 342L · 14.7 KB

│ ├─ 🐍 pdf_fetch.py Python 145L · 5.5 KB

│ ├─ 🐍 rendering.py Python 1048L · 47.3 KB

│ ├─ 📋 req_test.json JSON 15L · 718 B

│ └─ 🐍 run_analysis.py Python 191L · 9.3 KB

├─ ▾ 📁 assets

│ └─ 📦 icon.svg 3.5 KB

├─ ▾ 📁 references

│ ├─ 📝 ADVANCED.md Markdown 232L · 11.5 KB

│ ├─ 📝 ADVANCED_zh-CN.md Markdown 236L · 11.1 KB

│ ├─ 📝 advanced_analysis.md Markdown 438L · 11.2 KB

│ ├─ 📝 advanced_api.md Markdown 68L · 4.5 KB

│ ├─ 📝 baujat-plot.md Markdown 106L · 6.3 KB

│ ├─ 📝 bayesian_nma.md Markdown 190L · 4.9 KB

│ ├─ 📝 bug_report_endpoint.md Markdown 96L · 8.0 KB

│ ├─ 📝 citations.md Markdown 55L · 4.0 KB

│ ├─ 📝 compliance-precheck.md Markdown 79L · 4.3 KB

│ ├─ 📝 data_templates.md Markdown 188L · 7.1 KB

│ ├─ 📝 dedup-search.md Markdown 146L · 7.7 KB

│ ├─ 📝 diagnosis_meta.md Markdown 78L · 2.8 KB

│ ├─ 📋 drug_name_map.json JSON 616L · 21.8 KB

│ ├─ 📝 esc_robust_meta.md Markdown 248L · 7.0 KB

│ ├─ 📝 forest-binary.md Markdown 114L · 6.2 KB

│ ├─ 📝 forest-continuous.md Markdown 109L · 6.5 KB

│ ├─ 📝 funnel-plot.md Markdown 108L · 6.1 KB

│ ├─ 📝 inline_rendering.md Markdown 162L · 10.4 KB

│ ├─ 📝 interactive_menu.md Markdown 295L · 17.5 KB

│ ├─ 📝 language_policy.md Markdown 37L · 5.4 KB

│ ├─ 📝 migration-notes-aipoch.md Markdown 98L · 7.7 KB

│ ├─ 📝 pico-guide.md Markdown 78L · 3.8 KB

│ ├─ 📝 prospero-mapping.md Markdown 62L · 3.2 KB

│ ├─ 📝 purpose_zh.md Markdown 3L · 715 B

│ ├─ 📝 r_packages.md Markdown 171L · 7.8 KB

│ ├─ 📝 radial-plot.md Markdown 114L · 6.5 KB

│ ├─ 📝 references.md Markdown 43L · 3.1 KB

│ ├─ 📝 report_template.md Markdown 116L · 4.0 KB

│ ├─ 📝 review_workflow.md Markdown 131L · 3.4 KB

│ ├─ 📝 revman_complete.md Markdown 463L · 8.9 KB

│ ├─ 📝 rob2-plot.md Markdown 132L · 7.4 KB

│ ├─ 📝 single_group_meta.md Markdown 122L · 3.2 KB

│ ├─ 📝 speed-discipline.md Markdown 70L · 10.6 KB

│ ├─ 📝 stata_to_r_mapping.md Markdown 126L · 4.4 KB

│ ├─ 📝 survival_meta.md Markdown 71L · 2.3 KB

│ ├─ 📝 svg_editing.md Markdown 23L · 1010 B

│ ├─ 📋 term_map.json JSON 254L · 8.7 KB

│ ├─ 📝 topic-report-template.md Markdown 117L · 3.6 KB

│ ├─ 📝 topic-selection.md Markdown 175L · 9.9 KB

│ ├─ 📝 tsa_diagnostics.md Markdown 116L · 3.5 KB

│ └─ 📝 units.md Markdown 54L · 4.4 KB

├─ ▾ 📁 scripts

│ ├─ 🐍 build_request.py Python 535L · 27.1 KB

│ ├─ 🐍 classify.py Python 202L · 7.6 KB

│ ├─ 🐍 drug_name_resolver.py Python 150L · 4.9 KB

│ ├─ 🐍 excel_style.py Python 414L · 23.2 KB

│ ├─ 🐍 generate_topic_report.py Python 372L · 14.0 KB

│ ├─ 🐍 i18n.py Python 165L · 6.3 KB

│ ├─ 🐍 keyword_breadth.py Python 213L · 9.3 KB

│ ├─ 🐍 merge_spec.py Python 104L · 3.6 KB

│ ├─ 📋 meta_request_debug.json JSON 72L · 1.4 KB

│ ├─ 📋 meta_request_fixed.json JSON 80L · 1.6 KB

│ ├─ 🐍 office_to_md.py Python 217L · 7.2 KB

│ ├─ 🐍 quality_gate.py Python 133L · 5.2 KB

│ ├─ 🐍 run_meta.py Python 97L · 4.4 KB

│ ├─ 🐍 source_guard.py Python 136L · 5.6 KB

│ └─ 📋 topic_report.example.json JSON 99L · 5.6 KB

├─ 📝 AGENTS.md Markdown 168L · 11.9 KB

├─ 📝 CHANGELOG.md Markdown 1284L · 136.7 KB

├─ 📄 LICENSE 21L · 1.0 KB

├─ 📝 README.md Markdown 362L · 24.9 KB

├─ 📝 README_zh-CN.md Markdown 364L · 22.4 KB

├─ 📝 SKILL.md Markdown 191L · 18.5 KB

├─ 📋 _meta.json JSON 5L · 133 B

├─ 📋 meta_request.json JSON 72L · 1.4 KB

├─ 📄 requirements.txt Text 17L · 1.1 KB

└─ 📝 skill-card.md Markdown 66L · 3.2 KB

Security positives

No shell/subprocess/exec execution anywhere in the codebase — pure Python standard library

No base64-encoded commands or eval(atob(...)) patterns

No hidden functionality — all features described in SKILL.md match implementation

Network access is fully declared in permissions block and implemented via standard library urllib only

Payload sanitization (sanitize_payload) strips PII (ID card, phone, email) before outbound POST

Auth gate (ct-base §5) requires user confirmation before first outbound call to new endpoints

Coze-only compute model — no local R engine in the runtime path (moved to adapters/_dev/, git-ignored)

Bug report uses hard whitelist schema — only enumerated fields allowed, no raw data exfiltration

Literature probe (Europe PMC) makes read-only public literature queries, no PII involved

All factual claims in SKILL.md are traceable to reference documentation