Survival Analysis (KM)

Generates Kaplan-Meier survival curves, calculates survival statistics (log-rank test, median survival time), and estimates hazard ratios for clinical and bi...

This package is coherent with its stated purpose and uses appropriate libraries. Before installing/using: (1) run the script in an isolated sandbox (non-production) with non-sensitive test data; (2) review the full scripts/main.py (the provided copy was truncated in the bundle you gave me) to confirm there are no network calls, hidden subprocess invocations, or filesystem accesses beyond the declared input/output; (3) pin dependency versions in requirements.txt to reduce supply-chain risk; (4) ensure the output directory and input paths are validated/sandboxed to avoid accidental path traversal or overwriting important files; and (5) if you will analyze real clinical data, get a biostatistician to review results and ensure you meet privacy/regulatory requirements.

Type: OpenClaw Skill Name: survival-analysis-km Version: 1.0.0 The skill bundle is classified as suspicious due to path traversal vulnerabilities in `scripts/main.py`. The `--input` and `--output` arguments are used directly with `pd.read_csv`, `os.path.exists`, `os.makedirs`, `plt.savefig`, `df.to_csv`, and `open()` without proper sanitization, allowing an attacker to potentially read or write files to arbitrary locations on the file system (e.g., using `../` sequences). While this represents a significant security flaw, there is no clear evidence of intentional malicious behavior such as data exfiltration, backdoor installation, or unauthorized remote control. The `SKILL.md` documentation itself does not contain prompt injection attempts and accurately claims no external network access, which is verified by the code.