research-hotspot-analysis
Analyze research hotspots for a disease or topic and recommend representative literature. Use when users need to identify trending directions, topic clusters, or generate hotspot review reports. Input is a disease name or research topic; output is a structured hotspot analysis report and representative literature list.
56
63%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Critical
Do not install without reviewing
Fix and improve this skill with Tessl
tessl review fix ./scientific-skills/Evidence Insight/research-hotspot-analysis/SKILL.mdE004: Prompt injection detected in skill instructions.
What this means
Detected a prompt injection in the skill instructions. The skill contains hidden or deceptive instructions that fall outside its stated purpose and attempt to override the agent’s safety guidelines or intended behavior.
Why it was flagged
The skill contains hardcoded static API keys in its script file, which constitutes embedded credential material.
W008: Secret detected in skill content (API keys, tokens, passwords).
What this means
Detected sensitive credentials directly embedded within the skill content, such as API keys, access tokens, private keys, or service-specific secrets. Secrets should never be hardcoded in plain text within skill instructions.
Why it was flagged
Upon analyzing the provided skill documentation and scripts, the file `scripts/analysis_ops.py` contains hardcoded API keys inside an array in the `sort_by_jif_and_select` function (lines 282-283): `api_keys = ["e76024dbcecbf7ed987ab5c27cd5bed73e09","4a0cf12cdb32e8458d42ed2fc6fd22b3b909", "7a07e1951cfa0f0f5ff7ce951d0f0bea3d09", "edb6171f18c4d2e23692e0f2b9dedaf34208"]` These strings have high entropy and look like functional API tokens or credentials, rather than simple documentation placeholders or setup passwords.
- Repository
- aipoch/medical-research-skills
- Commit
63c61d3
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.