Openevidence Mcp— agent skill

OpenEvidence MCP: open-source browser-session MCP server for human and AI-agent medical workflows

by bakhtiersizhaev·Agent Skill·github.com/bakhtiersizhaev/openevidence-mcp
28starsReview on GitHub →

Is Openevidence Mcp safe to install?

SaferSkills independently audited Openevidence Mcp (Agent Skill) and scored it 65/100 (yellow). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 9 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

Score
65/100
●●●●●●●○○○
↑ +0 since first scan (65 → 65)Re-scan~30s
Latest scan
ScannedJun 24, 2026 · 34d ago
Scans run1 over 90 days
Detectors55 checks · 5 categories
Findings9 warnings · 0 high
EngineSaferSkills 2b638c6
View methodology →
SaferSkills installs
This week0
This month0
All time0
CategoryWeightCategory scoreContribution
Securityprompt, exec, net, exfil, eval
35%
0
0.0 pts
Supply chainhash, typosquat, maintainer, lockfile
20%
100
20.0 pts
Maintenancestaleness, pinning, CI
15%
100
15.0 pts
TransparencySKILL.md, perms, README
15%
100
15.0 pts
Communityinstalls, verify, response
15%
100
15.0 pts

Findings & checks · 9 flagged

Securityscore 0 · 9 findings
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · README.AI.md
MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.
Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted
excerptREADME.AI.md· markdown
34Guide me through OpenEvidence login with my own account. First try npm run login. If Google
… (108 chars elided on L34)
35 
36Do not ask for or expose my password, cookies, tokens, storage-state files, screenshots with
… (108 chars elided on L36)
37 
38After login, run npm run smoke. If smoke returns ok: true and authenticated: true, show me t
… (108 chars elided on L38)
Occurrences
1 occurrence · at L36
How to fix
Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.
  1. Delete blanket "don't ask / no need to confirm" directives from the skill.
  2. If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-DONT-ASK-01sha25668b030f55bcd484a…rubric 365aacaView on GitHub
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · README.es.md
MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.
Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted
excerptREADME.es.md· markdown
29Guide me through OpenEvidence login with my own account. First try npm run login. If Google
… (108 chars elided on L29)
30 
31Do not ask for or expose my password, cookies, tokens, storage-state files, screenshots with
… (108 chars elided on L31)
32 
33After login, run npm run smoke. If smoke returns ok: true and authenticated: true, show me t
… (108 chars elided on L33)
Occurrences
1 occurrence · at L31
How to fix
Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.
  1. Delete blanket "don't ask / no need to confirm" directives from the skill.
  2. If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-DONT-ASK-01sha25668b030f55bcd484a…rubric 365aacaView on GitHub
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · README.hi.md
MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.
Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted
excerptREADME.hi.md· markdown
29Guide me through OpenEvidence login with my own account. First try npm run login. If Google
… (108 chars elided on L29)
30 
31Do not ask for or expose my password, cookies, tokens, storage-state files, screenshots with
… (108 chars elided on L31)
32 
33After login, run npm run smoke. If smoke returns ok: true and authenticated: true, show me t
… (108 chars elided on L33)
Occurrences
1 occurrence · at L31
How to fix
Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.
  1. Delete blanket "don't ask / no need to confirm" directives from the skill.
  2. If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-DONT-ASK-01sha25668b030f55bcd484a…rubric 365aacaView on GitHub
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · README.ko.md
MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.
Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted
excerptREADME.ko.md· markdown
29Guide me through OpenEvidence login with my own account. First try npm run login. If Google
… (108 chars elided on L29)
30 
31Do not ask for or expose my password, cookies, tokens, storage-state files, screenshots with
… (108 chars elided on L31)
32 
33After login, run npm run smoke. If smoke returns ok: true and authenticated: true, show me t
… (108 chars elided on L33)
Occurrences
1 occurrence · at L31
How to fix
Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.
  1. Delete blanket "don't ask / no need to confirm" directives from the skill.
  2. If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-DONT-ASK-01sha25668b030f55bcd484a…rubric 365aacaView on GitHub
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · README.ru.md
MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.
Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted
excerptREADME.ru.md· markdown
29Guide me through OpenEvidence login with my own account. First try npm run login. If Google
… (108 chars elided on L29)
30 
31Do not ask for or expose my password, cookies, tokens, storage-state files, screenshots with
… (108 chars elided on L31)
32 
33After login, run npm run smoke. If smoke returns ok: true and authenticated: true, show me t
… (108 chars elided on L33)
Occurrences
1 occurrence · at L31
How to fix
Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.
  1. Delete blanket "don't ask / no need to confirm" directives from the skill.
  2. If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-DONT-ASK-01sha25668b030f55bcd484a…rubric 365aacaView on GitHub
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · README.zh-Hans.md
MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.
Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted
excerptREADME.zh-Hans.md· markdown
29Guide me through OpenEvidence login with my own account. First try npm run login. If Google
… (108 chars elided on L29)
30 
31Do not ask for or expose my password, cookies, tokens, storage-state files, screenshots with
… (108 chars elided on L31)
32 
33After login, run npm run smoke. If smoke returns ok: true and authenticated: true, show me t
… (108 chars elided on L33)
Occurrences
1 occurrence · at L31
How to fix
Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.
  1. Delete blanket "don't ask / no need to confirm" directives from the skill.
  2. If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-DONT-ASK-01sha25668b030f55bcd484a…rubric 365aacaView on GitHub
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · README.zh-Hant-TW.md
MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.
Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted
excerptREADME.zh-Hant-TW.md· markdown
29Guide me through OpenEvidence login with my own account. First try npm run login. If Google
… (108 chars elided on L29)
30 
31Do not ask for or expose my password, cookies, tokens, storage-state files, screenshots with
… (108 chars elided on L31)
32 
33After login, run npm run smoke. If smoke returns ok: true and authenticated: true, show me t
… (108 chars elided on L33)
Occurrences
1 occurrence · at L31
How to fix
Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.
  1. Delete blanket "don't ask / no need to confirm" directives from the skill.
  2. If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-DONT-ASK-01sha25668b030f55bcd484a…rubric 365aacaView on GitHub
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · docs/AGENT_INSTALL_PROMPT.md
MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.
Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted
excerptdocs/AGENT_INSTALL_PROMPT.md· markdown
20 
21Strict Privacy & Security Boundaries:
22- NEVER ask for or expose my OpenEvidence password, Google password, cookies, browser profil
… (38 chars elided on L22)
23- NEVER display or print screenshots containing private account details, private chat histor
… (76 chars elided on L23)
24- Use my own authentic OpenEvidence account and normal local browser profiles only. Do NOT a
… (96 chars elided on L24)
Occurrences
1 occurrence · at L22
How to fix
Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.
  1. Delete blanket "don't ask / no need to confirm" directives from the skill.
  2. If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-DONT-ASK-01sha2564e0873a3c77e8cc3…rubric 365aacaView on GitHub
MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · docs/EXTERNAL_REVIEW_CONTEXT.md
MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.
Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted
excerptdocs/EXTERNAL_REVIEW_CONTEXT.md· markdown
248 
249Rules:
250- Do not ask for or expose passwords, cookies, browser profile files,
251storage-state files, session tokens, account identifiers, screenshots with
252private account data, patient-identifiable information, or raw private
Occurrences
1 occurrence · at L250
How to fix
Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.
  1. Delete blanket "don't ask / no need to confirm" directives from the skill.
  2. If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.
Framework references
OWASPLLM01ATLASAML.T0051
Trace & refs
ruleSS-SKILL-INJECT-DONT-ASK-01sha25668b030f55bcd484a…rubric 365aacaView on GitHub
Supply chainscore 100 · 0 findings
✓—All supply chain checks passedNo findings in this category for the latest scan.pass
Maintenancescore 100 · 0 findings
✓—All maintenance checks passedNo findings in this category for the latest scan.pass
Transparencyscore 100 · 0 findings
✓—All transparency checks passedNo findings in this category for the latest scan.pass
Communityscore 100 · 0 findings
✓—All community checks passedNo findings in this category for the latest scan.pass
Vendor response · right of reply
Are you the maintainer? Submit a response →

Audit the pieces. Scan the whole. Decide.

~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.

Scan a GitHub repoBrowse capabilities