Chinese Medicine CN

• Outcome: Review
• Latest audit: Sep 14, 2026 · 9:13 PM UTC
• Version: 1.0.0

Overview

The skill is a static Chinese medicine reference, but it needs review because it can expose exact herbal doses and needle insertion instructions despite claiming to avoid prescribing.

Review carefully before installing. Treat this as cultural and educational reference only, not self-medication or self-needling guidance; safer publication would suppress dosage, preparation, formula-modification, needling, and moxibustion procedure fields from consumer responses and direct users to licensed clinicians for treatment decisions.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: references/formulas.json:8
• Finding: Exact Herbal Dosages and Preparation Instructions Violate the Non-Prescriptive Safety Boundary## Vulnerability Details **File Location**: `references/formulas.json`, lines 8-14; related dosage fields also appear throughout `references/formulas.json` and `references/herbs_db.json` **Vulnerability Type**: Unsafe medical guidance caused by inconsistent configuration and data exposure **Risk Level**: High ### Vulnerable Code Snippet ```json "composition": [ { "herb": "Ren Shen", "dosage": "9g", "role": "Chief", "purpose": "Powerfully tonifies Spleen and Stomach Qi" }, { "herb": "Bai Zhu", "dosage": "9g", "role": "Deputy", "purpose": "Strengthens Spleen, dries dampness" }, { "herb": "Fu Ling", "dosage": "9g", "role": "Assistant", "purpose": "Drains dampness, strengthens Spleen" }, { "herb": "Zhi Gan Cao", "dosage": "6g", "role": "Envoy", "purpose": "Harmonizes, tonifies Qi" } ] ``` Additional actionable dosage and preparation data appears in the herb database: ```json "dosage": "3-9g", "preparation": "Decoction added near end; can be taken as powder" ``` ### Technical Analysis The Skill declares that it must not provide specific medication dosage advice. Its formula response schema and reference datasets nevertheless contain exact quantities, preparation methods, and formula modifications. When the agent fulfills a formula or herb lookup, these fields can be reproduced directly in the response. A disclaimer does not neutralize actionable dosing information. Exact gram quantities, preparation methods, and modification instructions can reasonably be interpreted as instructions for preparing and consuming a medicinal product. The inconsistency between the declared safety boundary and the data model means enforcement depends entirely on the language model electing not to expose fields that the Skill explicitly tells it to use. Confirmed related locations include: - `references/formulas.json:8- ...[truncated 1996 chars]
• Remediation: ## Remediation Suggestions 1. Remove all user-facing `dosage` and `preparation` fields from the herb and formula datasets. 2. Change the formula output schema so that it lists ingredients and historical roles without quantities. 3. Suppress formula modification instructions that could be used to construct an individualized treatment. 4. Add a deterministic output filter that rejects gram values, dose ranges, frequency instructions, and preparation directions in consumer responses. 5. Do not rely solely on prompt instructions or disclaimers to enforce the restriction. 6. If historical dosages must remain for internal reference, place them in a separately access-controlled professional dataset that this consumer Skill cannot query. 7. Add automated tests covering direct requests, indirect requests, translation requests, and attempts to obtain dosages one ingredient at a time. 8. Require referral to a licensed medical professional whenever a user asks how much of an herb or formula to take.

T09 · Insecure Skill Coding Practices

Error

• Location: references/acupoints.json:340
• Finding: Consumer Acupressure Dataset Exposes Invasive Needle Insertion Depths and Trajectories## Vulnerability Details **File Location**: `references/acupoints.json`, lines 340-350; invasive needling instructions also appear throughout the acupoint dataset **Vulnerability Type**: Unsafe invasive-procedure guidance outside the declared massage-only scope **Risk Level**: High ### Vulnerable Code Snippet ```json { "id": "GB20", "name_en": "Wind Pool", "location": "In the depression between the upper portion of sternocleidomastoid muscle and trapezius muscle, level with GV16", "location_simple": "Base of skull, in the hollows on either side of neck muscles", "needling": "0.5-0.8 cun toward opposite eye", "moxibustion": "Applicable", "contraindications": [ "Deep insertion contraindicated - risk to brainstem" ], "safety_tags": [ "caution_deep_insertion", "wind_expelling" ] } ``` Other examples include: ```json "needling": "1.0-2.0 cun perpendicular insertion" ``` ```json "needling": "0.3-0.5 cun subcutaneous insertion" ``` ### Technical Analysis The declared consumer capability is non-invasive acupoint massage for routine wellness. The reference dataset nevertheless provides needle insertion depth, angle, and direction for multiple points. These fields are not required to explain acupressure and materially expand the Skill into invasive acupuncture instruction. Instructions involving the head, neck, wrists, hands, feet, and lower limbs require anatomical knowledge, sterile technique, appropriate equipment, and professional training. The GB20 record is particularly concerning because it supplies a trajectory while acknowledging a risk to the brainstem. Merely stating that deep insertion is contraindicated does not make the supplied trajectory safe for an untrained user. Confirmed needling fields appear at: - `references/acupoints.json:29` - `references/acupoints.json:61` - `references/acupoints.json:93` - `references/acupoints.json:125` - `referen ...[truncated 1581 chars]
• Remediation: ## Remediation Suggestions 1. Delete all `needling` fields from the consumer Skill's reference data. 2. Remove needle depth, angle, trajectory, and subcutaneous or perpendicular insertion terminology from all user-facing templates. 3. Restrict guidance to non-invasive pressure or massage, including safe pressure intensity, duration, frequency, and conditions for stopping. 4. Add a deterministic policy that refuses requests for self-needling or invasive acupuncture instructions and directs users to a licensed acupuncture professional. 5. Clearly distinguish acupressure from acupuncture in the Skill instructions and generated responses. 6. Preserve and strengthen pregnancy, skin injury, bleeding-disorder, anticoagulant, and acute-symptom warnings for non-invasive stimulation. 7. Add regression tests ensuring that no response can expose insertion measurements or trajectories, even when a user explicitly requests the original database record. 8. Review moxibustion and cupping references separately, as those procedures also carry burn and injury risks and should not be presented as unsupervised routine practices.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The description states the assistant is designed specifically for '国内用户' and the entire skill is framed as Chinese-only, which imposes a locale/language constraint in natural language. The policy allows locale constraints only when explicitly justified or when users are given a choice, neither of which is provided here.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: This dataset embeds Chinese names and transliterations as first-class fields, and later includes Chinese assessment questions and options throughout the file. Because there is no accompanying natural-language indication that language selection is optional or user-controlled, the skill may impose locale-specific content without explicit opt-in.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: This JSON file includes user-facing natural-language values in both Chinese and English, such as Chinese source titles alongside English field content, but does not indicate whether multilingual output is intentional or configurable. Under the language/locale policy rule, forcing or assuming a locale without opt-in or justification can be a policy concern.

Natural-Language Policy Violations

Low

• Confidence: 79% confidence
• Finding: This JSON includes locale-specific content through dedicated Chinese naming fields such as "name_cn" and pinyin transliterations, but the file provides no natural-language indication that users can choose their preferred language or locale. Under the policy rule, a file can be flagged when it appears to impose a specific language/locale convention without documented opt-in or justification.

Natural-Language Policy Violations

Low

• Confidence: 77% confidence
• Finding: This JSON file embeds multilingual labels, including English, Chinese, and pinyin, as part of the skill content. While multilingual support is not inherently problematic, the file provides no natural-language indication that language presentation is optional or selected based on user preference, which can conflict with a language/locale choice policy.

Static analysis

No suspicious patterns detected.