T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:23
- Finding
- Actionable Herbal Dosage and Invasive Needling Data Bypass Declared Safety Boundaries## Vulnerability Details **File Location**: `SKILL.md:23-26`; `references/herbs_db.json:15-16`; `references/formulas.json:12-15`; `references/acupoints.json:17-19, 354-357` **Vulnerability Type**: Safety-boundary mismatch in skill configuration and reference data **Risk Level**: High ### Vulnerable Code Snippets `SKILL.md:23-26` declares that dosage recommendations are prohibited: ```markdown ### What You CANNOT Do - Diagnose medical conditions or diseases - Prescribe specific treatment plans or dosages - Recommend stopping or replacing prescribed medications ``` However, `references/herbs_db.json:15-16` provides an exact dose and preparation method: ```json "dosage": "3-9g", "preparation": "Decoction added near end; can be taken as powder", ``` `references/formulas.json:12-15` exposes exact quantities for a multi-herb formula: ```json {"herb": "Ren Shen", "dosage": "9g", "role": "Chief", "purpose": "Powerfully tonifies Spleen and Stomach Qi"}, {"herb": "Bai Zhu", "dosage": "9g", "role": "Deputy", "purpose": "Strengthens Spleen, dries dampness"}, {"herb": "Fu Ling", "dosage": "9g", "role": "Assistant", "purpose": "Drains dampness, strengthens Spleen"}, {"herb": "Zhi Gan Cao", "dosage": "6g", "role": "Envoy", "purpose": "Harmonizes, tonifies Qi"} ``` Although the skill describes itself as an acupressure guide, `references/acupoints.json:17-19` includes invasive acupuncture instructions: ```json "needling": "0.5-1.0 cun perpendicular insertion", "moxibustion": "Contraindicated in pregnancy", "contraindications": ["PREGNANCY - STRONG CONTRAINDICATION", "Do not use during pregnancy"], ``` A particularly hazardous example appears in `references/acupoints.json:354-357`: ```json "needling": "0.5-0.8 cun toward opposite eye", "moxibustion": "Applicable", "contraindications": ["Deep insertion contraindicated - risk to brainstem"], "safety_tags": ["caution_deep_insertion", "wind_expelling"], ...[truncated 2569 chars]
- Remediation
- ## Remediation Suggestions 1. Remove all `dosage`, `preparation`, and `needling` fields from reference data available to the agent. 2. Restrict the acupoint module to non-invasive acupressure. Replace needle depths and directions with safe external-pressure guidance, including pressure intensity, maximum duration, skin-integrity precautions, and stop conditions. 3. If professional reference data must be retained, place it in a separate dataset that the user-facing skill cannot access. 4. Enforce an allowlisted output schema that excludes exact doses, formula quantities, needle insertion depths, insertion directions, and individualized treatment plans. 5. Add deterministic refusal logic for requests involving self-needling, herb dosing, formula preparation, labor induction, or invasive procedures. 6. Add automated tests asserting that responses never reveal prohibited fields, even when users explicitly request them or quote part of the underlying data. 7. Require prominent escalation to a licensed healthcare professional for pregnancy, medication interactions, liver disease, severe symptoms, or any invasive procedure. 8. Validate all reference data against the declared capability boundaries during build or publication so that future content cannot silently reintroduce prohibited instructions.