ClawHub
Back to skill

Security audit

Chinese Medicine

Security checks for vulnerabilities and agentic risk

Overview

The skill is a Chinese medicine wellness guide, but its reference data includes exact herbal dosages and invasive needling details that conflict with its stated safety limits.

Review this skill carefully before installing. It appears non-executable and not designed to access your system, but it may expose detailed herbal dosing, formula quantities, moxibustion, pregnancy-sensitive points, and acupuncture needling information despite saying it is educational and non-prescriptive. It should only be used with strong guardrails that prevent dosage, self-needling, labor-induction, or individualized treatment instructions from being given to users.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:23
Finding

Actionable Herbal Dosage and Invasive Needling Data Bypass Declared Safety Boundaries

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:23-26; references/herbs_db.json:15-16; references/formulas.json:12-15; references/acupoints.json:17-19, 354-357
Vulnerability Type: Safety-boundary mismatch in skill configuration and reference data
Risk Level: High

Vulnerable Code Snippets

SKILL.md:23-26 declares that dosage recommendations are prohibited:

markdown
### What You CANNOT Do
- Diagnose medical conditions or diseases
- Prescribe specific treatment plans or dosages
- Recommend stopping or replacing prescribed medications

However, references/herbs_db.json:15-16 provides an exact dose and preparation method:

json
"dosage": "3-9g",
"preparation": "Decoction added near end; can be taken as powder",

references/formulas.json:12-15 exposes exact quantities for a multi-herb formula:

json
{"herb": "Ren Shen", "dosage": "9g", "role": "Chief", "purpose": "Powerfully tonifies Spleen and Stomach Qi"},
{"herb": "Bai Zhu", "dosage": "9g", "role": "Deputy", "purpose": "Strengthens Spleen, dries dampness"},
{"herb": "Fu Ling", "dosage": "9g", "role": "Assistant", "purpose": "Drains dampness, strengthens Spleen"},
{"herb": "Zhi Gan Cao", "dosage": "6g", "role": "Envoy", "purpose": "Harmonizes, tonifies Qi"}

Although the skill describes itself as an acupressure guide, references/acupoints.json:17-19 includes invasive acupuncture instructions:

json
"needling": "0.5-1.0 cun perpendicular insertion",
"moxibustion": "Contraindicated in pregnancy",
"contraindications": ["PREGNANCY - STRONG CONTRAINDICATION", "Do not use during pregnancy"],

A particularly hazardous example appears in references/acupoints.json:354-357:

json
"needling": "0.5-0.8 cun toward opposite eye",
"moxibustion": "Applicable",
"contraindications": ["Deep insertion contraindicated - risk to brainstem"],
"safety_tags": ["caution_deep_insertion", "wind_expelling"],

...[truncated 2569 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove all dosage, preparation, and needling fields from reference data available to the agent.
  2. Restrict the acupoint module to non-invasive acupressure. Replace needle depths and directions with safe external-pressure guidance, including pressure intensity, maximum duration, skin-integrity precautions, and stop conditions.
  3. If professional reference data must be retained, place it in a separate dataset that the user-facing skill cannot access.
  4. Enforce an allowlisted output schema that excludes exact doses, formula quantities, needle insertion depths, insertion directions, and individualized treatment plans.
  5. Add deterministic refusal logic for requests involving self-needling, herb dosing, formula preparation, labor induction, or invasive procedures.
  6. Add automated tests asserting that responses never reveal prohibited fields, even when users explicitly request them or quote part of the underlying data.
  7. Require prominent escalation to a licensed healthcare professional for pregnancy, medication interactions, liver disease, severe symptoms, or any invasive procedure.
  8. Validate all reference data against the declared capability boundaries during build or publication so that future content cannot silently reintroduce prohibited instructions.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

This JSON embeds parallel Chinese-specific fields such as name_cn and name_pinyin, and similar Chinese-language content appears throughout the dataset. Because the file provides locale-specific content but does not document any user language selection or opt-in behavior, it may contribute to a skill experience that assumes a specific locale without explicit user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

This JSON contains user-facing natural-language fields in both Chinese and English, including classical Chinese verse and warnings, but does not indicate how a consuming skill should choose language based on user preference. Under the stated policy, forcing or assuming a language/locale without opt-in can be a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

This JSON embeds Chinese-language names and source citations alongside English fields, but provides no indication that language or locale is selectable or intentionally fixed. Because SQP-3 applies to all file types and covers language/locale policy concerns, this can be flagged as a mild locale constraint issue in the natural-language content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

This JSON consistently encodes herb categories, functions, indications, and safety concepts using Chinese and traditional Chinese medicine terminology such as Chinese names, pinyin, meridians, Qi, Yin, and Shen. Because the file provides no indication that users can opt into this language/terminology or choose an alternative locale/framework, it may force a specific language or locale context.

Content

No source excerpt is available for this finding.