ClawHub
Back to skill

Security audit

Healthcare Compliance

Security checks for vulnerabilities and agentic risk

Overview

This is a markdown-only healthcare compliance checklist skill with no executable behavior, but users should avoid sharing PHI or other regulated data unless authorized.

Use this skill for compliance structure and readiness checklists, but do not paste patient identifiers, PHI, breach evidence, contracts, credentials, or confidential regulated records unless you are authorized and the OpenClaw environment is approved for that data. Prefer sanitized summaries and least-necessary details.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README markets a healthcare compliance auditing skill that is likely to process highly sensitive information, including PHI, breach details, vendor contracts, and regulatory gaps, but it provides no warning or handling guidance for such data. This omission can lead users to paste regulated healthcare data into the tool without minimization, redaction, or authorization checks, increasing the risk of privacy violations and improper disclosure.

Content

No source excerpt is available for this finding.