Clinic Visit Prep

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:22 AM UTC
• Version: 1.0.0

Overview

This clinic-visit preparation skill includes extra local file-auditing and secret-scanning code that is not clearly explained by its medical-prep purpose.

Review this before installing because it contains more local scanning code than its clinic-visit description suggests. Use it only on files you intentionally provide, avoid pointing it at private directories or source repositories, and keep output paths explicit. It does not provide medical diagnosis and should only be used to organize notes for discussion with a clinician.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: 声明描述的是一个医疗场景下的患者就诊前信息整理工具，不做诊断；但代码本身没有任何医疗领域专属逻辑，也没有围绕患者问题、既往病史、检查清单或时间线进行特定处理。相反，它通过读取 resources/spec.json 决定运行模式，执行的是通用审计/扫描/报表任务：可扫描目录中文本文件、提取 Markdown 标题、统计扩展名、读取 CSV 字段、用正则查找危险命令和疑似凭证、检查 Skill 目录必需文件与 SKILL.md frontmatter。这些能力与“患者就诊准备”这一声明主用途明显不一致，且引入了未声明的代码审计/安全扫描/规范检查能力。因此应判定为描述与实际行为存在实质性不匹配。

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The script supports generic directory auditing and CSV analysis that can be pointed at arbitrary filesystem content, not just clinic-visit materials. This scope mismatch is dangerous because users or higher-level agents may grant access based on the healthcare description while the code can inventory unrelated local data and summarize it.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The code implements pattern-based source scanning for secrets, shell-dangerous constructs, and private URLs, which is materially outside the declared clinic-visit preparation purpose. In a healthcare-facing skill, this creates unjustified capability to inspect arbitrary local files and repositories, increasing the chance of sensitive data exposure and misuse of the skill as a generic security auditing tool.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: Secret-scanning and source-code auditing capability is context-inappropriate for a clinic-visit prep skill and enables inspection of potentially sensitive repository or system content. In a healthcare context, this is especially risky because the skill may be trusted with PHI-adjacent workflows while actually possessing functionality that can enumerate secrets or private internal paths from arbitrary files.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The file title and all user-facing documentation are written in Chinese, and there is no indication that users may choose another language or that the skill is intentionally restricted to a Chinese-speaking or region-specific context. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: This file presents all user-facing content in Chinese, and there is no indication that the skill offers language selection or that it is intentionally limited to a Chinese-speaking region or compliance context. Under the policy rule, forcing a specific language without user opt-in can be a natural-language policy violation.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill advertises executable capability via `python3` and references local input/output files, but it does not declare any explicit tool scope such as allowed tools or permissions. This creates an authorization ambiguity where an agent may permit shell and file operations broader than the user would expect from a healthcare intake/prep skill, increasing the chance of unintended local file access or modification.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The skill title and core role description are written as fixed Chinese-language instructions, with no indication that the user may choose another language or locale. This creates a natural-language policy issue because the skill appears to impose a specific language by default rather than offering user opt-in or a language choice.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: This code generates user-facing report text entirely in Chinese, including headings, prompts, and next-step guidance. The file does not offer user opt-in for language selection or indicate that the skill is intentionally region-specific, which makes it a natural-language locale policy concern.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill_audit logic validates arbitrary skill/project structure and parses project metadata, which has no clear relationship to helping a patient prepare for a clinic visit. This broadens the operational surface of the skill and can be used to inspect unrelated local project directories under a misleading healthcare-oriented identity.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The CLI presents itself as a local support script for the skill, but the implemented operations are broad code, directory, and security-style audits unrelated to the declared patient-prep purpose. This misleading interface increases the risk of over-trust and inappropriate invocation in environments containing sensitive local data.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: This markdown file contains user-facing natural language exclusively in Chinese, including the title, steps, and pass criteria. Under the policy, forcing a specific language without user opt-in or a documented justification is a natural-language policy violation.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: The file is entirely written in Chinese and includes Chinese-only output expectations such as using clear headings and structured results, but it does not indicate that language selection is optional or user-driven. Under the policy rule, a fixed language or locale without opt-in can be a natural-language policy concern unless clearly justified as region-specific.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: The markdown content, including the title and all section headings, is entirely in Chinese, but the file does not indicate that Chinese is optional, user-selected, or required for a region-specific context. Under the language/locale policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Natural-Language Policy Violations

Low

• Confidence: 92% confidence
• Finding: The file’s natural-language content is entirely in Chinese, and there is no indication that users can choose another language or that the template is intentionally restricted to a Chinese-speaking context. Under the policy, forcing a specific language without user opt-in can be a locale-policy violation.

Static analysis

No suspicious patterns detected.