ClawHub
Back to skill

Security audit

Medical Report Query

Security checks across malware telemetry and agentic risk

Overview

This is not malware, but it is a medical database reporting skill with broad triggers and unclear controls for sensitive healthcare data.

Install only in an approved healthcare reporting environment. Use a dedicated read-only database account, restrict schemas and tables, require explicit user confirmation before any database query or export, and de-identify patient or insurance data before displaying, saving, or sharing reports.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger words are broad, generic terms such as 報表, 查詢, 門診, 住院, 藥品, 醫保, and 統計 that are common in ordinary healthcare operations. In an environment with access to medical databases, this can cause accidental invocation during normal conversation and lead to unintended querying or exposure of sensitive operational or patient-related data.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal