tcm-jingfang

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:53 AM UTC
• Version: 1.0.1

Overview

This skill has no code-execution or persistence behavior, but it needs review because it can give high-risk medical prescription guidance, including toxic-herb doses and unsupported serious-disease claims.

Install only if you want a Chinese-language TCM study/reference aid and will not treat its outputs as medical prescriptions. Users should not self-administer formulas or toxic herbs from this skill, should not use it for cancer, bleeding, pregnancy, children, older adults, severe symptoms, or chronic disease management, and should consult licensed medical professionals for real health decisions.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: references/herb-database.md:83

Finding

Exact Dosage Guidance for Toxic Medicines Contradicts the Skill's Mandatory Safety Controls

Content

View full analysis

Vulnerability Details

File Location: references/herb-database.md:83; related control and output instructions at SKILL.md:167 and SKILL.md:177
Vulnerability Type: Unsafe generation of actionable medical dosage instructions
Risk Level: High
Category: T09: Insecure Skill Coding Practices

Vulnerable Content

The following is a faithful English translation of the relevant source content:

markdown

### Aconite — Primary medicine for restoring depleted yang
- Effects: Restores yang in collapse, supplements fire and assists yang, disperses cold, and relieves pain
- Usage perspective:
  - A core medicine in yang-supporting practice
  - Considered indispensable in formulas such as Sini Decoction
  - Combined with dried ginger as a classic treatment for restoring yang
- Warning: Toxic; it must be decocted first for 30–60 minutes and used according to medical advice
- Common dosage: 3–15 grams, decocted first

The conflicting Skill instructions are:

markdown

Prescription output:
Symptoms → pattern classification → formula and source → composition and dosage
→ modification rationale → administration precautions

Toxic medicines, including aconite, monkshood, pinellia, asarum, ephedra,
and rhubarb, must be described only as "follow medical advice," "decoct
first," or "use cautiously"; exact harmful dosages must not be provided.

Additional exact dosage ranges for medicines identified by the Skill as toxic appear in references/formulas-259.md:158-176, including:

markdown

Ephedra: 3–10 grams
Rhubarb: 3–10 grams
Aconite: 3–15 grams, decocted first
Pinellia: 6–10 grams

Technical Analysis

SKILL.md:167 directs the agent to produce individualized formula compositions and dosages. It also directs the agent to consult the bundled herb and formula references. However, SKILL.md:177 expressly prohibits exact dosing for toxic medicines.

The referenced k ...[truncated 2559 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all exact doses and preparation instructions for toxic or prescription-sensitive medicines from every bundled reference, including references/herb-database.md and references/formulas-259.md.
2. Replace prohibited dosage fields with a fixed statement requiring evaluation and dosing by a licensed clinician.
3. Change SKILL.md:167 so the Skill provides historical or educational formula descriptions rather than individualized prescriptions.
4. Add a deterministic output-validation rule that blocks numeric doses, administration frequency, pill counts, and preparation instructions for toxic medicines.
5. Maintain a centralized restricted-medicine list instead of duplicating safety rules across files.
6. Add tests covering direct requests, formula lookups, paraphrased requests, and attempts to obtain toxic dosages through reference queries.
7. Require immediate referral for emergency symptoms and clinician consultation for vulnerable populations, possible interactions, or serious underlying disease.
8. Review other actionable directions, including the unspecified “30 pills twice daily” instruction in references/hantang-100.md:153, and remove instructions lacking composition, strength, contraindications, and professional oversight.
9. Treat disclaimers only as supplemental notices; they must not substitute for enforcing the prohibition at the content and output layers.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (11)

Natural-Language Policy Violations

Critical

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The passage asserts that retained or reverse-flow breast milk causes lupus, lung cancer, leukemia, and breast cancer, which are unsupported and dangerous medical claims. In a skill explicitly designed to recommend formulas from symptoms, such misinformation can mislead users about cancer causation and treatment, potentially causing delayed diagnosis, refusal of evidence-based care, or harmful self-treatment.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This file is a condition-to-remedy reference that maps symptoms and diseases directly to named formulas, including serious conditions such as diabetes, cancer, stroke, glaucoma, and gastric bleeding. Although the broader skill metadata contains a disclaimer, this file itself functions as actionable medical guidance and could be surfaced to users without adequate safety framing, creating a meaningful risk of self-diagnosis, delayed care, or unsafe self-medication.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This file provides detailed symptom-to-formula mappings, treatment selection logic, and medication recommendations, including named prescriptions for specific presentations, without embedding an in-file safety warning near the guidance itself. In a skill explicitly intended to help users obtain prescription-style advice from symptoms, this materially increases the chance of unsafe self-diagnosis, inappropriate treatment, delayed real medical care, and harm to vulnerable users such as pregnant people or those with serious underlying conditions.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This file contains extensive diagnosis and prescribing logic, dosage guidance, and disease-treatment claims, but the file itself does not present a clear user-facing safety warning or escalation guidance. In a skill designed to turn symptoms into herbal recommendations, absence of an in-file warning increases the chance that downstream prompts or generated answers provide actionable medical advice without directing users to licensed care, which can lead to delayed treatment, contraindications, or harm.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The usage scenarios and keyword list define activation boundaries too loosely, relying on common disease-treatment and medication language that overlaps with ordinary medical queries. Because this skill is designed to move from symptoms directly to herbal prescriptions, ambiguous triggering raises the chance of unsolicited or mis-scoped medical guidance, especially for users who did not intend to invoke this specialized modality.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger includes broad phrasing like asking what medicine to take for an illness, which can cause the skill to activate on generic health conversations rather than explicit requests for this specific TCM prescribing workflow. In a medical-adjacent skill, unintended invocation is more dangerous because it may steer users into receiving quasi-prescriptive drug or herbal guidance without clear intent or sufficient context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file provides direct symptom-to-formula lookup guidance immediately under the usage instructions, which can encourage users to self-diagnose and self-medicate before seeing any strong safety warning. Although a disclaimer exists elsewhere in the skill, it is not prominent at the point of use, and the content includes specific formulas and dosage ranges for potentially toxic herbs, increasing the chance of harmful misuse.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

All headings and instructional content are written exclusively in Chinese, and line 148 indicates the quotations are '用于回答时引用', implying responses should be generated from this material in Chinese. The file does not offer a user language choice or explain a necessary locale-specific restriction, which can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The description states a fixed response style associated with "倪师风格：直接、犀利、不讲废话," which imposes a particular linguistic/tone policy rather than offering user choice. The policy criteria call for flagging language or locale constraints when they are forced without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The title and all instructional/reference content in this skill file are presented exclusively in Chinese, with no indication that users may choose another language. Under the policy rule for language/locale, this is a natural-language constraint that should be either optional or explicitly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 74% confidence

Finding

The entire skill reference is written only in Chinese and is positioned as part of the skill's operational knowledge base, but the file does not state that the skill is intentionally Chinese-only or offer any language-choice mechanism. Under the policy, forcing a specific language without user opt-in can be a natural-language policy concern.

Content

No source excerpt is available for this finding.