Automated Soap Note Generator

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 5:13 AM UTC
• Version: 0.1.0

Overview

This skill is a local SOAP note drafting helper that handles sensitive medical text, but its behavior is disclosed, purpose-aligned, and does not show hidden data access, exfiltration, persistence, or destructive actions.

Install only if you understand that this is a drafting aid for clinician review, not a diagnostic or prescribing tool. Do not process identifiable patient information unless your environment is HIPAA-compliant, and avoid JSON output or shared folders if raw transcripts should not be persisted. Remove or review the unnecessary requirements.txt entries before running pip install -r requirements.txt.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unnecessary Unpinned Standard-Library Backport Dependencies

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1-2
Vulnerability Type: Unnecessary and unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code

text

dataclasses
enum

The project documentation states that Python 3.7 or later is required and that no external packages are needed:

bash

# Python 3.7+
# No external packages required (uses standard library)

Technical Analysis

Both dataclasses and enum are part of the Python standard library in the project's stated Python 3.7+ environment. The implementation imports these standard-library modules and does not require separately installed packages with these names.

Nevertheless, a conventional installation command such as pip install -r requirements.txt instructs pip to retrieve unpinned third-party distributions. No exact versions, package hashes, or trusted package index are specified. This creates an unnecessary supply-chain execution path and contradicts the documented dependency model.

Python packages may execute build or installation logic during installation. Consequently, compromise of an upstream distribution, unsafe package resolution, or use of an untrusted package index could result in arbitrary code execution under the account running pip.

Attack Path

1. A user or automated deployment pipeline runs:

   bash

   pip install -r requirements.txt
   

2. pip resolves the unpinned dataclasses and enum package names through its configured package indexes.

3. Third-party package artifacts are downloaded even though the runtime already provides the required modules.

4. Package build or installation code executes with the privileges of the user or service performing installation.

5. If a resolved distribution or configured index is compromised, malicious installation code could read accessible data, modify the environment, install persistence, or tamper with project files.

Exploitation depends on compromise or manipulation ...[truncated 747 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove both entries from requirements.txt, because Python 3.7+ already supplies dataclasses and enum.

2. Delete requirements.txt or leave it empty if the project has no external runtime dependencies.

3. Keep the documented minimum Python version aligned with the implementation and dependency manifest.

4. If support for an older Python version is intentionally introduced, use explicitly audited backports with exact version pins and cryptographic hashes.

5. Install dependencies only from an approved index and use hash-enforced installation where third-party packages are genuinely necessary, for example:

   bash

   pip install --require-hashes -r requirements.txt
   

6. Add an automated dependency-manifest check to prevent standard-library modules or unpinned packages from being added inadvertently.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file contains realistic, condition-specific treatment plans, medication regimens, dosing, and follow-up instructions presented as exemplary SOAP outputs, but the file itself does not include a clear in-file warning that these examples are illustrative only and not medical advice. In a clinical documentation skill, such examples can be copied, over-trusted, or surfaced out of context, increasing the risk that users treat them as prescriptive guidance rather than draft-formatting examples.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This reference file provides clinical abbreviations, symptoms, medications, diagnostic terms, and treatment language without any inline disclaimer that it is informational support content only. In a medical documentation skill, that omission can encourage over-reliance on the reference and make users more likely to treat generated content as authoritative clinical guidance, increasing risk of inaccurate charting or inappropriate downstream care decisions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script reads potentially sensitive clinical text from files and can write generated SOAP notes, including raw input and extracted entities, directly to disk without any safeguards, warning, consent prompt, or secure-handling controls. In a healthcare context this materially increases the risk of PHI exposure through insecure file locations, accidental persistence, backups, shared systems, or downstream copying of unredacted notes.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The markdown states the tool is 'optimized for English; limited support for other languages,' which is a natural-language locale constraint. While this may be technically true, the file does not present it as a user choice or clearly justify the restriction as a region-specific compliance requirement.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The security checklist states 'No unauthorized file system access' and presents file-path validation and sanitized handling as settled properties, while elsewhere the document describes creating multiple output files and retaining original input material. That is not inherently unsafe, but the checklist wording overstates the actual behavior and can mislead reviewers about the extent of local data persistence.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 60% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

dataclasses
enum

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 60% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

dataclasses
enum