Digital Twin Discharge Drafter

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:45 AM UTC
• Version: 0.1.0

Overview

This skill is not malware, but it should be reviewed carefully because it claims to generate medical digital-twin predictions without real model validation and asks for broader agent permissions than it appears to need.

Install only after review if you can confine its permissions, pin or remove dependencies, and ensure it is used in an approved clinical environment with PHI controls and clinician review. Treat current predictions as demonstration heuristics, not validated medical guidance.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:4

Finding

Excessive Agent Tool Permissions Violate Least Privilege

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:4
Vulnerability Type: Excessive tool permissions
Risk Level: Medium

Vulnerable configuration:

yaml

allowed-tools: "Read Write Bash Edit"

Technical Analysis

The skill requests unrestricted Read, Write, Bash, and Edit capabilities even though its implemented functionality only performs deterministic data formatting and prints CLI status. In particular, no legitimate operation in scripts/main.py requires shell command execution or modification of existing project files.

Granting Bash and Edit expands the agent's authority beyond the task's functional requirements. If attacker-controlled content, a malicious patient record, or a later prompt successfully influences the agent, these capabilities could be used to run local commands or modify files accessible to the agent. This is a least-privilege violation rather than evidence that the current script itself executes malicious commands.

Attack Path

1. A user loads the skill, causing the agent to receive all declared tool permissions.
2. The agent processes attacker-controlled instructions or untrusted clinical content.
3. The malicious content induces the agent to invoke Bash, Write, or Edit.
4. Commands execute or files are modified under the privileges of the agent process.
5. The resulting scope depends on the filesystem access and operating-system privileges granted to that process.

Impact Assessment

Successful exploitation could permit command execution and arbitrary modification of files available to the agent. It could affect project files and other writable locations in the runtime environment. This declaration does not independently provide operating-system privilege escalation, and no direct exploitation mechanism is implemented in the audited Python code.

Remediation

View remediation

Remediation Suggestions

• Remove Bash and Edit from allowed-tools.
• Grant Read only for explicitly required templates and reference data.
• If document export is implemented, grant Write only for a dedicated output directory.
• Enforce path allowlists and reject traversal outside the designated workspace.
• Require explicit user confirmation before overwriting an existing discharge document.
• Treat patient records and reference documents as untrusted data rather than executable instructions.

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned and Ambiguously Named Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1-2
Vulnerability Type: Dependency confusion and non-reproducible dependency resolution
Risk Level: Medium

Vulnerable dependency manifest:

text

dataclasses
dateutil

Technical Analysis

Both dependencies are specified without version constraints or integrity hashes. Consequently, installation can resolve to different package contents over time.

The source imports from the dateutil namespace, but the commonly used PyPI distribution providing that namespace is python-dateutil. Declaring dateutil instead creates ambiguity and increases the chance of installing an unintended distribution. Package installation can execute build or installation logic, so resolving an unintended or compromised package may execute third-party code before the application starts.

The dateutil import is unused in the audited implementation. The dataclasses package is also unnecessary on supported modern Python versions because dataclasses is part of the standard library.

Attack Path

1. An operator runs pip install -r requirements.txt.
2. The package manager resolves the unpinned names against the configured package index.
3. The ambiguous dateutil name may resolve to an unintended distribution, or an unpinned package version may have changed since review.
4. Package build or installation hooks execute with the privileges of the installer.
5. A malicious dependency could modify the environment, access data available to the installation process, or install additional payloads.

Impact Assessment

Exploitation could result in code execution with the privileges used to install dependencies. In a privileged system-wide installation or CI environment, the affected scope could include the build workspace, environment credentials, and writable system paths. No evidence was found that either dependency is currently malicious; the confirmed issue ...[truncated 46 chars]

Remediation

View remediation

Remediation Suggestions

• Remove both dependencies if the current implementation remains unchanged.
• Remove the unused dateutil.parser import from scripts/main.py.
• If date parsing becomes necessary, declare the correct distribution using an exact reviewed version, such as python-dateutil==<reviewed-version>.
• Generate a lock file containing transitive dependency versions and cryptographic hashes.
• Install packages with hash verification, for example through pip install --require-hashes.
• Restrict installation to trusted package indexes and prevent fallback to unapproved public indexes.
• Run dependency installation in an isolated, unprivileged build environment.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/main.py:46

Finding

Clinical Predictions Are Generated Without Loading or Validating a Digital-Twin Model

Content

View full analysis

Vulnerability Details

File Location: scripts/main.py:46-48, 98-131
Vulnerability Type: Unvalidated and misleading safety-critical prediction logic
Risk Level: High

Vulnerable code:

python

def _load_model(self, model_path: Optional[str]):
    """Load digital twin model"""
    return {}

python

def _calculate_risk(self, model: Dict) -> float:
    """Calculate readmission risk using digital twin"""
    return model.get("readmission_risk", 0.15)

def simulate_outcomes(self, patient_model: Dict, scenarios: List[str],
                     timeframe: str = "30_days") -> Dict[str, Any]:
    """Simulate post-discharge outcomes for different scenarios"""
    results = {}
    for scenario in scenarios:
        results[scenario] = {
            "readmission_risk": self._scenario_risk(patient_model, scenario),
            "recovery_time": self._estimate_recovery(patient_model, scenario),
            "cost_impact": self._estimate_cost(patient_model, scenario)
        }
    return results

def _scenario_risk(self, model: Dict, scenario: str) -> float:
    """Calculate risk for specific scenario"""
    base_risk = model.get("readmission_risk", 0.15)
    if "non_adherent" in scenario:
        return min(base_risk * 3, 0.50)
    elif "optimal" in scenario:
        return base_risk * 0.5
    return base_risk

def _estimate_recovery(self, model: Dict, scenario: str) -> int:
    """Estimate recovery time in days"""
    base_days = 14
    if "non_adherent" in scenario:
        return base_days * 2
    elif "optimal" in scenario:
        return int(base_days * 0.8)
    return base_days

def _estimate_cost(self, model: Dict, scenario: str) -> int:
    """Estimate cost impact"""
    base_cost = 5000
    if "non_adherent" in scenario:
        return base_cost + 8500
    elif "optimal" in scenario:
        return base_cost
    return base_cost + 20
...[truncated 2104 chars]

Remediation

View remediation

Remediation Suggestions

• Do not label the current calculations as digital-twin or AI predictions; clearly mark them as demonstration-only heuristics.
• Fail closed when a model path is missing, unreadable, incompatible, or invalid instead of silently returning an empty model.
• Implement model loading only for an explicitly supported, reviewed format.
• Avoid unsafe model formats that permit arbitrary code execution during deserialization.
• Validate model provenance, integrity, version, required features, and calibration metadata.
• Validate all risk values as finite numeric probabilities within the range 0.0 to 1.0.
• Replace substring-based scenario handling with a strict enumeration of supported scenarios.
• Include confidence intervals, model limitations, data timestamps, and prediction provenance in generated output.
• Add tests for missing models, malformed values, out-of-range probabilities, unsupported scenarios, and incomplete patient records.
• Require qualified clinical review and explicit approval before any generated content is used for patient care.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/main.py (reported line 151)May include surrounding context.

python

"lifestyle_changes": self._lifestyle_recommendations(patient_profile),
            "access_support": self._address_barriers(access_barriers or [])
        }
        return instructions
    
    def _format_medications(self, profile: Dict) -> List[Dict]:
        """Format medication list"""

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill description is broad enough to trigger on routine discharge drafting, care transition, and readmission-reduction tasks even when no digital-twin workflow is intended. In a clinical context, this can cause over-invocation of AI-generated discharge content and predictive outputs in sensitive patient-care scenarios, increasing the chance of inappropriate reliance, unnecessary PHI exposure, or use outside validated scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill repeatedly instructs handling detailed patient records, admission data, hospital course, medication lists, and predictive outputs without any explicit privacy, minimum-necessary-use, or disclosure warning. Because this is healthcare content involving PHI, omission of privacy constraints materially raises the risk of unauthorized use, oversharing, or processing of sensitive data in inappropriate environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The post-discharge checklist describes automated follow-up calls and sharing information with pharmacies, primary care providers, and home health services without warning about consent, authorization, verification, or human review. In a healthcare setting, automating external communications based on AI-generated discharge artifacts can lead to privacy violations, misdirected disclosures, and patient-safety issues if information is incorrect or sent to the wrong party.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The top-level docstring says the skill provides 'AI-powered discharge summary generation using digital twin patient models,' and _calculate_risk says it calculates risk using a digital twin. In practice, the code mostly concatenates text from input dictionaries and returns defaults or fixed heuristics, which contradicts the stated implementation intent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest describes AI-enhanced discharge documentation and digital twin predictions, but _load_model returns an empty dict and the generation logic only copies or formats input fields. Risk scoring and scenario outputs are simple rule/default-based lookups rather than meaningful model-driven prediction, so the implemented behavior does not match the claimed AI/digital twin capability.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The generated patient-friendly discharge summary is hard-coded entirely in English, and the file provides no mechanism in this output path for user language choice or documented locale restriction. This can violate language/locale policy expectations because patient-facing medical instructions are forced to a single language without opt-in.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The dependency is unpinned, which makes builds non-reproducible and can allow unexpected or vulnerable package versions to be installed over time. In a healthcare-oriented discharge drafting skill, dependency drift is more concerning because reliability and supply-chain integrity matter for patient-facing documentation workflows, even though this file alone does not show active exploitation.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

dataclasses
dateutil

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency is unpinned, so future installations may pull different versions, including versions with newly introduced vulnerabilities or breaking changes. This is a supply-chain hygiene issue rather than direct malicious logic, but in a medical discharge-summary context it increases operational risk because unstable dependencies could affect patient instructions or downstream care-transition outputs.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

dataclasses
dateutil

Static analysis

No suspicious patterns detected.