Back to skill

Security audit

Lab Result Interpretation

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent lab-result explainer, but it has review-worthy safety and scoping gaps around critical medical values and file access.

Review before installing or using for real medical decisions. Do not rely on this skill to identify urgent or critical lab values until critical thresholds are loaded and tested, and only process files you explicitly choose in an isolated workspace. A clinician or qualified healthcare provider should interpret any concerning results.

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

other

Error
Location
scripts/main.py:165
Finding

Critical laboratory values are never classified or escalated

Content
View full analysis
tuple: """Determine status and severity of a result.""" if result.reference_min is None or result.reference_max is None: return "unknown", "none" value = result.value min_val = result.reference_min max_val = result.reference_max if min_val <= value <= max_val: return "normal", "none" # Calculate deviation percentage if value < min_val: deviation = (min_val - value) / min_val if min_val > 0 else 0 if deviation > 0.5: return "low", "severe" elif deviation > 0.2: return "low", "moderate" else: return "low", "mild" else: # value > max_val deviation = (value - max_val) / max_val if max_val > 0 else 0 if deviation > 0.5: return "high", "severe" elif deviation > 0.2: return "high", "moderate" else: return "high", "mild" ``` ```python def format_output(self, results: List[LabResult]) -> str: """Format results as patient-friendly output.""" if not results: return "No valid lab results could be recognized. Please check the input format." output_lines = ["=== Lab Result Interpretation ===\n"] for r in results: # Status emoji status_emoji = { "normal": "✅", "low": "⚠️", "high": "⚠️", "critical": "🚨", "unknown": "❓" }.get(r.status, "❓") # Status text status_text = { "normal": "Normal", "low": "Low", "high": "High", "critical": "Critical", "unknown": "Unknown" }.get(r.status, "Unknown") ref_range = "" if r.reference_ ...[truncated 2612 chars]
Remediation
View remediation
= critical_high: return "critical", "critical" ``` 4. Generate a “Critical Findings Summary” before the per-test breakdown whenever any critical result exists. 5. Include an explicit instruction to seek immediate professional medical attention for critical values. 6. Sort results by status so critical findings appear first. 7. Do not silently infer critical thresholds for tests where no validated threshold is available. 8. Add unit-aware validation so thresholds are never compared against values expressed in incompatible units. 9. Add automated boundary tests for values immediately below, equal to, and immediately above every critical threshold. 10. Clarify that laboratory-specific ranges and clinician review take precedence over packaged defaults. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/main.py:397
Finding

Unrestricted file path permits access outside the documented workspace boundary

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
requirements.txt:1
Finding

Unnecessary unpinned dependency creates avoidable supply-chain exposure

Content
View full analysis
Remediation
View remediation
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill documents file-processing behavior (--file lab_report.txt) and even mentions rejecting ../ paths, which implies file read capability, but it declares no explicit tool/permission scope. Without an allowlisted scope, an agent or runtime may grant broader-than-expected file access, increasing the chance of unintended reading of sensitive local files such as medical reports or unrelated workspace data.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The audit report contains an internal contradiction: it states the skill does not generate clinical or diagnostic decision outputs, while elsewhere documenting severity classification and urgent-care recommendations for critical values. In a medical context, this mismatch is dangerous because it can cause downstream reviewers, deployment systems, or policy gates to under-classify the skill’s clinical risk and approve it without the safeguards appropriate for triage-like behavior.

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The tool hardcodes its disclaimer text in English, and the surrounding user-facing interface and explanations are also defined only in English despite comments indicating Chinese/English input normalization. This imposes a specific output language without user opt-in or a documented locale constraint, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
60% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
dataclasses

Static analysis

No suspicious patterns detected.