ClawHub
Back to skill

Security audit

Medical Email Polisher

Security checks across malware telemetry and agentic risk

Overview

This is a small local email-polishing skill, but users should not treat its medical or HIPAA wording as compliance or clinical guidance.

Reasonable to install as a drafting aid. Use it only to polish wording you provide, avoid unnecessary patient identifiers or confidential details, and have a qualified person review patient-facing or compliance-sensitive emails before sending.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The audit records a real scope-control failure in the stress scenario, meaning the skill can produce outputs beyond its declared email-polishing purpose under pressure. In a medical-correspondence context, scope drift can lead to unsupported interpretation, advice, or content transformation that exceeds safe administrative editing and may mislead users.

Vague Triggers

Medium
Confidence
80% confidence
Finding
An overly broad invocation description increases the chance the skill will be used for tasks outside its intended medical-email polishing role, especially where users ask for assumptions, bounded outputs, or academic-style writing transformations. In this context, broad triggering can route sensitive medical communications into workflows that may rewrite meaning, add unsupported framing, or bypass appropriate human review.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill handles medical correspondence but the description lacks explicit warning about sensitive medical content, privacy expectations, and limits on handling regulated or confidential information. That omission can cause users to submit PHI or other sensitive details without adequate caution, increasing the risk of inappropriate disclosure, retention, or unsafe transformation of medical communications.

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.