Medication Adherence Message Gen

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:47 AM UTC
• Version: 1.0.0

Overview

The package is not malware, but it needs Review because it labels itself as academic writing while generating persuasive patient-facing medication reminders with unsupported medical claims.

Install only after the publisher narrows the description and activation guidance to medication reminder drafting, removes unsupported statistics and categorical dosing claims, and adds clear requirements for clinician/human review before any patient-facing use. Use an isolated environment and avoid installing the unnecessary unpinned dependencies.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned and Unnecessary Third-Party Dependencies

Content

View full analysis

Remediation

View remediation

other

Error

• Location: scripts/main.py:213

Finding

Unsupported Medical Claims in Patient-Facing Reminder Messages

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill metadata and top-level description present the tool as suitable for academic writing workflows, while the body of the skill clearly implements patient-facing medication reminder generation using behavioral persuasion techniques. This mismatch can cause improper invocation, bypass expected review boundaries, and lead users or agents to apply a health-influencing tool in contexts where medical, safety, or compliance review would otherwise be required.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · scripts/main.py (reported line 116)May include surrounding context.

python

],
        Tone.URGENT: [
            "[Execute immediately] {greeting}{time_prompt} Immediately execute your medication plan! If {time}, then {action} must be performed immediately!",
        ]
    },
    Principle.REWARD: {
        Tone.GENTLE: [
            "[{medication} reminder] {greeting}{time_prompt} please {action}. After taking the medicine, you can drink a cup of tea of ​​your choice. This is a reward for being responsible for yourself.",
            "[Health Reward] {greeting} Complete today's medication, and you will be one step closer to recovery! {time_prompt} Please {action} to give yourself a affirmation.",
            "[Small luck] {greeting}{time_prompt} please {action}. Give yourself a small reward when you're done, you deserve it!"
        ],
        Tone.FIRM: [
            "【Instant Feedback】{greeting}{time_prompt} please {action}. Every pill is the fuel for your body’s recovery, so you can realize this health immediately!",

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest and introductory sections describe two contradictory purposes: academic writing workflow support and generation of medication adherence reminders. Contradictory documentation is dangerous because downstream systems, reviewers, or orchestration logic may classify the skill incorrectly, reducing scrutiny for health-related persuasive content and increasing the chance of unsafe deployment.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation guidance is broad and inconsistent, encouraging use for generic academic-writing tasks even though the implemented capability is specialized generation of patient medication reminders. Over-broad trigger conditions increase the chance that an agent selects this skill in inappropriate contexts, exposing users to manipulative health messaging or outputs outside intended governance.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill generates patient-facing health-related reminder messages and explicitly uses behavioral persuasion methods, but it does not prominently warn users about the health, ethical, and compliance implications of such content. Without clear warning and limitations, users may treat the output as routine copy generation rather than sensitive health communication that may require clinical, legal, or policy review.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This JSON audit/result file includes natural-language skill-use labels such as "Use medication adherence message gen for academic writing workflows..." that read like activation guidance, but they do not define clear trigger phrases, exclusions, or invocation boundaries. In a manifest/config-like file, this kind of broad wording can overlap with ordinary requests about academic writing and create ambiguity about when the skill should or should not be invoked.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The label says "Use this skill for academic writing tasks that require explicit assumptions, bounded scope, and a reproducible output format," which is still a wide class of common tasks rather than a specific trigger. Because the file is JSON and SQP-1 applies to manifest-style files, this broad phrasing qualifies as a vague activation description without explicit constraints or exclusions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The generator defaults the language parameter to Language.ZH, which means users receive Chinese content unless they explicitly override it. This is a natural-language locale policy concern because the skill imposes a specific language by default rather than first obtaining the user's language preference.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The command-line interface sets --language to zh by default, causing the tool to generate Chinese reminders even when no language preference was provided. Forcing a locale in user-facing text without opt-in matches the policy's language/locale violation criteria.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 60% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

dataclasses
enum

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 60% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

dataclasses
enum

Static analysis

No suspicious patterns detected.