T08 · Insecure Dependencies
Warning
- Location
requirements.txt:1- Finding
Unnecessary and Unpinned Third-Party Dependencies Create a Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
Security audit
Prior Authorization Letter Drafter
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to draft prior authorization letters, but it handles medical and insurance data with poorly scoped file writes and unsafe install instructions, so it needs review before use.
Install only after fixing or accepting the review risks: remove the unnecessary requirements, avoid entering real PHI unless running in an approved healthcare-compliant environment, and restrict input/output paths to a private workspace with no default overwrites.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/main.py:142- Finding
Unrestricted CLI Paths Permit Arbitrary File Reads and Overwrites Within Process Permissions
- Content
View full analysis
str: """Save the letter to a file.""" # Ensure output directory exists os.makedirs(os.path.dirname(output_path) if os.path.dirname(output_path) else '.', exist_ok=True) with open(output_path, 'w', encoding='utf-8') as f: f.write(letter_text) return output_path def generate_from_json(self, json_path: str, output_path: str) -> str: """Generate letter from JSON input file.""" with open(json_path, 'r', encoding='utf-8') as f: data = json.load(f) ``` `scripts/main.py:211-216`: ```python } with open(output_path, 'w', encoding='utf-8') as f: json.dump(sample_data, f, indent=2) return output_path ``` `scripts/main.py:247-263`: ```python if args.create_sample: path = create_sample_input(args.sample_output) print(f"Sample input file created: {path}") print("Edit this file with actual patient information and run again with --input") return 0 if not args.input: print("Error: --input is required (or use --create-sample to generate a template)") parser.print_help() return 1 if not os.path.exists(args.input): print(f"Error: Input file not found: {args.input}") return 1 try: generator = PriorAuthLetterGenerator() output_path = generator.generate_from_json(args.input, args.output) ``` ### Technical Analysis The user-controlled `--input`, `--output`, and `--sample-output` values are passed directly to filesystem operations. The implementation does not ...[truncated 3291 chars]- Remediation
View remediation
Path: workspace = workspace.resolve(strict=True) candidate = (workspace / raw_path).resolve(strict=False) if candidate != workspace and workspace not in candidate.parents: raise ValueError("Path is outside the approved workspace") return candidate ``` 3. Reject absolute paths when callers are expected to provide workspace-relative names. 4. Reject existing symlinks and check parent path components for symlinks. Where supported, use low-level open flags that prevent symlink following. 5. Do not overwrite files by default. Use exclusive creation, such as mode `x`, or require a separate explicit overwrite option after validating the target. 6. Separate input and output roots so an output cannot replace an input, configuration file, or executable. 7. Create healthcare-data outputs with restrictive permissions, such as owner-only access where supported. 8. Avoid printing full sensitive filesystem paths in logs exposed to untrusted users. 9. Validate input file type, maximum size, schema, and required fields before processing. 10. Add tests covering: - Absolute paths. - `../` traversal. - Symlinked input and output files. - Existing output files. - Paths outside the workspace. - Unwritable destinations. - Oversized or malformed JSON. ]]>
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill documents file read/write behavior and packaged script execution but does not declare any explicit tool scope such as allowed tools or permissions. In an agent ecosystem, that omission weakens policy enforcement and can let the skill operate with broader filesystem access than users or reviewers expect, especially when handling sensitive patient and insurance data.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest presents a narrowly scoped prior-authorization letter skill, but the documentation expands usage into generic academic writing workflows. That scope drift can cause an agent or user to apply the skill outside its reviewed medical-document context, increasing the chance of unsafe data handling, incorrect outputs, or bypass of domain-specific safeguards.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The usage and parameter sections describe structured patient-data inputs and a generated letter artifact, but the audit-ready command uses a narrative text string as --input. This is an active contradiction in the documentation about what the script accepts and how it is meant to be used.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill is designed to process PHI and insurance identifiers, including patient names, member IDs, diagnosis codes, and clinical justification, but it lacks explicit privacy, retention, and handling requirements. In a healthcare context this omission is especially dangerous because users may input regulated data without guidance on minimization, storage controls, redaction, or compliant execution environments.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The finding appears valid because the audit artifact explicitly includes a broad variant label, "Use this skill for academic writing tasks that require explicit assumptions, bounded scope, and a reproducible output format," which widens invocation beyond the stated purpose of drafting prior authorization letters. In an agent setting, this kind of over-broad routing language can cause the skill to be selected for unrelated writing tasks, increasing the chance of scope drift, inappropriate outputs, or misuse of medically themed templates outside intended controls.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This code saves generated prior authorization letters containing personally identifiable and medical information to disk, and the script also creates sample/input JSON files with the same type of sensitive data. Although the file operations are visible in code, there is no user-facing warning or disclosure that protected health information may be written to local files.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
The dependency 'dataclasses' is unpinned, so builds are not reproducible and a future package change or dependency-confusion style issue could alter runtime behavior unexpectedly. In addition, 'dataclasses' is part of the Python standard library on modern Python versions, so listing it as an external requirement may cause unnecessary package resolution and increases supply-chain risk.
- Content
text dataclasses main
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
The requirement 'main' is unpinned and unusually generic, which makes it riskier than a normal unpinned dependency because generic names are more susceptible to typosquatting, dependency confusion, or accidental installation of an unintended package. In a skill that drafts prior-authorization letters, compromise of the execution environment could expose sensitive healthcare-related data or alter generated clinical content.
- Content
text dataclasses main
Static analysis
No suspicious patterns detected.