Security audit

Symptom Checker Triage

Security checks for vulnerabilities and agentic risk

Overview

This medical triage skill is purpose-aligned, but it can under-triage serious symptoms and has avoidable install and disclosure issues users should review before relying on it.

Install only if you treat it as a rough demonstration tool, not a dependable triage system. Review and fix the case-insensitive matching, Chinese-support claim, low-confidence fallback behavior, and default disclaimer display before using it in any real medical workflow; remove the unnecessary requirements entries or pin any future dependencies.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

Location: requirements.txt:1
Finding: Unnecessary and Unpinned Third-Party Dependencies Create Supply-Chain Exposure
Content: View full analysis
Remediation: View remediation

other

Error

Location: scripts/main.py:148
Finding: Case-Sensitive Symptom Matching Can Miss Emergency Red Flags
Content: View full analysis
List[Tuple[str, TriageLevel, float, str, str]]: """Extract red flags from symptom description""" expanded_text = expand_synonyms(text) found_flags = [] for keyword, (name, level, weight, dept, reason) in RED_FLAGS.items(): if keyword in expanded_text: found_flags.append((name, level, weight, dept, reason)) ``` A related instance occurs in `extract_outpatient_symptoms` at `scripts/main.py:191-223`: ```python text_lower = text.lower() # Check temperature first temperature = calculate_temperature(text) for keyword, (name, level, weight, dept, reason) in OUTPATIENT_SYMPTOMS.items(): if keyword in text: found.append((name, level, weight, dept, reason)) ``` ### Technical Analysis All configured symptom and red-flag keywords are lowercase, but `extract_red_flags` performs substring matching against the original, non-normalized input. Consequently, inputs such as `Chest pain` do not match the configured `chest pain` rule. The outpatient extraction function computes `text_lower` but does not use it, repeating the same case-sensitivity defect. If no rule matches, `triage()` falls through to an outpatient result with a confidence of `0.30`, even when the differently capitalized input describes an emergency. This also conflicts with documented examples that capitalize symptom descriptions. In addition, `SKILL.md` claims support for English and Chinese input, while the reviewed rule tables contain only English terms. Unsupported Chinese input can therefore follow the same unrecognized-symptom fallback. ### Attack Path 1. A user supplies an emergency symptom using capitalization, such as `Chest pain`. 2. `expand_synonyms()` preserves the capitalization because its replacements are als ...[truncated 1061 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This tool provides concrete medical triage advice such as 'Proceed to emergency immediately' or 'Schedule an outpatient appointment,' but the user-facing disclaimer is only shown in verbose mode and omitted from normal and JSON output. In a medical decision-support context, inconsistent warnings can cause users to over-trust the output as diagnostic or authoritative guidance, increasing the risk of delayed care or inappropriate self-triage.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The markdown states that the skill accepts natural language symptom descriptions only in English or Chinese. This imposes a language constraint as a policy choice, but the file does not present it as an optional preference or justify it as a documented region-specific limitation.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 60% confidence
Finding: Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
dataclasses enum

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 60% confidence
Finding: Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
Content: Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.
text
dataclasses enum