Medical Record Structurer

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:26 AM UTC
• Version: 1.4.0

Overview

The skill does medical-record structuring, but it also ships an unbounded self-evolution daemon and makes overstated privacy claims around sensitive medical data.

Review this package carefully before installing. Do not run the auto-evolution daemon, avoid processing real PHI unless you have your own privacy controls, and treat the advertised encryption, hashing, audit logging, and no-storage claims as unsupported by the inspected code paths.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T06 · System Persistence

Error

• Location: auto-evolve-daemon.sh:10

Finding

Indefinite Background Daemon Repeatedly Executes Self-Modifying Code

Content

View full analysis

> $LOG_FILE echo "[$(date)] Running self-evolution..." >> $LOG_FILE cd $SKILL_PATH python3 scripts/self_evolve.py >> $LOG_FILE 2>&1 echo "[$(date)] Evolution cycle complete. Sleeping 30 minutes..." >> $LOG_FILE # Run another evolution cycle every 30 minutes sleep 1800 done ``` The invoked evolution engine writes directly to executable code: ```python if content != original: with open(script_path, 'w', encoding='utf-8') as f: f.write(content) ``` It also rewrites the Skill definition: ```python with open(skill_md, 'w', encoding='utf-8') as f: f.write(content) ``` ### Technical Analysis The daemon runs indefinitely and invokes `scripts/self_evolve.py` every 30 minutes. That module can rewrite `scripts/process_record.py`, `SKILL.md`, generated support modules, changelogs, and evolution logs. Medical-record structuring does not require a perpetual background loop or autonomous modification of reviewed executable files. The implementation has no integrity verification, trusted update source, file locking, rollback mechanism, change approval, or limit on the number of cycles. The repository does not contain an automatic startup-service or cron installer, so cross-reboot persistence is not established by the reviewed code alone. Nevertheless, once manually launched or launched by an external supervisor, the script remains active indefinitely and continually mutates the installed Skill. ### Attack Path 1. A user, deployment script, or external process launches `auto-evolve-daemon.sh`. 2. The script enters an unbounded `while true` loop. 3. Every 30 minutes, it runs `scripts/self_evolve.py`. 4. The evolution engine rewrites executable and instruction files in ...[truncated 781 chars]

Remediation

View remediation

T07 · Tool Hijacking and Spoofing

Error

• Location: scripts/self_evolve.py:123

Finding

Non-Idempotent Self-Modification Causes Progressive Source Corruption

Content

View full analysis

List[str]: """Enhance the core script.""" changes = [] script_path = self.skill_path / "scripts" / "process_record.py" if not script_path.exists(): return changes with open(script_path, 'r', encoding='utf-8') as f: content = f.read() original = content # Add performance optimization if "@lru_cache" not in content: # Add cache support content = content.replace( "import json", "import json\nfrom functools import lru_cache" ) changes.append("Add LRU cache support") # Add data validation if "validate" not in content.lower(): changes.append("Enhance data validation") if content != original: with open(script_path, 'w', encoding='utf-8') as f: f.write(content) return changes ``` The resulting `scripts/process_record.py` contains hundreds of repeated imports such as: ```python from functools import lru_cache from functools import lru_cache from functools import lru_cache ``` The bundled `evolution-log.json` records repeated evolution cycles at approximately 30-minute intervals. ### Technical Analysis The mutation condition checks whether the source contains the decorator text `@lru_cache`, but the mutation only inserts an import statement. Because the decorator is never added, the condition remains true on every cycle. Each execution therefore replaces every matching `import json` occurrence with another import block. This is non-idempotent and progressively enlarges and corrupts the source file. The issue also undermines review integrity: the executable file used by later calls is modified after installation without a trusted update or approval pr ...[truncated 1031 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/process_record.py:746

Finding

Complete Medical Records Can Be Written to Disk as Unencrypted Plaintext

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/process_record.py:437

Finding

Raw User Identifiers Are Persisted and Transmitted Despite Hashing Claims

Content

View full analysis

bool: """Record a free trial usage for a user.""" if not user_id: return False data = self._load_trial_data() if user_id not in data: data[user_id] = {'used_calls': 0, 'first_use': datetime.now().isoformat()} data[user_id]['used_calls'] += 1 data[user_id]['last_use'] = datetime.now().isoformat() self._save_trial_data(data) return True ``` The raw identifier is inserted into a URL without URL encoding: ```python def check_balance(self, user_id: str) -> float: result = self._make_request( f'/api/v1/billing/balance?user_id={user_id}' ) return result.get('balance', 0.0) ``` It is also transmitted in payment payloads: ```python result = self._make_request( '/api/v1/billing/charge', method='POST', data={ 'user_id': user_id, 'skill_id': self.skill_id, 'amount': amount, } ) ``` ```python result = self._make_request( '/api/v1/billing/payment-link', method='POST', data={ 'user_id': user_id, 'amount': amount, } ) ``` ### Technical Analysis `SECURITY.md` states that the locally stored user ID is hashed, but no hashing or pseudonymization occurs. The raw identifier is stored in `~/.openclaw/skill_trial/medical-record-structurer.json` with first-use and last-use timestamps. The same identifier is transmitted to SkillPay. Although transmitting a billing identifier is related to payment functionality, the implementation does not minimize or pseudonymize it. The balance endpoint constructs a query string through direct interpolation. Reserved charac ...[truncated 1103 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/process_record.py:983

Finding

Billing API Key Can Be Exposed Through Command-Line Arguments

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (52)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The Flask API example accepts and returns medical record content over an API without any mention of transport security, authentication, authorization, logging hygiene, or data minimization. Because the payload is medical data, this omission can encourage insecure deployment patterns that expose PHI in transit or to unauthorized callers.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 28)May include surrounding context.

3. Copy the environment variables file and configure:

bash

cp .env.example .env
# Edit .env with your actual API keys

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 29)May include surrounding context.

3. Copy the environment variables file and configure:

bash

cp .env.example .env
# Edit .env with your actual API keys

Environment Variables Configuration

Self-Modification

High

• Category: Rogue Agent
• Confidence: 98% confidence

Finding

The script explicitly invokes a self-evolution mechanism on a perpetual schedule, which is a classic self-modification pattern. In this context, that is especially dangerous because it can continuously alter skill behavior without oversight, making malicious payload insertion, persistence, and evasion of prior review substantially easier.

Content

Scanner excerpt · auto-evolve-daemon.sh (reported line 17)May include surrounding context.

sh

echo "[$(date)] Running self-evolution..." >> $LOG_FILE
    
    cd $SKILL_PATH
    python3 scripts/self_evolve.py >> $LOG_FILE 2>&1
    
    echo "[$(date)] Evolution cycle complete. Sleeping 30 minutes..." >> $LOG_FILE

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The demo-mode messaging says it uses simulated/demo data and that no API key is required, but the implementation still processes the real user-supplied medical text. In a healthcare context, this is deceptive and can cause users to enter real PHI under the false assumption that the data is synthetic or specially protected.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The tool prints structured records, including source_text and extracted medical details, to stdout and can write them to output files without any warning or redaction. This can expose protected health information through terminal logs, shell history capture, redirected output, shared systems, or insecure files.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module presents itself as part of a medical record structuring skill, but its real behavior is to inspect, rewrite, and generate files in the skill repository. This mismatch is dangerous because it obscures high-risk self-modifying behavior behind an unrelated medical context, reducing operator scrutiny and making unintended code changes more likely to be trusted.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This code autonomously edits project files, creates new modules, updates metadata, and persists logs, despite belonging to a skill whose apparent purpose is medical record processing. In this context, self-modification is unjustified and expands the attack surface substantially: compromised logic, accidental corruption, or stealthy persistence could be introduced without review.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/upload-to-clawhub.sh (reported line 38)May include surrounding context.

sh

echo "Size: $(ls -lh $SKILL_PATH | awk '{print $5}')"
echo ""

# Upload using curl
curl -X POST "$CLAWHUB_API" \
    -H "Authorization: Bearer $API_TOKEN" \
    -H "Content-Type: multipart/form-data" \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The examples process highly sensitive medical record data, including names, ages, diagnoses, and treatments, but provide no privacy, consent, de-identification, or secure-handling guidance. In a medical-record structuring skill, omission of such warnings can lead users to test with real PHI and handle it insecurely, increasing risk of privacy breaches and regulatory noncompliance.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The document explicitly organizes usage around 'Chinese Medical Records' and 'English Medical Records', which signals a fixed language scope. Because no user choice, opt-in, or justification for the locale restriction is provided in the natural-language description, this may violate the language/locale policy.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The batch example explicitly writes structured medical record results to a local JSON file, which can contain sensitive patient information, without warning about encryption, access controls, or retention. This creates a straightforward path to accidental PHI exposure through local disk persistence, backups, shared workstations, or source-control mistakes.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · FAQ.md (reported line 111)May include surrounding context.

• Include patient demographics

Permission denied errors

Create the required directory:

bash

mkdir -p ~/.openclaw/skill_trial
chmod 755 ~/.openclaw

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · FAQ.md (reported line 114)May include surrounding context.

Create the required directory:

bash

mkdir -p ~/.openclaw/skill_trial
chmod 755 ~/.openclaw

Slow processing

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · GETTING_STARTED.md (reported line 166)May include surrounding context.

Create the required directory:

bash

mkdir -p ~/.openclaw/skill_trial
chmod 755 ~/.openclaw

Slow processing

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The quick-start encourages users to process medical records, including their own data, without any warning that the content may contain protected health information. In a healthcare context, omission of privacy guidance increases the chance users will expose sensitive patient data insecurely during testing or routine use.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation claims the skill has no external dependencies and uses only the Python standard library, yet later describes integration with an external paid service requiring API credentials. This discrepancy can mislead users into believing medical data stays local when the skill may depend on or communicate with a third-party service, creating supply-chain, privacy, and trust risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The API-key setup section introduces a third-party service but does not warn that sensitive medical content may be transmitted outside the local environment. Because the skill processes medical records, failing to disclose potential external transmission materially raises privacy, confidentiality, and regulatory exposure.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · GETTING_STARTED.md (reported line 165)May include surrounding context.

Permission Denied

If you see permission errors for ~/.openclaw/:

bash

mkdir -p ~/.openclaw/skill_trial
chmod 755 ~/.openclaw

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The usage example and printed output strings are presented in Chinese, including patient data and user-facing messages, but the document does not state that the skill is China-specific or that users can choose their preferred language. This can violate language/locale policy because it implicitly forces a specific language experience without opt-in or justification.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SECURITY.md (reported line 27)May include surrounding context.

md

- **Retention**: Until user deletes the file or uninstalls the skill

### File System Access
- **Purpose**: Read/write trial tracking data
- **Scope**: User's home directory only (`~/.openclaw/`)
- **No access** to: System files, other applications' data, sensitive directories

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill advertises processing medical records, file input, OCR, and speech-to-text, but does not clearly warn near the main description that patient data may be read from local files and transmitted to third-party OCR/STT providers during normal use. Because the content is explicitly PHI/medical data, inadequate disclosure materially increases the risk of unauthorized disclosure, unsafe deployment, and noncompliant handling of sensitive records.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation makes strong PHI/privacy and compliance assurances such as encryption, access control, audit logging, and HIPAA-oriented handling, while the same file only shows these protections as optional or configurable and provides no evidence they are enforced. In a healthcare skill processing medical records, overstated security claims can cause users to submit sensitive patient data under false assumptions, creating substantial privacy, regulatory, and trust risk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file header identifies the script as 'Medical Record Structurer - Auto-Evolution Daemon', implying it supports a medical-record-structuring skill, but the operative behavior is an infinite loop that repeatedly invokes scripts/self_evolve.py. This is an active contradiction in intent labeling because the documented purpose suggests domain processing, while the code is dedicated to autonomous self-modification/evolution orchestration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This daemon repeatedly executes a self-evolution script in an infinite loop without any approval gate, change control, or user-visible warning. In a skill context, autonomous code evolution can introduce unreviewed behavior over time, enabling persistence, privilege abuse, or silent drift into unsafe functionality.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.