T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:700- Finding
Clinical Record Example Fabricates Unsupported Patient Findings and Interventions
- Content
View full analysis
- Remediation
View remediation
Security audit
AU Allied Health Notes Recall
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent Australian allied-health documentation helper, but it includes unsafe clinical-record examples that invent patient details despite its own guardrails.
Review carefully before installing in a real practice. The skill should not be used to produce filing-ready clinical notes unless every patient statement, objective finding, assessment, intervention, exercise, dosage, and billing detail is supplied or explicitly verified by the clinician. Current MBS descriptors, session limits, and rebate amounts should be checked against official sources before billing.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill says it must never fabricate patient clinical details and should use placeholders when data is incomplete, but its example SOAP note includes detailed clinical findings, measurements, and treatment specifics that were not supplied by the user. In a clinical documentation context, this normalizes hallucinated medical record content and could lead clinicians to adopt or submit inaccurate notes that affect care continuity, audits, or Medicare substantiation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The trigger list includes generic phrases such as "clinical note," "write a note," "draft a note," and especially "item number" and "privacy," which can appear in many ordinary conversations beyond this skill's intended scope. Although the file includes a "Do NOT use" section, it does not provide enough trigger constraints or negative trigger examples to prevent accidental activation in unrelated contexts.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly instructs the agent to never state Medicare rebate dollar amounts from memory, yet elsewhere embeds a specific rebate figure as reference content. In a billing/compliance-focused healthcare skill, stale or incorrect rebate values can mislead users into making billing or patient-fee decisions based on inaccurate information, undermining the skill's own safety guardrails.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The task table uses broad examples like "help with my notes," "what code," and "report back," which are ambiguous outside this domain and could match everyday requests. The surrounding instructions do not explicitly require that these phrases be interpreted only in Australian allied health documentation or Medicare contexts.
- Content
Static analysis
No suspicious patterns detected.