Clinical Tempo

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:20 AM UTC
• Version: 1.0.0

Overview

This is mostly a disclosed Clinical Tempo context helper, but its optional install paths, persistent hooks, and scaffold script deserve review before installation.

Install only if you trust the Clinical Tempo source and want its project-context behavior. Treat the hook setup as persistent agent configuration, pin or verify external install commands before running them, and avoid using scripts/extract-skill.sh with untrusted slugs unless its validation is tightened first.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:41

Finding

Unpinned Third-Party Packages Are Downloaded and Executed

Content

View full analysis

Remediation

View remediation

install arunnadarasa/clinicaltempo ``` 2. Pin the optional plugin to an explicitly reviewed version: ```bash openclaw plugins install @anyway-sh/anyway-openclaw@ ``` 3. Publish expected package checksums or signatures and document how users can verify them before installation. 4. Link to the authoritative source repository and release commit so users can inspect the exact code associated with the pinned version. 5. Document whether package lifecycle scripts execute and provide a safer installation method that disables scripts where practical. 6. Remove the optional Anyway plugin from the primary installation path or place it in a clearly separated integration section because it is not required by the Skill's context-only functionality. 7. In CI or sensitive environments, install dependencies with a minimally privileged account and without unnecessary secrets in the process environment. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/extract-skill.sh:24

Finding

Insufficient Slug Validation Permits Destination Path Traversal

Content

View full analysis

&2 usage exit 1 fi DEST="$OUT_BASE/$SKILL_NAME" if [[ -e "$DEST" ]]; then echo -e "${RED}ERROR:${NC} already exists: $DEST" >&2 exit 1 fi if $DRY_RUN; then echo -e "${GREEN}[dry-run]${NC} would create $DEST" exit 0 fi mkdir -p "$DEST/references" "$DEST/assets" "$DEST/scripts" ``` The script subsequently writes `SKILL.md`, `README.md`, and an asset beneath the same unvalidated `DEST` path. ### Technical Analysis The script claims to require a lowercase, hyphenated slug, but its validation only rejects empty strings and values containing a literal space. It does not reject: - `/` path separators - `..` parent-directory components - Absolute paths - Newline and other control characters - Uppercase or other characters outside the advertised slug format `SKILL_NAME` is directly concatenated with `OUT_BASE` to construct `DEST`. Although filesystem operations quote the resulting value and therefore do not introduce ordinary shell word-splitting or command injection, quoting does not prevent the operating system from resolving `../` path components. The existing-path check reduces overwrite risk because execution stops if the complete destination already exists. It does not prevent creation of a new attacker-selected destination outside `.cursor/skills`, nor does it verify that the canonical destination remains beneath `OUT_BASE`. ### Attack Path 1. An attacker or untrusted automation influences the slug supplied to `ex ...[truncated 1352 chars]

Remediation

View remediation

&2 exit 1 fi ``` 2. Explicitly reject `/`, `\`, `..`, control characters, and values beginning with `-`. 3. Canonicalize both the output base and candidate destination before creating files. 4. Verify that the canonical destination's parent is the canonical `OUT_BASE`; abort if it escapes that directory. 5. Use a non-following creation strategy where available, and reject symbolic-link components in the destination path. 6. Retain the existing destination check, but treat it only as overwrite protection rather than containment validation. 7. Add regression tests for malicious values such as: ```text ../outside ../../outside /tmp/outside valid/../../outside -option ``` 8. Perform all validation before `mkdir`, `cp`, or heredoc file writes. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared purpose is context/debugging, but the skill also instructs creation of new skill packages and writing files outside its own directory via extraction/scaffolding commands. That mismatch is dangerous because users or agents may trust it as read-only context while it actually enables code generation and filesystem changes in broader workspace locations.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

md

lawHub (publish):** Zip **`clawhub/`** (this folder) so the listing includes **`SKILL.md`**, **`references/`**, **`assets/`**, **`hooks/`**, **`scripts/`**. See

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 292)May include surrounding context.

md

lawHub (publish):** Zip **`clawhub/`** (this folder) so the listing includes **`SKILL.md`**, **`references/`**, **`assets/`**, **`hooks/`**, **`scripts/`**. See

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The README instructs users to run npx clawhub@latest install ..., which fetches and executes the latest published package version at install time. If the package is compromised, typo-squatted, or a malicious update is published, consumers could execute unreviewed code on their systems. In a skill-installation context this is more dangerous because readers are explicitly encouraged to run the command during setup.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 80% confidence

Finding

The skill references executable shell scripts and installation/verification commands but does not declare any explicit tool scope or allowed-tools boundary. In agents that infer capabilities from content, this can lead to unreviewed shell execution and broader-than-expected access, especially because the skill includes hooks, scripts, and file-copy operations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

Phrases like "The user uploads ClawHub / OpenClaw / Copilot context questions" and mentions of broad terms such as "Clinical Tempo" or "MPP" leave unclear when the skill should activate versus when those topics are incidental. The guidance lacks constraints or negative examples, increasing the chance of over-invocation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger list includes broad terms such as "Clinical Tempo," "HealthTech," "Tempo," "8787," "ClawHub," and "OpenClaw," any of which could appear in ordinary repo discussion without the user intending to invoke this skill. The section does not provide exclusion conditions or negative examples to constrain when activation should not occur.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The documentation instructs users to run npx clawhub@latest install ..., which fetches and executes the latest published package version at runtime rather than a pinned, reviewed release. If the package is compromised, a malicious version is published, or the account/package supply chain is hijacked, users could execute attacker-controlled code on their workstation during installation.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · scripts/extract-skill.sh (reported line 61)May include surrounding context.

sh

# ${SKILL_NAME//-/ }

Brief description. Replace this file with content modeled on \`.cursor/skills/clawhub/SKILL.md\`.

## Quick reference

Static analysis

No suspicious patterns detected.