ClawHub
Back to skill

Security audit

风险管理专家 (ISO 14971)

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent medical-device risk-management helper with no hidden access or persistence, though its FMEA calculator has a boundary-case classification bug users should review.

Before relying on this skill for medical-device risk documentation, review and fix the FMEA RPN threshold handling or treat RPN values at 50 and 100 manually according to your approved risk policy. The skill otherwise behaves like a local guidance-and-calculation aid and does not request unusual system access.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/risk_matrix_calculator.py:146
Finding

FMEA Boundary Values Are Assigned a Lower Priority Than Documented

Content
View full analysis

Vulnerability Details

File Location: scripts/risk_matrix_calculator.py, lines 146-156
Vulnerability Type: Incorrect boundary validation in safety-related risk classification
Risk Level: Medium

Vulnerable Code

python
# Determine priority level
if rpn > 200:
    priority = "Critical"
    action = "Immediate action required"
elif rpn > 100:
    priority = "High"
    action = "Action plan required"
elif rpn > 50:
    priority = "Medium"
    action = "Consider risk reduction"
else:
    priority = "Low"
    action = "Monitor"

Technical Analysis

The implementation uses strict greater-than comparisons, while the documented thresholds in references/risk-analysis-methods.md and references/risk-assessment-templates.md specify:

  • RPN greater than 200: Critical
  • RPN 100–200: High
  • RPN 50–100: Medium
  • RPN below 50: Low

Consequently:

  • An RPN of exactly 50 is classified as Low rather than Medium.
  • An RPN of exactly 100 is classified as Medium rather than High.

This is an off-by-one boundary defect in a medical-device risk assessment utility. It causes the executable behavior to conflict with the project’s documented risk-control criteria.

Attack Path

  1. A user or integrated system supplies valid FMEA ratings whose product is exactly 50 or 100.
  2. For example, severity 5, occurrence 5, and detection 4 produce an RPN of 100.
  3. The condition rpn > 100 evaluates to false.
  4. The condition rpn > 50 evaluates to true.
  5. The calculator reports Medium priority and recommends only “Consider risk reduction,” although the documented criteria require High priority and an action plan.
  6. Similarly, ratings producing an RPN of 50 result in Low priority and the recommendation “Monitor,” rather than the documented Medium priority.

This path does not provide operating-system access or elevated privileges. It may be ...[truncated 721 chars]

Remediation
View remediation

Remediation Suggestions

Replace the strict comparisons with explicit inclusive boundaries that match the documented policy:

python
if rpn > 200:
    priority = "Critical"
    action = "Immediate action required"
elif rpn >= 100:
    priority = "High"
    action = "Action plan required"
elif rpn >= 50:
    priority = "Medium"
    action = "Consider risk reduction"
else:
    priority = "Low"
    action = "Monitor"

Additionally:

  1. Define the thresholds once as named constants or a shared policy table to prevent divergence between implementation and documentation.
  2. Clarify whether RPN 200 belongs to High or Critical and encode that boundary explicitly.
  3. Add automated tests for RPN values 49, 50, 51, 99, 100, 101, 199, 200, and 201.
  4. Add tests comparing all implemented classifications against the documented ranges.
  5. Require review and validation of threshold changes because the results may inform safety-related decisions.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The description overstates the skill substantially. The supplied code is limited to a command-line calculator for a fixed 5x5 risk matrix and FMEA RPN computation, plus display of criteria. While this partially matches risk analysis/risk evaluation and risk acceptability concepts, it does not implement ISO 14971 throughout the product lifecycle and lacks several named areas in the description: post-production information analysis, hazard identification workflows, fault tree analysis, benefit-risk analysis, and residual risk handling. The primary purpose is therefore materially narrower than declared.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · scripts/risk_matrix_calculator.py (reported line 82)May include surrounding context.

python
7: "High effect",
    8: "Very high effect",
    9: "Hazardous with warning",
    10: "Hazardous without warning"
}

FMEA_OCCURRENCE = {

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · scripts/risk_matrix_calculator.py (reported line 309)May include surrounding context.

python
7: "High effect",
    8: "Very high effect",
    9: "Hazardous with warning",
    10: "Hazardous without warning"
}

FMEA_OCCURRENCE = {

Static analysis

No suspicious patterns detected.