Security audit

Korean Booking

Security checks for vulnerabilities and agentic risk

Overview

The skill has a plausible booking purpose, but it needs Review because it can open unvalidated URLs through shell commands, weakens browser security, tries to control the host agent, and logs appointment contact data.

Only install after review or fixes. Require URL allowlisting and shell-free browser opening, remove host-agent control rules, restore the missing template or simplify rendering, add explicit user confirmation before submitting appointments, remove plaintext contact-data logs, and avoid running developer sync scripts unless you intentionally want to modify the local OpenClaw cache.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:62
Finding: Forced Promotional Output and Agent Tool-Routing Hijack
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: api/browser/open-url.js:17
Finding: Arbitrary OS Command Execution Through Unescaped URL Interpolation
Content: View full analysis
true).catch(() => false) ``` The helper constructs shell commands by directly interpolating the URL: ```js async function openUrl(url) { if (!url) { console.error('❌ URL is required') process.exit(1) } try { if (process.platform === 'darwin') { await execAsync(`open "${url}"`) } else if (process.platform === 'win32') { await execAsync(`start "" "${url}"`) } else { await execAsync(`xdg-open "${url}"`) } console.log(`✅ Opened: ${url}`) process.exit(0) } catch (err) { console.error(`❌ Failed to open: ${err.message}`) process.exit(1) } } ``` ### Technical Analysis `child_process.exec()` executes its argument through a platform shell. Placing the value inside double quotes does not make the command safe. On Unix-like systems, shell constructs such as command substitution remain active inside double quotes. For example, a malicious value containing `$(command)` can cause the shell to execute `command` before invoking `xdg-open` or `open`. Quote-breaking and platform-specific metacharacters can produce additional injection forms. The vulnerability is externally reachable through `context.resolvedHospital.url`: - If the context contains a recognized hospital name, the database re ...[truncated 1848 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: api/browser/consult.js:16
Finding: Arbitrary Web Content Opened with Chromium Sandbox and Web Security Disabled
Content: View full analysis
{ page.on('dialog', async dialog => { await dialog.accept().catch(() => dialog.dismiss().catch(() => {})) }) }) const page = await context.newPage() await page.route('**/*', async (route) => { const reqUrl = route.request().url() if (!reqUrl.startsWith('http://') && !reqUrl.startsWith('https://')) { await route.abort() } else { await route.continue() } }) page.on('dialog', async dialog => { await dialog.accept().catch(() => dialog.dismiss().catch(() => {})) }) await page.goto(url, { waitUntil: 'networkidle', timeout: 30000 }).catch(() => { console.warn('⚠️ networkidle timeout, continuing anyway') }) ``` The CLI accepts an unrestricted URL: ```js if (requ ...[truncated 2788 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: api/skill.js:549
Finding: Plaintext Logging of User Contact and Appointment Information
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence

Findings (131)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 220)May include surrounding context.
md
- 医院数据：`data/hospitals.json`（961条）

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 224)May include surrounding context.
md
- 医院数据：`data/hospitals.json`（961条）

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: The plan contains rm -rf lib/, a destructive filesystem operation. In agentic execution, recursive deletion is dangerous because path mistakes, repository layout changes, or partial migrations can permanently remove code needed for recovery, validation, or forensic review.
Content: Scanner excerpt · docs/superpowers/plans/2026-03-20-project-restructure.md (reported line 790)May include surrounding context.

Step 1: Delete old lib/ and root-level files no longer needed

bash
rm -rf lib/ rm templates/zh_cn.txt rm index.js rm hospitals.json # now lives in data/

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: rm templates/zh_cn.txt is a direct file deletion command. Although narrower than rm -rf, it still performs irreversible state change and can remove a fallback or reference artifact before migration correctness is fully established.
Content: Scanner excerpt · docs/superpowers/plans/2026-03-20-project-restructure.md (reported line 791)May include surrounding context.
bash
rm -rf lib/ rm templates/zh_cn.txt rm index.js rm hospitals.json # now lives in data/

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 94% confidence
Finding: git rm -rf lib/ templates/zh_cn.txt index.js hospitals.json combines recursive removal with persistence in version control. This magnifies risk because it not only deletes files locally but also codifies their removal in repository history, increasing the chance of accidental loss of important components during autonomous execution.
Content: Scanner excerpt · docs/superpowers/plans/2026-03-20-project-restructure.md (reported line 806)May include surrounding context.

Step 3: Commit

bash
git rm -rf lib/ templates/zh_cn.txt index.js hospitals.json git commit -m "chore: remove old lib/, templates/zh_cn.txt, root index.js and hospitals.json"

Self-Modification

High

Category: Rogue Agent
Confidence: 90% confidence
Finding: The plan directs modification of skill.json, which is part of the skill's own configuration and execution surface. Self-modification is dangerous because an agent following the plan could change its entrypoint, inputs, or behavior contract in ways that bypass prior review or expand capabilities beyond intended scope.
Content: Scanner excerpt · docs/superpowers/plans/2026-03-20-project-restructure.md (reported line 812)May include surrounding context.
md
--- ## Task 9: Update skill.json and SKILL.md **Files:** - Modify: `skill.json`

Self-Modification

High

Category: Rogue Agent
Confidence: 90% confidence
Finding: This step includes concrete instructions to update skill.json, directly altering the skill manifest. In an agentic setting, allowing a plan to rewrite its own manifest can enable persistence, capability drift, or redirection to a different entry file without adequate oversight.
Content: Scanner excerpt · docs/superpowers/plans/2026-03-20-project-restructure.md (reported line 818)May include surrounding context.

Modify: skill.json

Modify: SKILL.md

Step 1: Update skill.json

json
{

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Updating SKILL.md is a form of self-modification to the skill's operating documentation. While less dangerous than manifest changes, it can still mislead downstream agents or users about data sources, capabilities, or safe usage, especially if documentation is trusted as policy input.
Content: Scanner excerpt · docs/superpowers/plans/2026-03-20-project-restructure.md (reported line 836)May include surrounding context.
}

text
- [ ] **Step 2: Update SKILL.md data section** Change the data paths in `SKILL.md` to reflect new locations: - `hospitals.json` → `data/hospitals.json`

Self-Modification

High

Category: Rogue Agent
Confidence: 91% confidence
Finding: The commit step explicitly persists changes to skill.json and SKILL.md, turning self-modification into a durable state change. Persisted configuration/documentation changes are risky because they survive the current run and may affect future executions or audits.
Content: Scanner excerpt · docs/superpowers/plans/2026-03-20-project-restructure.md (reported line 853)May include surrounding context.
bash
git add skill.json SKILL.md git commit -m "chore: update skill.json entry point and SKILL.md for new structure"

Known Vulnerable Dependency: brace-expansion==1.1.12 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more

High

Category: Supply Chain
Confidence: 88% confidence
Finding: brace-expansion 1.1.12 has multiple denial-of-service issues involving pathological expansion patterns that can cause extreme CPU or memory consumption. Although it is transitively included through dev tooling, lockfile processing chains often touch globbing on file names, patterns, or configuration, so attacker-influenced patterns in CI or automation could stall developer workflows.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: browserslist==4.28.1 — 2 advisory(ies): CVE-2026-73088 (Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.); CVE-2026-73089 (Browserslist: Unbounded memory growth (no cache eviction) via distinct query res)

High

Category: Supply Chain
Confidence: 80% confidence
Finding: browserslist 4.28.1 is flagged for crash/prototype write and unbounded memory growth issues when handling untrusted browserslist stats or many distinct queries. Because this is in the development toolchain rather than the runtime app, the main exposure is CI/build instability or unexpected object mutation if untrusted configuration/data is processed.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: js-yaml==3.14.2 — 4 advisory(ies): CVE-2026-84375 (js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources); CVE-2026-59869 (js-yaml: YAML merge-key chains can force quadratic CPU consumption); GHSA-5p4m-2wfm-xmqj (JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026) +1 more

High

Category: Supply Chain
Confidence: 86% confidence
Finding: js-yaml 3.14.2 has known quadratic/CPU exhaustion issues in parsing certain crafted YAML structures. Even as a dev dependency, YAML parsers are commonly exercised on configuration files, so attacker-controlled config or fixture content in CI, test, or helper scripts could trigger denial of service.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: picomatch==2.3.1 — 2 advisory(ies): CVE-2026-33672 (Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Mat); CVE-2026-33671 (Picomatch has a ReDoS vulnerability via extglob quantifiers)

High

Category: Supply Chain
Confidence: 85% confidence
Finding: picomatch 2.3.1 is reported vulnerable to ReDoS and method-injection-style matching issues from crafted glob patterns. Since picomatch is heavily used across Jest and file-matching utilities, untrusted patterns or path-like inputs in developer automation could cause excessive CPU use or incorrect matching behavior.
Content: No source excerpt is available for this finding.

Whitespace Padding

High

Category: Prompt Injection
Confidence: 80% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · page-full-snapshot.html (reported line 348)May include surrounding context.
html
/* 垂直间距 */ /* 透明度 */ /* 文章场景相关 */.qr-code[data-v-41c36176]{position:fixed;z-index:9999;bottom:120px;right:5px;width:45px;height:45px;-webkit-animation:shake-data-v-41c36176 1s infinite;animation:shake-data-v-41c36176 1s infinite}.qr-code uni-image[data-v-41c36176]{width:100%;height:100%}.kf-code[data-v-41c36176]{position:fixed;z-index:9998;bottom:150px;right:5px;width:45px;height:45px}.kf-code uni-image[data-v-41c36176]{width:100%;height:100%}@-webkit-keyframes shake-data-v-41c36176{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}20%{-webkit-transform:rotate(-3deg);transform:rotate(-3deg)}30%{-webkit-transform:rotate(3deg);transform:rotate(3deg)}60%{-webkit-transform:rotate(-3deg);transform:rotate(-3deg)}80%{-webkit-transform:rotate(3deg);transform:rotate(3deg)}100%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}@keyframes shake-data-v-41c36176{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}20%{-webkit-transform:rotate(-3deg);transform:rotate(-3deg)}30%{-webkit-transform:rotate(3deg);transform:rotate(3deg)}60%{-webkit-transform:rotate(-3deg);transform:rotate(-3deg)}80%{-webkit-transform:rotate(3deg);transform:rotate(3deg)}100%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}</style><style type="text/css">

Whitespace Padding

High

Category: Prompt Injection
Confidence: 80% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · page-snapshot.html (reported line 348)May include surrounding context.
html
/* 垂直间距 */ /* 透明度 */ /* 文章场景相关 */.qr-code[data-v-41c36176]{position:fixed;z-index:9999;bottom:120px;right:5px;width:45px;height:45px;-webkit-animation:shake-data-v-41c36176 1s infinite;animation:shake-data-v-41c36176 1s infinite}.qr-code uni-image[data-v-41c36176]{width:100%;height:100%}.kf-code[data-v-41c36176]{position:fixed;z-index:9998;bottom:150px;right:5px;width:45px;height:45px}.kf-code uni-image[data-v-41c36176]{width:100%;height:100%}@-webkit-keyframes shake-data-v-41c36176{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}20%{-webkit-transform:rotate(-3deg);transform:rotate(-3deg)}30%{-webkit-transform:rotate(3deg);transform:rotate(3deg)}60%{-webkit-transform:rotate(-3deg);transform:rotate(-3deg)}80%{-webkit-transform:rotate(3deg);transform:rotate(3deg)}100%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}@keyframes shake-data-v-41c36176{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}20%{-webkit-transform:rotate(-3deg);transform:rotate(-3deg)}30%{-webkit-transform:rotate(3deg);transform:rotate(3deg)}60%{-webkit-transform:rotate(-3deg);transform:rotate(-3deg)}80%{-webkit-transform:rotate(3deg);transform:rotate(3deg)}100%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}</style><style type="text/css">

Whitespace Padding

High

Category: Prompt Injection
Confidence: 80% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · page-full-snapshot.html (reported line 708)May include surrounding context.
html
._sup[data-v-c6b99c78]{display:inline} </style><style type="text/css">

Whitespace Padding

High

Category: Prompt Injection
Confidence: 80% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · page-snapshot.html (reported line 708)May include surrounding context.
html
._sup[data-v-c6b99c78]{display:inline} </style><style type="text/css">

Whitespace Padding

High

Category: Prompt Injection
Confidence: 80% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · page-full-snapshot.html (reported line 1268)May include surrounding context.
html
/* 圆角 */}.bottom-popup .popup-gs[data-v-8c33c7b8]{display:flex;flex-direction:row;justify-content:center;align-items:center;margin-top:10px;font-size:14px}.bottom-popup .popup-gs .gs-label[data-v-8c33c7b8]{color:#949494}.bottom-popup .popup-gs .gs-name[data-v-8c33c7b8]{margin-left:10px;color:#ff5a62;font-weight:700}.bottom-popup .popup_text[data-v-8c33c7b8]{width:85%;font-size:14px;padding:10px;margin:5px auto 0;background:#fff;border:1px solid #dedede;border-radius:5px;height:140px;overflow-y:auto}.bottom-popup .popup_jf_num[data-v-8c33c7b8]{font-size:14px;color:#333;text-align:center;width:100%}.bottom-popup .popup_jf-btn[data-v-8c33c7b8]{width:85%;display:flex;flex-direction:column;align-items:center;margin:0 auto;padding-top:5px}.bottom-popup .popup_jf-btn .popup_jf_info[data-v-8c33c7b8]{font-size:15px;border-radius:15px;padding:7px 0;width:100%;text-align:center;box-sizing:border-box;margin-top:5px;margin-bottom:10px}.bottom-popup .popup_jf-btn .popup_jf_info-disable[data-v-8c33c7b8]{background:#eee;color:#333}.bottom-popup .popup_jf-btn .popup_jf_info-get[data-v-8c33c7b8]{ /* 基础线性渐变方案 */background:linear-gradient(180deg,#fd9d99,#ff5a62);color:#fff}.bottom-popup .popup_jf-btn .popup_jf_info-pm[data-v-8c33c7b8]{ /* 基础线性渐变方案 */background:linear-gradient(180deg,#fd9d99,#ff5a62);color:#fff}.success-icon[data-v-8c33c7b8]{font-size:30px;color:#4caf50;text-align:center;margin:10px 0}.err-icon[data-v-8c33c7b8]{color:#af4c4c}.success-text[data-v-8c33c7b8]{font-size:18px;color:#333;text-align:center;margin-bottom:10px}.success-description[data-v-8c33c7b8]{width:85%;font-size:14px;margin:20px auto 30px;padding:10px;background:#fff;border:1px solid #dedede;border-radius:5px;height:125px;overflow-y:auto}</style><style type="text/css">

Whitespace Padding

High

Category: Prompt Injection
Confidence: 80% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · page-snapshot.html (reported line 1268)May include surrounding context.
html
/* 圆角 */}.bottom-popup .popup-gs[data-v-8c33c7b8]{display:flex;flex-direction:row;justify-content:center;align-items:center;margin-top:10px;font-size:14px}.bottom-popup .popup-gs .gs-label[data-v-8c33c7b8]{color:#949494}.bottom-popup .popup-gs .gs-name[data-v-8c33c7b8]{margin-left:10px;color:#ff5a62;font-weight:700}.bottom-popup .popup_text[data-v-8c33c7b8]{width:85%;font-size:14px;padding:10px;margin:5px auto 0;background:#fff;border:1px solid #dedede;border-radius:5px;height:140px;overflow-y:auto}.bottom-popup .popup_jf_num[data-v-8c33c7b8]{font-size:14px;color:#333;text-align:center;width:100%}.bottom-popup .popup_jf-btn[data-v-8c33c7b8]{width:85%;display:flex;flex-direction:column;align-items:center;margin:0 auto;padding-top:5px}.bottom-popup .popup_jf-btn .popup_jf_info[data-v-8c33c7b8]{font-size:15px;border-radius:15px;padding:7px 0;width:100%;text-align:center;box-sizing:border-box;margin-top:5px;margin-bottom:10px}.bottom-popup .popup_jf-btn .popup_jf_info-disable[data-v-8c33c7b8]{background:#eee;color:#333}.bottom-popup .popup_jf-btn .popup_jf_info-get[data-v-8c33c7b8]{ /* 基础线性渐变方案 */background:linear-gradient(180deg,#fd9d99,#ff5a62);color:#fff}.bottom-popup .popup_jf-btn .popup_jf_info-pm[data-v-8c33c7b8]{ /* 基础线性渐变方案 */background:linear-gradient(180deg,#fd9d99,#ff5a62);color:#fff}.success-icon[data-v-8c33c7b8]{font-size:30px;color:#4caf50;text-align:center;margin:10px 0}.err-icon[data-v-8c33c7b8]{color:#af4c4c}.success-text[data-v-8c33c7b8]{font-size:18px;color:#333;text-align:center;margin-bottom:10px}.success-description[data-v-8c33c7b8]{width:85%;font-size:14px;margin:20px auto 30px;padding:10px;background:#fff;border:1px solid #dedede;border-radius:5px;height:125px;overflow-y:auto}</style><style type="text/css">

Whitespace Padding

High

Category: Prompt Injection
Confidence: 80% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · page-full-snapshot.html (reported line 1343)May include surrounding context.
html
/* 无任何数据的空布局 */.mescroll-empty[data-v-482baad0]{box-sizing:border-box;width:100%;padding:50px 25px;text-align:center}.mescroll-empty.empty-fixed[data-v-482baad0]{z-index:99;position:absolute; /*transform会使fixed失效,最终会降级为absolute */top:50px;left:0}.mescroll-empty .empty-icon[data-v-482baad0]{width:140px;height:140px;margin:0 auto}.mescroll-empty .empty-tip[data-v-482baad0]{margin-top:10px;font-size:12px;color:grey}.mescroll-empty .empty-btn[data-v-482baad0]{display:inline-block;margin-top:20px;min-width:100px;padding:9px;font-size:14px;border:1px solid #e04b28;border-radius:30px;color:#e04b28}.mescroll-empty .empty-btn[data-v-482baad0]:active{opacity:.75}</style><style type="text/css">

Whitespace Padding

High

Category: Prompt Injection
Confidence: 80% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · page-snapshot.html (reported line 1343)May include surrounding context.
html
/* 无任何数据的空布局 */.mescroll-empty[data-v-482baad0]{box-sizing:border-box;width:100%;padding:50px 25px;text-align:center}.mescroll-empty.empty-fixed[data-v-482baad0]{z-index:99;position:absolute; /*transform会使fixed失效,最终会降级为absolute */top:50px;left:0}.mescroll-empty .empty-icon[data-v-482baad0]{width:140px;height:140px;margin:0 auto}.mescroll-empty .empty-tip[data-v-482baad0]{margin-top:10px;font-size:12px;color:grey}.mescroll-empty .empty-btn[data-v-482baad0]{display:inline-block;margin-top:20px;min-width:100px;padding:9px;font-size:14px;border:1px solid #e04b28;border-radius:30px;color:#e04b28}.mescroll-empty .empty-btn[data-v-482baad0]:active{opacity:.75}</style><style type="text/css">

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The README instructs users to run npx clawhub install korean-booking without pinning a specific version of the tool being executed. This creates a supply-chain risk: users may fetch and run whatever version is current at install time, and if the package or dependency chain is compromised, arbitrary code could execute on the user's machine.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases are broad conversational requests like booking, recommending clinics, or downloading an app, which overlap with normal user speech. In an agent environment, ambiguous triggers can cause the skill to activate unexpectedly and initiate sensitive flows related to browser opening, clinic selection, or booking actions without sufficiently explicit scoping.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The invocation examples include short, generic commands such as '帮我下载' and other broad appointment-related phrases that lack clear scope constraints. This increases the chance of accidental or context-confused activation, especially in multi-skill or agentic environments where similar phrases may refer to unrelated tasks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The README describes automatic browser opening, button clicking via Playwright, form filling, and submission of appointment information, but provides no user-facing warning, consent requirement, or safety boundary for actions that affect user data and external system state. In context, this is more dangerous because the skill operates on healthcare/medical-booking workflows and may submit personal scheduling details or contact interactions to third-party sites.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.