Security audit

护工助手

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real caregiving dashboard, but it handles sensitive patient health data with weak local-only safeguards and asks for more agent authority than its function needs.

Install only if you are comfortable using a local browser tool for sensitive care records. Do not enter real patient or protected health information on shared devices or untrusted browser profiles, treat exported JSON backups as sensitive medical records, and be cautious with imported backup files. The publisher should narrow triggers, remove Bash unless needed, add explicit privacy warnings, and add confirmation/backup safeguards for import and export.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The skill requests Bash even though the documented functionality is a local front-end caregiving dashboard using localStorage. Unnecessary shell access expands the attack surface significantly: if the agent is induced to use Bash, sensitive patient data could be read, copied, exfiltrated, or system files modified despite no legitimate need for command execution.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The README explicitly states that all data is stored in browser localStorage while the skill handles highly sensitive patient, medication, vital-sign, emergency-contact, and care-log information. localStorage is readable by any script running in the same origin, persists on shared devices, and offers no built-in encryption or access controls, so in a caregiving context this creates significant confidentiality and privacy risk.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The trigger list includes broad generic phrases such as '患者管理', '护理管理', and '生命体征', which may cause the skill to activate in contexts where the user did not intend to invoke it. In a healthcare setting, accidental invocation is more serious because the skill handles highly sensitive medical and caregiver workflow data, increasing the risk of inappropriate data collection, display, or file generation.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The usage example suggests broad commands like '护工管理', which are ambiguous and could unintentionally trigger the skill during ordinary healthcare discussions. Because the skill may generate a dashboard and process patient records, accidental invocation could expose or create sensitive content without clear user intent.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The skill describes storing patient profiles, medical history, allergies, medication restrictions, and emergency contacts, yet provides no privacy warning or safeguards around local browser storage. localStorage is not appropriate for sensitive health information because it is accessible to scripts on the same origin, persists on shared devices, and typically lacks encryption, creating substantial confidentiality risk for patient data.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The export button allows bulk extraction of highly sensitive patient and caregiver data without any privacy warning, purpose limitation notice, or confirmation step. In a caregiving context this dataset includes medical history, vitals, medication, family contacts, and staffing information, so accidental or unauthorized export can cause major confidentiality and regulatory harm.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The import workflow replaces in-browser stored records with imported content after only minimal structural validation and without an explicit overwrite warning. This can lead to accidental destruction or corruption of care records, which is especially risky in a healthcare workflow where data integrity affects continuity of care.

Static analysis

No suspicious patterns detected.