medical-record-structuring

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:57 AM UTC
• Version: 1.0.0

Overview

This skill appears to be a local medical-record structuring tool, but its privacy and standards-compliance claims are stronger than what the bundled code actually provides.

Review before installing if you plan to use real patient data. Treat this as a lightweight local demo extractor, not a validated FHIR/WS 445/ICD/LOINC production pipeline, and avoid sending its stdout or output files to logs, shared folders, or source control unless you have separately reviewed and protected the PHI.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared description promises conversion of Chinese clinical narratives into standardized JSON aligned with HL7 FHIR R4 and national EMR standards, implying broad clinical information extraction and standards-based structuring/coding. The code instead is a small rule-based extractor with regexes for demographics, vitals, diagnosis lines, and medication mentions. It does not generate FHIR resources, does not map to WS 445-2014, ICD-10, or ICD-9-CM-3, and leaves several declared domains (lab, procedure) effectively unimplemented. While the code is related to clinical text extraction, its actual scope and output format are materially narrower and less standards-compliant than described.

Natural-Language Policy Violations

Medium

• Confidence: 86% confidence
• Finding: The English description states that the skill converts 'Chinese clinical narratives' into structured JSON, which constrains the skill to a specific language context. Under the policy, locale or language restrictions should either be user-selectable or clearly justified as a region-specific tool; this README presents the constraint as mandatory without an explicit opt-in mechanism.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises and demonstrates local script execution that reads input records and writes structured outputs, but it does not declare an explicit tool scope such as allowed-tools or permissions. In an agent environment, this weakens containment and reviewability: a caller or runtime may grant broader filesystem access than intended, increasing the chance of unauthorized reading of sensitive medical records or writing derived PHI to unsafe locations.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: Line L19 converts gender by checking only whether the input equals the Chinese character "男", otherwise assigning "female". This embeds a language-specific assumption and forces a locale-specific interpretation without user opt-in or documented justification, which matches the language/locale policy violation category.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script prints a rendered preview of the extracted FHIR bundle directly to stdout, and that preview includes serialized resource fields that can contain highly sensitive medical record data. In CLI, pipeline, CI, or hosted agent environments, stdout is commonly captured in terminal scrollback, logs, job artifacts, and observability systems, creating an unintended disclosure path for PHI/PII.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The regex patterns explicitly target Chinese terms such as 体温, 脉搏, 呼吸, 血压, 岁, 性别, 男, and 女. This imposes a language/locale assumption in the skill behavior, but the file does not indicate user opt-in or explain that the skill is intentionally limited to a Chinese-language clinical context.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The docstring states the pipeline reads a Chinese clinical narrative, and the record-type detection logic is also hard-coded to Chinese phrases. This creates a language-specific constraint in the skill's natural-language behavior without an explicit user opt-in or documented policy justification.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The code comments and CLI help imply that PII masking protects preview output, but the implementation only masks the Patient.family field and explicitly returns the full FHIR bundle with original values intact. In a medical-record processing skill, this creates a strong risk that operators or downstream systems will mistakenly believe PHI has been de-identified when sensitive identifiers remain present in structured output.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script writes the generated JSON bundle to disk without warning that it may contain unmasked medical PII/PHI, and the code path preserves full values in the returned bundle. Because this skill handles clinical narratives, silent persistence of full patient data can lead to privacy violations, insecure local storage, accidental check-in, or leakage through shared workspaces and logs.

Natural-Language Policy Violations

Low

• Confidence: 86% confidence
• Finding: This markdown file contains natural-language guidance that specifies a single language/locale for the input example: 'A canonical admission note in Chinese.' Under the policy, forcing or presuming a specific language without user opt-in can be a locale-policy violation unless clearly justified as region-specific.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: This plain-text skill file contains only Chinese-language medical content and provides no indication that the language is optional, user-selected, or required by a documented regional context. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The module docstring states the skill will split a Chinese clinical record, which imposes a language-specific constraint in natural language. The file does not indicate that Chinese input is optional, user-selected, or justified as a region-specific tool, so this appears to be a locale restriction without explicit opt-in.

Static analysis

No suspicious patterns detected.