ClawHub
Back to skill

Security audit

壹康互联网诊疗申报助手

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed advisory skill for Shandong internet-hospital applications; it does not install privileged code, but users should avoid following an outdated flowchart note about sharing passwords.

Before installing, treat this as China/Shandong regulatory guidance and verify current official requirements for your locality. Use the curated SKILL.md and references rather than raw historical HTML notes, and do not share platform passwords, patient records, full identity numbers, API keys, merchant keys, or private keys through the skill or with a vendor unless a separate secure, authorized project channel is established.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)

Credential Access

High
Category
Privilege Escalation
Content
.DS_Store
__pycache__/
*.py[cod]
.env
.env.*
dist/
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding
声明描述的是一个面向用户的医疗申报咨询/知识引导技能，而提供的代码并未实现任何申报咨询、路径判断、材料梳理、监管对接或咨询引导逻辑。相反，代码仅执行离线的内容打包与发布验证工作，属于开发/发布工具链脚本。其主要目的与声明用途明显不同。虽然打包脚本可能服务于该技能的交付，但这属于仓库工程能力，不是声明中的技能行为，因此应判定为描述与实际行为不匹配。

Hidden Instructions

High
Category
Prompt Injection
Content
<p class="subtitle">互联网医院申请全流程任务分工</p>
        </div>
        
        <!-- 第一阶段：环境准备 -->
        <div class="phase phase-1">
            <div class="phase-header">
                <div class="phase-number">①</div>
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
<p class="subtitle">互联网医院申请全流程任务分工</p>
        </div>
        
        <!-- 第一阶段:环境准备 -->
        <div class="phase phase-1">
            <div class="phase-header">
                <div class="phase-number">1</div>
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Missing User Warnings

High
Confidence
98% confidence
Finding
The workflow explicitly says the client needs to give a username and password to a third party ('乙方'). In a healthcare/regulatory context, this normalizes credential sharing, breaks basic access-control and audit principles, and can expose sensitive administrative systems or regulated data if the third party is compromised or misuses the account.

Ssd 3

High
Confidence
99% confidence
Finding
The plain-language instruction to hand over account credentials to another party is a direct insecure-practice issue. In a medical licensing and platform-integration workflow, credential sharing can enable unauthorized submissions, privilege abuse, loss of non-repudiation, and possible exposure of institution or patient-related information accessible through linked systems.

Natural-Language Policy Violations

Medium
Confidence
91% confidence
Finding
文件标题及全文说明均以中文编写，并明确面向山东申报场景，但未说明是否支持其他语言或允许用户选择输出语言。根据规则，若技能在自然语言层面强制特定语言而没有用户 opt-in，属于可报告的语言/locale 政策问题。

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

Natural-Language Policy Violations

Medium
Confidence
88% confidence
Finding
This markdown file presents all operational guidance in Chinese and does not indicate that the user can choose another language or that the skill is intentionally restricted to Chinese-speaking or region-specific users. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.

Natural-Language Policy Violations

Low
Confidence
84% confidence
Finding
The HTML declares lang="zh-CN" at L002 and all visible content is presented only in Chinese. Under the policy, forcing a specific language without user opt-in can be a natural-language policy issue when no language choice or explicit regional justification is provided in the file.

Natural-Language Policy Violations

Low
Confidence
89% confidence
Finding
The page sets `lang="zh-CN"`, and all visible content is presented only in Chinese. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation when no language choice or justification is provided.

Natural-Language Policy Violations

Low
Confidence
92% confidence
Finding
The `scope` field is written entirely in Chinese, which imposes a specific language context in the manifest metadata without any indication of user language choice or locale opt-in. The file does not document that this is a region-specific or Chinese-only skill context, so this appears to be a natural-language locale constraint rather than an explicitly justified one.

Static analysis

No suspicious patterns detected.