ClawHub
Back to skill

Security audit

simplepractice-fpx

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently supports reading your medical portal, with disclosed session access and explicit limits against payments or record changes.

Use your own practice's portal hostname and confirm the selected client before reading records. The agent will see sensitive health and billing information. Protect the cookie jar, remove it when finished, and review browser-pairing permissions if using that optional route. The external CLI and extension were not included in the reviewed artifact.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
70% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md
export SP_API="https://$sp_host/client-portal-api"
export SP_JAR="$HOME/.simplepractice-cookies"

# curl creates a cookie jar world-readable (644). This one holds a live
# session for a medical record, so create it 0600 BEFORE curl ever writes it.
[ -e "$SP_JAR" ] || ( umask 077; : > "$SP_JAR" )
chmod 600 "$SP_JAR"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

The four headers — all of them, on every call

sh
sp() { curl -s -b "$SP_JAR" -c "$SP_JAR" \
  -H 'Api-Version: 2026-05-25' \
  -H 'Application-Build-Version: 0.0.0' \
  -H 'Application-Platform: web' \

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 256)May include surrounding context.

md
`jq 'select(.attributes.hasDocumentPdf)'` are BOTH true for `"false"`.
  Compare against the string: `select(.attributes.hasDocumentPdf == "true")`.
  A card's `isDefault` is the same — so do not assume a JSON boolean anywhere
  in this API without checking the value you actually get back.
- `billing-items` is polymorphic: `.data[].type` tells you which of
  invoice / statement / superbill / receipt / payment a row actually is, and
  the attribute set differs per type. `.meta.endBalance` accompanies every