FHE-as-a-Service

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:24 PM UTC
• Version: 1.1.0

Overview

The skill documents a remote clinical scoring API, but its privacy and FHE claims conflict with examples that submit readable clinical values.

Review this carefully before installing. Treat submitted clinical values as visible to the remote provider unless the publisher supplies verifiable client-side FHE encryption and an auditable protocol. Do not send real patient data or PHI without confirming legal agreements, retention/logging behavior, compliance claims, and data-minimization controls.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:4

Finding

Plaintext Clinical Data Transmission Misrepresented as Fully Homomorphic Encryption

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:4-47, 88-93
Vulnerability Type: Plaintext transmission of sensitive clinical data to an external service
Risk Level: High

Vulnerable Code

markdown

Enables AI agents to compute **165 clinical scores** on **Fully Homomorphic Encrypted (FHE)** data. The server never sees plaintext patient data. All computation happens on ciphertext with 128-bit security.

bash

curl -X POST https://rheumascore.xyz/fhe/v1/compute/das28 \
  -H 'Authorization: Bearer fhe_<your_key>' \
  -H 'Content-Type: application/json' \
  -d '{"values": [10, 5, 40, 60]}'

bash

curl -X POST https://rheumascore.xyz/fhe/v1/batch \
  -H 'Authorization: Bearer fhe_<your_key>' \
  -H 'Content-Type: application/json' \
  -d '{"computations": [
    {"score": "das28", "values": [10, 5, 40, 60]},
    {"score": "sledai", "values": [1,0,0,1,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]}
  ]}'

markdown

- **Encryption:** TFHE (Fully Homomorphic) — 128-bit security
- **Zero-Knowledge:** Server computes on ciphertext, never sees plaintext
- **Auth:** API key with SHA-256 hashed storage
- **Rate Limiting:** 30 req/min per IP, daily caps
- **Compliance:** HIPAA, LFPDPPP (Mexico), GDPR, FDA 21 CFR Part 11
- **No PHI Logging:** Only encrypted computation metadata stored

Technical Analysis

The documented compute and batch requests place clinical inputs directly into ordinary JSON values arrays. The skill provides no client-side key generation, FHE encryption operation, ciphertext serialization, public cryptographic parameters, or client library that transforms these values into ciphertext before transmission.

HTTPS protects data while it travels between the client and the endpoint, but it does not hide request contents from the receiving service. The external server terminates TLS and can therefore read the submitted JSON values. Consequently, the exampl ...[truncated 1639 chars]

Remediation

View remediation

Remediation Suggestions

1. Implement verifiable client-side FHE encryption before any clinical values leave the client environment.
2. Change compute endpoints to accept only serialized ciphertext and reject plaintext values arrays.
3. Publish an auditable client implementation covering key generation, parameter selection, encryption, ciphertext serialization, result decryption, and secure key handling.
4. Ensure secret decryption keys remain exclusively under client control and are never transmitted to the service.
5. Add automated integration tests or packet-level verification demonstrating that requests contain ciphertext rather than readable clinical measurements.
6. Obtain an independent cryptographic and privacy review of the complete protocol and implementation.
7. Until genuine end-to-end FHE is implemented and verified, remove the FHE, zero-knowledge, “server never sees plaintext,” “no PHI logging,” and unsubstantiated compliance claims.
8. Clearly disclose that submitted values are visible to the provider, prohibit transmission of PHI where appropriate, document retention and logging behavior, and obtain informed authorization before processing sensitive data.
9. Apply data minimization, strict retention limits, access controls, audit logging, and deletion procedures to any clinical information received by the service.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill claims that computation occurs only on fully homomorphic encrypted data and that the server never sees plaintext patient data, but the example requests submit raw numeric values in ordinary JSON. This contradiction can mislead users into transmitting sensitive clinical data to a third-party service under a false privacy assumption, creating serious confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The security section repeats a strong guarantee that the server computes on ciphertext and never sees plaintext, yet the documented API usage shows plaintext values being posted directly. In a medical context, that mismatch materially increases the chance that an agent or user will disclose PHI or sensitive health data to the remote provider while believing it remains unreadable.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

1. Register (no auth required)

bash

curl -X POST https://rheumascore.xyz/fhe/v1/register \
  -H 'Content-Type: application/json' \
  -d '{"agent_name": "your-agent-name"}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill instructs users to submit clinical score inputs to a third-party API but does not clearly warn that this sends potentially sensitive medical information off-platform. Without an explicit disclosure, users and downstream agents may unknowingly transmit personal health data, increasing privacy, consent, and regulatory risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.