VetClaw Bundle

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:42 AM UTC
• Version: 1.0.1

Overview

VetClaw’s clinic automation purpose is coherent, but it handles sensitive customer, pet, medical, and business data through unauthenticated network APIs and under-disclosed third-party LLM sharing.

Review before installing or deploying. Run it only on a private localhost or behind real authentication, do not put real clinic/customer records into it until authorization, session ownership, XSS protection, retention controls, and privacy notices are fixed, and treat DeepSeek integration as third-party data sharing that needs explicit consent and minimization.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: main.py:660

Finding

Unauthenticated Access to Sensitive Clinic Data and Administrative Operations

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: templates/index.html:83

Finding

DOM-Based Cross-Site Scripting Through Unsanitized Chat Content

Content

View full analysis

${skillNames[skill]||skill}
`; } html += `

${text}

`; bubble.innerHTML = html; div.appendChild(bubble); chat.appendChild(div); chat.scrollTop = chat.scrollHeight; } ``` ### Technical Analysis The `text` parameter is inserted into an HTML string and assigned to `bubble.innerHTML`. No HTML escaping or sanitization occurs. The parameter can contain: - Text entered directly by a user. - Content returned by the server. - Content produced by the externally hosted LLM. - Potentially persisted conversation content stored by `/api/chat`. Because `innerHTML` interprets markup rather than displaying it as text, an attacker can supply elements with event handlers, such as an image with an `onerr ...[truncated 1743 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: main.py:133

Finding

Potentially Sensitive Medical and Conversation Content Is Sent to DeepSeek Without Data Minimization or Accurate Disclosure

Content

View full analysis

str: """Call DeepSeek API if configured, else return None""" if not DEEPSEEK_API_KEY: return None try: import httpx resp = httpx.post("https://api.deepseek.com/v1/chat/completions", headers={"Authorization": f"Bearer {DEEPSEEK_API_KEY}", "Content-Type": "application/json"}, json={"model": "deepseek-chat", "messages": [ {"role": "system", "content": system or "你是VetClaw宠物医院AI助手。"}, {"role": "user", "content": prompt} ], "temperature": 0.3}, timeout=30) data = resp.json() return data["choices"][0]["message"]["content"] except Exception: return None ``` Laboratory content is passed directly to that function: ```python @register_skill("vet-lab-interpret") def handle_lab_interpret(message: str, config: dict) -> str: """化验单解读""" # Try LLM first llm_resp = llm_chat( f"请用通俗语言解读以下宠物化验结果，标注异常指标并说明可能含义：\n{message}", "你是兽医AI助手，用简洁易懂的中文解读宠物化验单。不要做诊断，只解读数值含义。" ) if llm_resp: return f"🔬 化验单解读\n\n{llm_resp}" ``` General health questions are also transmitted: ```python # Try LLM llm_resp = llm_chat( message, "你是宠物医疗知识问答助手。用简洁中文回答宠物健康问题，不要做诊断，只提供参考信息。建议复杂问题就医。" ) if llm_resp: return f"📖 知识库回复\n\n{llm_resp}\n\n⚠️ 仅供参考，请以兽医诊断为准。" ``` The project documentation states at `SKILL.md:181-182` that data is not shared with third parties: ```markdown ### Q: 数据安全吗？ A: 所有数据存储在本地或您选择的云服务，不会共享给第三方。符合《个人信息保护法》要求。 ``` ### Technical Analysis When `DEEPSEEK_API_KEY` is set, the application sends the complete `prompt` to `https://api.deepseek.com/v1/chat/completions`. The transmitte ...[truncated 1928 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Non-Reproducible Dependency Resolution and Undeclared Runtime Dependencies

Content

View full analysis

=0.104.0 uvicorn>=0.24.0 python-dotenv>=1.0.0 jinja2>=3.1.0 aiofiles>=23.0.0 ``` Runtime code additionally imports packages not listed in `requirements.txt`: ```python try: import yaml return yaml.safe_load(cfg_file.read_text(encoding="utf-8")) or {} except ImportError: pass ``` ```python try: import httpx resp = httpx.post("https://api.deepseek.com/v1/chat/completions", ``` ### Technical Analysis All declared dependencies use open-ended lower bounds. A deployment performed later can therefore install substantially different, unreviewed versions from those used during development or audit. This prevents reproducible builds and broadens the supply-chain trust boundary. The application also directly imports `httpx` and conditionally imports `yaml`, but neither `httpx` nor `PyYAML` is declared. Their availability depends on transitive dependencies or the deployment environment. This can produce environment-dependent behavior: - LLM requests silently fail when `httpx` is unavailable because all exceptions are suppressed. - YAML configuration is silently ignored when `PyYAML` is unavailable. - A manually installed or unexpected package can become part of the runtime without review. No evidence was found of typosquatted package names, dependency confusion through private package names, or an actively malicious dependency. The risk arises from unbounded and incomplete dependency management. ### Attack Path 1. An operator runs `pip install -r requirements.txt`. 2. The package resolver selects the newest versions satisfying the open-ended constraints. 3. Those versions may differ from the versions previously tested or audited. 4. A compromised upstream release, incompatible change, or vulnerable transitive ...[truncated 885 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (210)

Tainted flow: 'DEEPSEEK_API_KEY' from os.getenv (line 131, credential/environment) → httpx.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · main.py (reported line 139)May include surrounding context.

python

return None
    try:
        import httpx
        resp = httpx.post("https://api.deepseek.com/v1/chat/completions",
            headers={"Authorization": f"Bearer {DEEPSEEK_API_KEY}", "Content-Type": "application/json"},
            json={"model": "deepseek-chat", "messages": [
                {"role": "system", "content": system or "你是VetClaw宠物医院AI助手。"},

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README promotes automation of patient records, reminders, messaging, phone calls, payments, and database-backed operations but does not mention consent, retention, access control, audit logging, or privacy safeguards. In a veterinary clinic setting this still involves sensitive personal data, contact data, billing data, and potentially regulated medical/operational information, increasing the risk of unsafe deployment and privacy violations.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 147)May include surrounding context.

bash

cd business/skill-bundles/veterinary-clinic-bundle
pip install -r requirements.txt
copy .env.example .env       # 可选：配置DeepSeek API Key
py main.py
# 访问 http://localhost:8000

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

There is a clear description-behavior mismatch. The declared purpose presents a comprehensive veterinary clinic AI automation suite with many operational scenarios, but the actual code chunk only contains a simple placeholder handler labeled for package management and membership-related triggers. It performs no scheduling, recordkeeping, follow-up, analytics, or other substantive automation. No suspicious undeclared access or permissions are present, but the primary purpose and implemented scope are materially narrower than described.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The description presents a broad veterinary clinic automation suite with many operational scenarios. The actual code chunk is a single lightweight handler for 'appointment reminder' and does not implement any substantive automation behavior beyond returning a placeholder message. There is no evidence of scheduling management, medical record handling, customer follow-up, or business analytics. This is a material description-versus-behavior mismatch in scope and implemented purpose, even though the reminder theme is adjacent to clinic operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents a broad veterinary clinic automation suite focused on operational and clinical workflows. The actual code chunk is a narrowly scoped placeholder for new employee training, with no logic for scheduling, medical records, customer follow-up, or business analysis. Its embedded trigger words are training-related and not aligned with the declared scenarios. This is a material purpose mismatch rather than a minor implementation detail.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill states that customer and pet information is automatically stored in a database, but it does not warn about consent, minimization, retention, access control, or handling of medical-adjacent personal data. Because this bundle targets clinics, the context makes the issue more dangerous: records may contain identity, contact, and treatment-related details that require stronger privacy controls.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Automatic call handling and intent recognition involve collection and processing of voice, contact, and potentially health-related information, but the description lacks any consent, notice, retention, or recording safeguards. In a veterinary clinic context, this can lead to unlawful or unethical surveillance, privacy complaints, and disclosure of sensitive client/pet medical information.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

User prompts, including medical questions and possibly personal/contact information, are sent to DeepSeek when the API key is configured, without any user warning or opt-in. This creates third-party data disclosure risk and may violate expectations or policy requirements for handling medical and customer data. The veterinary context increases sensitivity because the chat can include health information plus owner contact details.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The /api/conversation/{session_id} endpoint returns stored conversation history for any supplied session ID with no authentication or authorization checks. Because conversations may contain client identities, phone numbers, pet medical details, and operational data, an attacker who guesses or enumerates session IDs can read sensitive records. In a veterinary context handling medical and contact data, this is more dangerous than a generic chatbot log leak.

Content

No source excerpt is available for this finding.

Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'

High

• Category: Supply Chain
• Confidence: 70% confidence

Finding

Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill declares its trigger as '自动触发' (auto-trigger) while the usage section also says users should input a trigger word, creating ambiguity about when the skill activates. Overly broad or unspecified activation can cause the agent to invoke the skill on unrelated conversations, potentially exposing pet owner data, generating unintended outbound messages, or performing workflow actions without clear user intent.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The trigger phrases "设备" and "维护" are very broad, common terms that are likely to appear in ordinary veterinary operations conversations. This can cause accidental invocation of the skill in unrelated contexts, leading to unintended actions, workflow confusion, or exposure of maintenance-related data/functions without clear user intent.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill declares an automatic trigger without defining concrete activation phrases, scope, or guardrails, which can cause the agent to invoke the skill in unintended contexts. In a veterinary workflow, this could lead to unsolicited collection of customer satisfaction data, mishandling of patient/client context, or activation during unrelated conversations where personal information is present.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill declares an automatic trigger and says the AI will automatically identify intent and execute actions, but it does not define clear activation boundaries, confirmation requirements, or action limits. In a phone-handling context for a veterinary clinic, this ambiguity can cause unintended processing of caller data or unauthorized workflow execution, especially when conversations may contain sensitive personal and pet medical information.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The trigger phrases "手术" and especially "术前" are broad enough to match ordinary veterinary conversations, making accidental or inappropriate activation likely. In a medical workflow skill, unintended invocation can surface or execute checklist logic at the wrong time, creating workflow confusion, premature actions, or incorrect reliance on automation during clinical preparation.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · templates/index.html (reported line 22)May include surrounding context.

html

</style>
</head>
<body class="bg-gray-50 min-h-screen">
    <!-- Header -->
    <header class="bg-gradient-to-r from-green-600 to-teal-600 text-white shadow-lg">
        <div class="max-w-4xl mx-auto px-4 py-4">
            <div class="flex items-center justify-between">

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documented trigger phrases are extremely broad everyday terms such as symptom words and common service words, which can cause accidental invocation of medical, scheduling, or record-related workflows during normal conversation. In a veterinary clinic context, unintended activation can lead to incorrect triage, mistaken record actions, or disclosure of sensitive customer/pet information through the wrong workflow.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

A default route of 'AI front desk' without clear boundaries means unmatched or ambiguous user input may be automatically processed by a powerful fallback handler. In this skill bundle, that handler appears able to perform or initiate customer-service, scheduling, and possibly health-related actions, so ambiguous routing can cause over-collection of data, misclassification, or execution of unintended workflows.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence

Finding

The skill advertises configuration that involves environment secrets, storage, notifications, and likely external integrations, but it does not declare any explicit tool scope or allowed-tools boundary. In an agent platform, undocumented access to env, file, network, or shell increases the chance of over-privileged execution, unintended data access, and harder review of what the skill is allowed to do.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Broad triggers like '预约', '挂号', and '看诊' are common phrases that may appear in routine conversation and can activate booking workflows unintentionally. In a clinic setting, false activations could create erroneous appointments, expose patient data in the wrong context, or cause workflow confusion during customer interactions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Emergency activation terms such as '急', '危险', or symptom fragments are vague and likely to appear in many unrelated conversations, making unintended triage activation plausible. In a medical-adjacent workflow, false positives or misrouting can distract staff, delay genuine emergencies, or generate unsafe automated guidance at the wrong time.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document claims the bundle only handles administrative and communication tasks, yet earlier sections explicitly describe lab-result interpretation and emergency triage. In a veterinary context, this contradiction can cause operators to underestimate clinical decision support behavior, leading to unsafe reliance on AI for health-related judgment and possible harm to animals.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This JSON knowledge base uses Chinese-only natural-language keys and advice throughout, with no indication that language selection is configurable or optional. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The sample conversation includes directly identifiable personal data such as a real-name style identifier, phone number, and pet medical/profile details, and it explicitly states the data is being created and retained in a customer record. In documentation for an operational veterinary automation skill, this can normalize collecting and storing sensitive customer information without any notice about consent, minimization, masking, retention, or compliance obligations, increasing the risk of privacy violations or downstream misuse.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.