Veterinary Clinic Bundle

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:41 AM UTC
• Version: 1.0.1

Overview

This veterinary-clinic automation bundle is purpose-aligned, but it needs Review because it handles sensitive clinic and pet medical data with weak access controls and under-disclosed external AI processing.

Use this only in a controlled local or test environment unless you first add authentication, role-based authorization, random server-side sessions, endpoint restrictions, explicit consent and retention policies, DeepSeek disclosure or local-only mode, prompt redaction, safe text rendering instead of innerHTML, and pinned dependencies. Treat clinic, owner, and pet medical information entered into it as sensitive.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: main.py:695

Finding

Unauthenticated Access to Sensitive Clinic Data and Administrative Operations

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: main.py:131

Finding

Undisclosed Transmission of Potentially Sensitive Medical Data to DeepSeek

Content

View full analysis

str: """Call DeepSeek API if configured, else return None""" if not DEEPSEEK_API_KEY: return None try: import httpx resp = httpx.post("https://api.deepseek.com/v1/chat/completions", headers={"Authorization": f"Bearer {DEEPSEEK_API_KEY}", "Content-Type": "application/json"}, json={"model": "deepseek-chat", "messages": [ {"role": "system", "content": system or "你是VetClaw宠物医院AI助手。"}, {"role": "user", "content": prompt} ], "temperature": 0.3}, timeout=30) data = resp.json() return data["choices"][0]["message"]["content"] except Exception: return None ``` Laboratory input is forwarded in full: ```python llm_resp = llm_chat( f"请用通俗语言解读以下宠物化验结果，标注异常指标并说明可能含义：\n{message}", "你是兽医AI助手，用简洁易懂的中文解读宠物化验单。不要做诊断，只解读数值含义。" ) ``` Knowledge-base fallback input is also forwarded in full: ```python llm_resp = llm_chat( message, "你是宠物医疗知识问答助手。用简洁中文回答宠物健康问题，不要做诊断，只提供参考信息。建议复杂问题就医。" ) ``` The documented privacy assurance conflicts with this behavior. `SKILL.md:179-180` states: ```text ### Q: 数据安全吗？ A: 所有数据存储在本地或您选择的云服务，不会共享给第三方。符合《个人信息保护法》要求。 ``` ### Technical Analysis When `DEEPSEEK_API_KEY` is configured, the application sends complete user messages to `https://api.deepseek.com/v1/chat/completions`. No code removes names, telephone numbers, account identifiers, pet identifiers, free-form clinical notes, or other sensitive information before transmission. The affected paths include laboratory interpretation, veterinary health questions, and unmatched messages routed through the AI receptionist. A user may reasonably include owner de ...[truncated 1667 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: templates/index.html:112

Finding

Unsafe HTML Rendering of User and LLM-Controlled Chat Content

Content

View full analysis

${skillNames[skill]||skill}
`; } html += `

${text}

`; bubble.innerHTML = html; div.appendChild(bubble); chat.appendChild(div); chat.scrollTop = chat.scrollHeight; } ``` The vulnerable function receives direct user input and server responses: ```javascript addMsg(msg, true); ... addMsg(data.response || '抱歉，处理出错', false, data.skill); ``` ### Technical Analysis The `text` value is inserted into an HTML template and assigned to `innerHTML` without contextual escaping or sanitization. Browser parsing therefore treats attacker-controlled markup as active HTML rather than plain text. Both direct user messages and server-generated responses reach this sink. Server responses may include content derived from user input or ret ...[truncated 2056 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned Dependencies Permit Unreviewed Future Package Versions

Content

View full analysis

=0.104.0 uvicorn>=0.24.0 python-dotenv>=1.0.0 jinja2>=3.1.0 aiofiles>=23.0.0 ``` The documented installation process resolves these constraints directly: ```text pip install -r requirements.txt ``` ### Technical Analysis Every dependency is specified using an open-ended minimum-version constraint. A new installation can therefore resolve to any future release accepted by the package resolver. The project does not provide a lockfile, exact transitive dependency versions, package hashes, or an integrity-verification procedure. No malicious package or currently vulnerable resolved version was confirmed during the audit. The finding concerns the unsafe dependency-management policy: reviewed source code does not determine the code that will actually be installed in the future. If an upstream account, release process, package index, or dependency is compromised, a later installation may automatically consume the affected version. Unbounded upgrades can also introduce breaking security behavior without any project change or review. ### Attack Path 1. An operator follows the documented installation command. 2. `pip` queries the configured package index and selects the newest versions satisfying the open-ended constraints. 3. A compromised, malicious, or security-regressed future package version satisfies the constraints. 4. The package and its transitive dependencies are installed without comparison against a reviewed lockfile or expected hashes. 5. Package code executes during application runtime and, where applicable, installation or build processing. 6. The compromised dependency obtains the same filesystem, environment-variable, database, and network privileges as the VetClaw process. ### Impact Assessment A compromised dependen ...[truncated 532 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (211)

Tainted flow: 'DEEPSEEK_API_KEY' from os.getenv (line 131, credential/environment) → httpx.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · main.py (reported line 139)May include surrounding context.

python

return None
    try:
        import httpx
        resp = httpx.post("https://api.deepseek.com/v1/chat/completions",
            headers={"Authorization": f"Bearer {DEEPSEEK_API_KEY}", "Content-Type": "application/json"},
            json={"model": "deepseek-chat", "messages": [
                {"role": "system", "content": system or "你是VetClaw宠物医院AI助手。"},

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 147)May include surrounding context.

bash

cd business/skill-bundles/veterinary-clinic-bundle
pip install -r requirements.txt
copy .env.example .env       # 可选：配置DeepSeek API Key
py main.py
# 访问 http://localhost:8000

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Using 'default routing' for the AI front desk means ambiguous or unmatched user input may be automatically processed by a broad LLM-driven handler. For a system handling medical inquiries and customer data, this raises the risk of over-collection of sensitive data, incorrect triage, and unintended autonomous actions without clear user intent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The documented behavior claims a broad 52-skill veterinary automation suite, while the analyzed content reportedly does not implement or substantiate those capabilities consistently. This mismatch is dangerous because operators may trust the package to perform validated medical-office workflows or controls that are not actually present, leading to unsafe deployment assumptions and hidden functionality risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

User-provided chat content, including veterinary medical details and potentially personal contact data, is sent to DeepSeek without any visible consent, disclosure, minimization, or opt-out mechanism. This creates a privacy and compliance risk because sensitive data leaves the local system and is processed by a third party.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The medical record lookup skill returns recent records based only on a pet name match, with no verification that the requester is authorized to view that pet's information. Because records include symptoms, diagnoses, and treatment, this permits unauthorized disclosure of sensitive medical data through normal chat interaction.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The conversation endpoint exposes all prior messages for any provided session identifier, enabling direct retrieval of sensitive plain-language interactions. Since session IDs are client-controlled and no auth checks exist, this is a straightforward data exposure issue in a medical-adjacent context.

Content

No source excerpt is available for this finding.

Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'

High

• Category: Supply Chain
• Confidence: 70% confidence

Finding

Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill declares its trigger as '自动触发' and the usage says the AI should 'automatically identify intent and execute corresponding operations,' which is overly broad and can cause unintended invocation. In a veterinary clinic context, ambiguous activation could trigger customer-facing messages or downstream automation without clear user intent, creating privacy, workflow, and authorization risks.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger phrases "设备" and "维护" are very broad and are likely to appear in ordinary veterinary conversations, causing the skill to activate unintentionally. In a clinic context, accidental activation could lead to incorrect workflow execution, confusion around maintenance tasks, or unintended handling of operational data, even if the skill itself is not overtly malicious.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill declares an automatic trigger and says the AI will identify intent and execute actions, but it does not define clear activation boundaries, user confirmation requirements, or permitted actions. In a veterinary workflow handling scheduling, records, and follow-up tasks, ambiguous triggering can cause unintended automation, accidental processing of sensitive data, or actions taken in the wrong context.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill declares the trigger as '自动触发' without defining clear activation boundaries, required context, or explicit user consent. In a phone-handling workflow for a veterinary clinic, this can cause unintended activation during unrelated conversations, leading to accidental call handling actions, misclassification of caller intent, or unauthorized processing of sensitive personal and pet medical information.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger phrases "什么病", "怎么办", and "症状" are generic medical-conversation terms that are likely to appear in normal user dialogue, making accidental or unintended skill activation plausible. In a veterinary context, unintended activation can cause the system to provide knowledge-base answers in situations involving medical advice, which increases the risk of inappropriate guidance, workflow confusion, or disclosure/use of sensitive case context without clear user intent.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · templates/index.html (reported line 22)May include surrounding context.

html

</style>
</head>
<body class="bg-gray-50 min-h-screen">
    <!-- Header -->
    <header class="bg-gradient-to-r from-green-600 to-teal-600 text-white shadow-lg">
        <div class="max-w-4xl mx-auto px-4 py-4">
            <div class="flex items-center justify-between">

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The README content, labels, examples, and trigger phrases are all Chinese, which effectively imposes a single language experience in the user-facing documentation. There is no indication that users can opt into another language or that the package is intentionally limited to a Chinese-language deployment context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README promotes automation for customer intake, medical records, scheduling, payments, and inventory without any visible discussion of privacy boundaries, consent, retention, access control, or human review. In a clinic setting, this can lead deployers to expose personally identifiable information and pet medical data through poorly governed automated workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Outbound messaging and AI phone handling are described as fully automated, but the documentation does not mention consent, call disclosure, lawful messaging practices, or data minimization. This can cause unauthorized contact, recording/privacy violations, and misuse of sensitive appointment or health information in customer communications.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documented trigger phrases are extremely generic (for example words like '症状', '什么病', '预约', '价格'), making accidental activation and misrouting likely during normal conversation. In a veterinary context this can cause unintended handling of appointment, medical-record, or triage workflows, increasing privacy exposure and the chance of unsafe automated responses.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill documents access to secrets, local files, networking, and installation/configuration behavior, but it does not declare any explicit tool scope or permission boundaries. In an agent environment, this increases the risk of over-privileged execution, unauthorized data access, and unsafe shell or network actions against sensitive clinic systems and patient/customer data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill description, triggers, examples, and user-facing content are entirely in Chinese, with no indication that users may choose another language or that the package is intentionally limited to a China-specific deployment context. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The intake skill states that customer and pet information will be automatically stored in a database, but the description does not clearly warn users or describe consent, retention, or access controls. Because this involves personally identifiable and potentially sensitive medical-adjacent records, silent collection and storage create privacy, compliance, and trust risks.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The appointment skill uses broad trigger terms like '预约', '挂号', and '看诊', which can appear in ordinary conversation and may activate the workflow unintentionally. In a veterinary clinic context, accidental activation could create or alter bookings, collect personal data, or send notifications without clear user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The phone AI and appointment flows involve automatic call handling and outbound notifications, but the documentation does not warn users about the privacy and consent implications of recording, processing, or messaging customer data. In a clinic environment, this can expose contact details, appointment status, and health-related context through automated channels without adequate disclosure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The emergency workflow includes vague single-word triggers such as '急' alongside symptom words, creating a substantial risk of false activation during normal conversation. In a triage setting, unintended emergency handling could misroute clients, generate alarming guidance, or interfere with urgent-care prioritization where accuracy and intent confirmation are critical.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This YAML file uses Chinese for comments, labels, service names, and scheduling values throughout, effectively imposing a specific language/locale on operators and downstream skills. The file does not offer a language choice or document that it is intended only for a Chinese-language deployment context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.