Mentx Doctor 医疗助手

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:25 PM UTC
• Version: 2.0.0

Overview

This medical skill has a coherent purpose, but it can automatically send sensitive health information to an external service without enough user consent, scoping, or local data safeguards.

Install only if you are comfortable sending health questions and medical files to Mentx.com. Before use, confirm what data is sent, how it is retained, and who can access it; avoid broad automatic triggering for casual health mentions, avoid storing API keys in shell startup files when possible, and do not run this on shared machines until the /tmp report storage and task ID validation issues are fixed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/mentx-api.sh:111

Finding

Path Traversal Enables Unauthorized File Read and Deletion

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/mentx-api.sh:13

Finding

Predictable Shared Temporary Files Expose Sensitive Medical Reports

Content

View full analysis

"$result_file" echo "completed" > "$status_file" echo -e "${BLUE}[任务 $task_id] 报告已生成，保存到：$result_file${NC}" ) & ``` ### Technical Analysis The script uses a fixed, shared directory under `/tmp` and creates it without explicitly restrictive permissions. It also does not set a restrictive process `umask`. Task filenames are generated from the current Unix timestamp and process ID. These values are predictable or can often be observed by another local user. Files are created using ordinary shell redirection, which: - Does not guarantee exclusive atomic creation. - Follows pre-existing symbolic links. - Does not verify file ownership or type. - Applies permissions according to the ambient `umask`. - Allows interaction with names in a shared, predictable directory. The result file contains the full response from the medical API and may therefore hold highly sensitive health information. The initial status write and subsequent result write can both target attacker-prepared filesystem objects if symbolic li ...[truncated 1373 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/mentx-api.sh:64

Finding

Untrusted Input Is Interpolated Directly into JSON Requests

Content

View full analysis

Remediation

View remediation

/dev/null 2>&1 <<<"$files_json"; then echo "Invalid files JSON" >&2 return 1 fi ``` 3. Validate every file object against an allowlist of expected fields and data types. 4. Pass validated file data using `jq --argjson` rather than raw string interpolation. 5. Enforce reasonable input-length limits for messages, identifiers, and file arrays. 6. Treat API validation failures separately from successful report completion and avoid marking malformed or error responses as successfully completed reports. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · README.md (reported line 14)May include surrounding context.

mentx@doctor 技能

医疗辅助决策报告生成助手 - 为用户提供医疗健康问题的辅助分析与参考报告。

快速开始

1. 配置 API 密钥

bash

# 临时设置（当前会话）
export MENTX_API_KEY="your_api_key_here"

# 永久设置（添加到 ~/.bashrc 或 ~/.zshrc）
echo 'export MENTX_API_KEY="your_api_key_here"' >> ~/.bashrc
source ~/.bashrc

获取密钥：https://developer.mentx.com/

2. 验证配置

bash

cd ~/.openclaw/workspace/skills/mentx-doctor
./scripts/mentx-api.sh check_key

3. 使用方式

在对话中直接描述健康问题，技能会自动触发：

• 纯文字描述："最近头晕乏力，有高血压家族史"
• 图文混合：上传医学影像图片 + 文字描述

4. 紧急症状处理

如检测到胸痛、呼吸困难等紧急症状，会立即提示就医。

---

文件结构

text

mentx-doctor/
�

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill describes accepting symptom text, medical documents, images, and then asynchronously sending them to a professional medical API, but it does not clearly warn users that sensitive health data will be transmitted off-platform. In a healthcare context, omission of explicit disclosure and consent is a serious privacy and compliance risk, especially when files and potentially identifying data are involved.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script uploads user-provided files to an external medical API and provides no built-in disclosure, consent gate, or privacy warning at the point of transfer. Because these files may contain sensitive medical records, transmitting them off-system without explicit user awareness can create serious privacy, compliance, and data-governance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script sends user medical messages, identifiers, and optionally attached file references to an external API without explicit notice in the execution flow. In a medical-assistant context, this increases the sensitivity of the transmission because both free-text symptoms and user IDs may constitute personal or regulated health information.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README says users can directly describe health problems and that the skill will "automatically trigger," using very broad natural-language examples. In an agent environment, such loose activation criteria can overlap with ordinary conversation and cause unintended invocation on sensitive medical content, which may route private data to an external service or produce unsolicited medical guidance.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

“仅限中国大陆用户使用”属于语言/地域范围限制的自然语言策略约束，但 README 未说明用户可选择其他地区模式，也未解释该限制的合规或业务必要性。按规则，这类未提供 opt-in 或明确正当依据的地域限制应视为潜在政策违规。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill states that the initial 'emotional comfort' phase excludes medical analysis, but later instructs the agent to ask symptom-triage questions and suggest actions like drinking warm water, resting, and breathing exercises. In a medical context, these are health-related recommendations and can blur the boundary between emotional support and clinical guidance, increasing the risk that users rely on unvalidated advice before a professional review is available.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger conditions are broad enough to activate on ordinary conversation about health, stress, reports, or common symptoms, which can cause inadvertent collection and forwarding of sensitive medical information. Because this skill invokes a backend medical API, over-triggering increases privacy exposure and the chance that users receive medical-style handling when they did not clearly request it.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The boundary statement says emotional comfort contains no health advice, diagnosis hints, or health suggestions, yet the examples direct the agent to gather symptom details and provide self-care guidance. This inconsistency is dangerous because implementers and users may misunderstand what the system is permitted to do, leading to unsupervised pseudo-triage in a high-stakes medical setting.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The statement "仅限中国大陆用户使用" is a natural-language locale restriction that excludes users by region, but the document does not provide user choice or a clear compliance justification for the limitation. Under the policy rule, forced locale or region constraints without opt-in or documented necessity should be flagged.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

This code performs deliberate external transmission of user-supplied medical content to a third-party service. While external API use is expected for this skill's purpose, the medical context makes the transfer more dangerous because highly sensitive data leaves the local environment and is handled by a remote provider.

Content

Scanner excerpt · scripts/mentx-api.sh (reported line 100)May include surrounding context.

sh

(
    echo -e "${BLUE}[任务 $task_id] 开始生成医疗报告...${NC}"
    
    response=$(curl -s -X POST "https://developer.mentx.com/v1/chat/completions" \
      -H "Authorization: Bearer $MENTX_API_KEY" \
      -H "Content-Type: application/json" \
      -d "$request_body")

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Comments and all user-visible messages are written in Chinese, and the script does not offer any option to select another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The comment says the enhanced version supports '等待期间可提供情绪陪伴' (provide emotional companionship while waiting). In practice, the polling logic only sleeps, checks status, and emits progress messages to stderr; there is no logic that provides supportive or conversational output during waiting.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.