ClawHub
Back to skill

Security audit

Medical Advice

Security checks for vulnerabilities and agentic risk

Overview

This medical advice skill is purpose-aligned and disclosed, but users should treat its health guidance as informational and be aware that medical query terms may be sent to NIH/OpenFDA services.

Install only if you are comfortable using a Chinese-first medical information helper. Do not rely on it for diagnosis or emergencies, and avoid sending personally identifying health details in API-backed searches unless you intend those terms to be queried against NIH/OpenFDA services.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (14)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
声明描述的是一个较完整的医疗咨询与决策支持技能，而提供的代码片段只是一个面向 OpenFDA 的药品信息/不良事件查询脚本。虽然这与声明中“集成 OpenFDA 药品信息查询”部分一致，但无法覆盖声明的主要功能，且也未体现 PubMed 集成。因此描述显著高估了该技能的实际能力，属于描述与行为不匹配。

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding
从代码看，唯一能力是调用 NCBI ESearch 和 ESummary 接口检索 PMC 文献，并输出标题、作者、期刊、日期、摘要和链接。这与声明中的核心用途“提供医疗咨询和就医建议”不符，因为代码没有接收结构化症状/病史并进行分析，也没有生成任何诊疗建议、分诊建议或药品信息查询。虽然声明中提到“集成 PubMed 医学文献搜索”，该部分与代码一致，但整体声明覆盖了大量未实现的核心医疗能力，因此描述不能准确代表该代码块的实际行为。未发现额外敏感或恶意的未声明能力；问题主要是声明远宽于实际实现。

Anti-Refusal Statement

High
Category
Anti-Refusal
Content
'manufacturer': item.get('manufacturer_name', ['Unknown'])[0],
                            'purpose': item.get('purpose', ['N/A'])[0],
                            'indication': extract_text_from_fda_format(item.get('indications_and_usage', [])),
                            'warning': extract_text_from_fda_format(item.get('warnings', []))[:300] + '...' if item.get('warnings') else 'No warnings listed',
                            'dosage': extract_text_from_fda_format(item.get('dosage_and_administration', []))[:300] + '...' if item.get('dosage_and_administration') else 'No dosage info',
                            'active_ingredient': item.get('active_ingredient', []),
                            'route': item.get('route', ['Unknown'])[0],
Confidence
80% confidence
Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Anti-Refusal Statement

High
Category
Anti-Refusal
Content
'manufacturer': item.get('manufacturer_name', ['Unknown'])[0],
                            'purpose': item.get('purpose', ['N/A'])[0],
                            'indication': extract_text_from_fda_format(item.get('indications_and_usage', [])),
                            'warning': extract_text_from_fda_format(item.get('warnings', []))[:300] + '...' if item.get('warnings') else 'No warnings listed',
                            'dosage': extract_text_from_fda_format(item.get('dosage_and_administration', []))[:300] + '...' if item.get('dosage_and_administration') else 'No dosage info',
                            'active_ingredient': item.get('active_ingredient', []),
                            'route': item.get('route', ['Unknown'])[0],
Confidence
80% confidence
Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Natural-Language Policy Violations

Medium
Confidence
94% confidence
Finding
The README states '支持中文界面输出', and the overall document presents the skill as Chinese-first without indicating that users can choose another language. Per the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation.

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill instructs the agent to perform network-backed API lookups to PubMed and OpenFDA, but it does not declare any explicit tool scope such as allowed-tools or permissions. This creates a governance gap where network access may be invoked without least-privilege constraints, increasing the chance of unintended external requests, data leakage, or policy bypass in a medical context.

Natural-Language Policy Violations

Medium
Confidence
85% confidence
Finding
Forcing Chinese-language behavior across the full skill without user opt-in can create safety and consent issues, especially in medical contexts where misunderstanding dosage, warnings, or triage advice can have real consequences. It also reduces accessibility for users who did not request Chinese and may distort quoted source material from external medical resources.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger conditions are broad enough to capture many ordinary health-related queries, causing the skill to activate in situations where a narrower or safer response path might be preferable. In a medical skill, overbroad invocation increases the risk of unnecessary collection of sensitive health details and of users receiving quasi-medical guidance outside an appropriately constrained workflow.

Natural-Language Policy Violations

Medium
Confidence
97% confidence
Finding
The file description and user-facing content indicate the skill is designed to respond in Chinese, and the later response strings are likewise hard-coded in that language. This creates a language/locale policy issue because the skill forces a specific language without user opt-in or an explicit documented regional constraint.

External Transmission

Medium
Category
Data Exfiltration
Content
"warning": "⚠️ 过敏警告：可能导致严重过敏反应\n⚠️ 胃出血警告：含有 NSAID，可能引起严重胃出血\n⚠️ 心脏病和中风警告：增加心脏病发作和中风风险",
        "active_ingredient": "Ibuprofen USP, 200 mg (NSAID)",
        "route": "Oral",
        "source_url": "https://api.fda.gov/drug/label.json"
    }
]
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
"warning": "⚠️ 过敏警告：可能导致严重过敏反应\n⚠️ 胃出血警告：含有 NSAID，可能引起严重胃出血\n⚠️ 心脏病和中风警告：增加心脏病发作和中风风险",
        "active_ingredient": "Ibuprofen USP, 200 mg (NSAID)",
        "route": "Oral",
        "source_url": "https://api.fda.gov/drug/label.json"
    }
]
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Medium
Confidence
96% confidence
Finding
This Python file contains multiple user-facing strings in Chinese, including error messages and formatted output, while the CLI description and usage text are in English. That creates a language/locale policy issue because the skill imposes a specific language on users without offering a choice or documenting that the tool is intended only for Chinese-speaking users.

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
The code claims to search PubMed but actually queries the PMC database, then labels returned identifiers as PMIDs and builds PubMed links from them. In a medical-advice skill, this data provenance mismatch can mislead users or downstream agents about what literature was retrieved, causing incorrect citations, broken links, or unsafe trust in evidence used for medical guidance.

Natural-Language Policy Violations

Medium
Confidence
88% confidence
Finding
This code hard-codes Chinese messages such as '未找到相关文献' and '找到 ... 篇相关文献' while the rest of the tool is described in English. That creates a language/locale policy concern because users are forced into a specific output language with no opt-in, selection mechanism, or stated region-specific justification.

Static analysis

No suspicious patterns detected.