ClawHub
Back to skill

Security audit

UAE clinic-digital-health

Security checks for vulnerabilities and agentic risk

Overview

This is an informational UAE clinic technology guidance skill with no executable code, persistence, or hidden data access, though users should verify healthcare compliance details before acting on it.

Installers should treat this as general operational guidance, not legal, regulatory, or clinical approval. Before adopting any EMR, telemedicine platform, AI scribe, or data-sharing workflow, verify current UAE regulator requirements, patient consent wording, audio-recording disclosure, data residency, retention controls, and vendor processing terms.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger list is unusually broad for a healthcare-specific skill and includes generic phrases like clinic software, clinic app, patient portal, and clinic AI. In a healthcare context this can cause the skill to activate for ordinary software questions and provide regulated medical-technology, privacy, or compliance guidance where the user may not have asked for it, increasing the chance of mis-scoped or unsafe advice around sensitive health systems.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The AI scribe section recommends tools that record consultations and draft notes but does not prominently require explicit patient consent, audio-recording disclosure, retention limits, or vendor data-processing safeguards at the point of recommendation. Because this skill targets clinics handling sensitive health data, omission of these warnings could lead operators to deploy recording workflows that violate privacy expectations, local law, or professional obligations.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
## Data Protection — UAE Context

**Federal Law No. 45 of 2021** — UAE Personal Data Protection Law (PDPL):
- Patient data is protected; cannot share without consent
- Must notify patients of data collection and purpose
- Right to access, correct, and delete personal data
- Health data = sensitive data — stricter rules apply
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.