Safety Netting

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:37 AM UTC
• Version: 1.0.0

Overview

The skill has a coherent healthcare follow-up purpose, but it asks to handle and store identifiable patient medical data and use broad backend credentials without enough safeguards.

Review this before installing in any real clinical setting. It should use an approved encrypted clinical datastore, narrowly scoped credentials instead of a service-role key, documented patient consent and verified contact channels, minimized message content, retention/deletion rules, and governance for any learning data derived from patient interactions.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:91

Finding

Unprotected Persistence of Identifiable Patient and Clinical Data

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 91–125
Vulnerability Type: Plaintext or insufficiently protected storage of sensitive health information
Risk Level: High

Vulnerable Code Snippet

markdown

Store: when contacted, patient's exact response, which flags matched, decision made. This is the audit trail.

## Memory

Store active safety nets in memory/. Each entry:
- Patient name, contact, condition, timeframe, red flags
- Status: pending → sent → resolved/escalated
- GP name for escalation routing

## Learning

Track in learning/:
- Was the escalation correct? (GP confirmed or overrode)
- Which follow-up message phrasing got the best response rate?
- Which red flag keywords matched most accurately?

Use this to improve matching accuracy and message effectiveness over time.

Technical Analysis

The skill explicitly instructs the agent to retain patient names, contact information, clinical conditions, red flags, exact patient responses, escalation decisions, and GP feedback in the memory/ and learning/ directories.

These records combine direct identifiers with sensitive health information. The instructions do not establish encryption at rest, access-control boundaries, data minimization, retention limits, secure deletion, consent handling, de-identification, or separation between operational records and learning data.

Storing exact patient responses and clinical outcomes in persistent learning storage also creates a risk that information will remain available after the operational safety-net case has ended. Any process, user, or other skill able to read these directories could potentially access the retained records.

Attack Path

1. A GP creates a safety net containing a patient's identity, contact details, condition, and red flags.
2. The patient provides a response containing additional clinical information.
3. The skill stores the patient's exact respons ...[truncated 925 chars]

Remediation

View remediation

Remediation Suggestions

• Replace unspecified directory-based persistence with an approved encrypted clinical datastore.
• Encrypt sensitive records both in transit and at rest using centrally managed keys.
• Enforce role-based access controls so that users and services can access only the patients and practices they are authorized to manage.
• Separate direct identifiers from clinical records and use pseudonymous case identifiers wherever possible.
• Avoid placing exact patient responses or direct identifiers in learning datasets. Only use de-identified, minimized, and appropriately consented data for learning.
• Define explicit retention periods for pending, resolved, and escalated cases, followed by verifiable secure deletion.
• Record and audit every access, modification, export, and deletion involving patient records.
• Prevent other skills or unrelated processes from reading the storage location through filesystem permissions and runtime isolation.
• Document consent, lawful processing, incident-response, backup, and data-subject handling requirements before deployment in a clinical environment.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:5

Finding

Overprivileged Supabase Service-Role Credential Requirement

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 5–8
Vulnerability Type: Excessive backend privileges and violation of least privilege
Risk Level: High

Vulnerable Code Snippet

yaml

env:
  - OPENMAIL_API_KEY
  - SUPABASE_URL
  - SUPABASE_SERVICE_ROLE_KEY

Technical Analysis

The skill requires a SUPABASE_SERVICE_ROLE_KEY, although its documented workflow only requires narrowly scoped operations such as creating, reading, and updating safety-net records.

A Supabase service-role credential commonly grants broad backend authority and can bypass normal row-level authorization controls. Making this credential available to the skill runtime therefore exceeds the minimum privileges required for individual patient follow-up operations.

The documentation does not specify credential isolation, token expiration, rotation, allowed operations, tenant restrictions, or controls preventing the credential from entering agent-visible context, logs, error messages, or child processes. Although the key itself is not hardcoded in the repository, requiring it in the runtime environment creates a high-impact credential target.

Attack Path

1. The skill is deployed with SUPABASE_SERVICE_ROLE_KEY in its environment.
2. The agent runtime, a co-located component, diagnostic output, or a compromised process gains access to the environment value.
3. The exposed credential is used directly against the configured Supabase backend.
4. Because a service-role credential may bypass ordinary row-level restrictions, the attacker accesses or modifies records outside the current patient or GP context.
5. The attacker may retrieve patient records in bulk, alter safety-net statuses, delete audit data, or insert misleading clinical follow-up information within the privileges granted to that role.

Impact Assessment

Compromise of this credential could provide backend privileges substantially broader than thos ...[truncated 477 chars]

Remediation

View remediation

Remediation Suggestions

• Do not expose a Supabase service-role key to the agent or general skill runtime.
• Place privileged database operations behind a dedicated server-side API that validates the authenticated GP, practice, patient, case, and requested operation.
• Issue narrowly scoped, short-lived tokens rather than long-lived administrative credentials.
• Enforce row-level security and tenant isolation for every patient-facing and GP-facing database operation.
• Restrict each token to the minimum required actions, such as reading or updating a single authorized safety-net record.
• Store secrets in a managed secret vault and inject them only into an isolated backend component that requires them.
• Prevent secrets from appearing in prompts, logs, telemetry, crash reports, tool output, or subprocess environments.
• Rotate existing service-role credentials before production deployment and immediately after any suspected disclosure.
• Monitor and alert on bulk reads, unusual writes, authorization failures, audit-record deletion, and service-role use from unexpected hosts.
• Document credential ownership, rotation intervals, incident-response procedures, and emergency revocation mechanisms.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs storage of identifiable patient data, contacts, clinical conditions, responses, and audit trails in local memory without any warning about sensitivity, minimization, retention, access control, or lawful handling. In a healthcare context this creates a real risk of confidentiality breaches and improper processing of special-category health data, which could expose patients to privacy harm and create significant regulatory and clinical governance consequences.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill authorizes outreach over email, SMS, WhatsApp, Telegram, and voice without warning about channel security, identity verification, consent, misdelivery, or the risks of transmitting medical follow-up content via third-party providers. Because these messages concern health status and red-flag symptoms, use of insecure or misaddressed channels could disclose sensitive medical information or cause unsafe communication failures.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.