ClawHub
Back to skill

Security audit

YouYou 佑佑

Security checks for vulnerabilities and agentic risk

Overview

This health skill is mostly coherent, but it handles very sensitive data while using under-disclosed remote report scripts and several high-risk medical/crisis workflows.

Install only if you are comfortable keeping extensive sensitive health records in this workspace. Avoid opening generated HTML reports with network access unless remote scripts are removed or bundled locally, do not rely on the skill for diagnosis, crisis triage, medication changes, or herbal dosing, and verify deletion, encryption, and credential-storage practices before using it with real records.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
commands/report.md:195
Finding

Third-party remote JavaScript executes within sensitive health reports

Content
View full analysis
``` From `references/health-trend-analyzer/templates/report-template.html:7-15`: ```html ``` ### Technical Analysis The generated HTML reports load executable JavaScript directly from multiple third-party CDN domains. The reports are intended to contain sensitive medical information, including patient profiles, biochemical results, imaging summaries, medications, allergies, symptoms, surgeries, and discharge records. JavaScript loaded by an HTML report executes with access to that report's DOM. If a CDN response, hosted package, mutable release, or delivery path is compromised, the remote script can inspect and transmit the report contents. This creates a remote payload channel whose effective code can change after the Skill package has been reviewed. Several controls that would reduce this risk are absent: - No Subresource Integrity hashes are specified. - No restrictive Content Security Policy is defined. - `lucide@latest` is a mutabl ...[truncated 1846 chars]
Remediation
View remediation
``` 6. Set `connect-src 'none'` to prevent report scripts from initiating outbound network requests. 7. Provide an offline report mode as the default and require explicit informed consent before generating a report that loads remote resources. 8. Document and lock dependency versions, hashes, provenance, and update procedures. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
commands/report.md:11
Finding

User-controlled report output path lacks documented containment validation

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (282)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The supplied code does relate to health, but its actual purpose is much narrower and different from the declared description. It does not implement personal health data management, storage, profile management, reminders, report/image handling, or consultation analysis. Instead, it only defines chart initialization/configuration functions for rendering health-related visual reports in ECharts. While medication adherence and symptom/lab trend visualization are health-supporting features, the primary behavior is data visualization, not natural-language health record management. Therefore the description materially overstates and misrepresents what this code chunk actually does.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The command materially expands the skill from personal health-data management into child environmental safety assessment and emergency guidance, which is outside the declared manifest scope. Scope drift is dangerous because it can bypass user/admin expectations, route unrelated sensitive family data into a health skill, and cause users to rely on unvetted safety or first-aid guidance in higher-risk situations.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The disclaimer claims the system is only for monitoring records and not diagnosis or treatment, but the document later gives treatment instructions and triage-style recommendations. This contradiction creates a false sense of safety/compliance while still encouraging users to act on medical advice, increasing the chance of harmful reliance.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

This skill explicitly handles and persists highly sensitive medical discharge summaries, including diagnoses, medications, surgeries, insurance, and financial information, but provides no user-facing notice, consent step, retention policy, or access-control/privacy guidance before storage. In a health-data context, silent persistence of such data materially increases the risk of privacy violations, regulatory noncompliance, and accidental secondary exposure through local files or later indexing/query features.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

Update/delete capabilities against the clinical interaction database are especially dangerous because they can weaken or remove contraindication logic entirely. In a health-management context, integrity of medication interaction rules is safety-critical; unauthorized changes could hide life-threatening combinations or downgrade alerts.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · commands/menopause.md (reported line 2)May include surrounding context.

md
---
description: 管理更年期症状和健康记录
arguments:
  - name: action
    description: 操作类型：start(开始)/symptom(症状)/hrt(激素治疗)/bone(骨密度)/status(状态)/risk(风险评估)
    required: true
  - name: info
    description: 更年期信息（年龄、末次月经日期、症状描述、检查结果等，自然语言描述）
    required: false
---

# 更年期管理

围绝经期症状追踪和管理，提供更年期健康评估和管理建议。

## 操作类型

### 1. 开始更年期追踪 - `start`

初始化更年期追踪记录。

**参数说明：**

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · commands/mood.md (reported line 2)May include surrounding context.

md
---
description: 心理健康与情绪追踪
arguments:
  - name: action
    description: 操作类型：add(记录情绪)/history(历史记录)/status(统计分析)/correlations(相关性分析)/insights(AI洞察)/crisis(危机资源)
    required: true
  - name: description
    description: 情绪描述（自然语言描述情绪状态、睡眠、压力等）
    required: false
  - name: date
    description: 记录日期（格式：YYYY-MM-DD，默认今天）
    required: false
---

# 心理健康与情绪追踪

全面的心理健康监测系统，支持情绪打卡、睡眠与压力记录�

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The command declares a hard safety boundary against adjusting doses or stopping medications, but later introduces deprescribing actions such as taper, switch, and discontinue. In a health-management skill, this contradiction can lead the agent to generate medication-change guidance that users may act on without clinician oversight, creating direct patient safety risk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The document says the system does not recommend specific medication regimens, yet later sections promise alternative-drug suggestions and switch plans. For medication management, recommending substitutes can functionally amount to treatment advice, especially when presented alongside risk screening and deprescribing workflows.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file implements a full psychological assessment, crisis triage, and support workflow far beyond simple personal health data management. In this context, scope expansion is dangerous because it introduces high-risk medical decision support and crisis handling behaviors without clear evidence that the skill is governed, consented, and safety-reviewed for that purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill begins collecting and later storing extremely sensitive mental-health data without an upfront warning in the skill description that responses and support dialogue will be persisted and indexed. This is dangerous because users may reveal suicidal ideation, psychiatric symptoms, and personal history without meaningful prior notice of retention and secondary use.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill actively performs suicide/crisis intervention guidance, including risk stratification and immediate action prompts. This is especially dangerous because incorrect triage, stale hotline information, overconfidence, or inappropriate conversational handling during a crisis can cause severe real-world harm or delay urgent professional care.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill instructs the system to persist suicidal ideation details, crisis-assessment answers, mental-health scale results, and support conversation content into local files and indexes. This is highly dangerous because such data is extraordinarily sensitive, can be exposed through local compromise or overbroad access, and creates lasting records of crisis-state disclosures that may exceed necessity.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill explicitly states it will not recommend specific herbal medicines or issue prescriptions, yet elsewhere provides named formulas, ingredient lists, gram dosages, symptom-based modifications, and administration instructions. In a health-management skill handling real users' symptoms and profiles, this contradiction can enable self-medication with potentially unsafe or contraindicated herbal treatments despite the surrounding disclaimer.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The privacy section claims sensitive fields can be hidden and phone numbers are partially masked, but the generation logic copies emergency_contacts directly from profile data with no masking or redaction control. This can leak full contact details in printed cards, saved files, and QR exports, increasing privacy exposure for both the user and third parties.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The QR code section recommends embedding complete JSON medical data offline and labels it as the preferred approach, but omits any warning that anyone who can scan or photograph the code may obtain the user's sensitive medical history. Because this skill handles emergency medical cards, placing full health data in a portable QR code materially increases the risk of unauthorized disclosure, tracking, and misuse.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger list is extremely broad for a health skill and includes common terms like '分析', '总结', '最近', '睡眠', and '心情', which can cause the skill to activate on routine conversation and pull highly sensitive medical context without clear user intent. In a health-data management skill, over-triggering is especially dangerous because it risks unnecessary processing, storage, or disclosure of protected health information.

Content

No source excerpt is available for this finding.

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/health-trend-analyzer/templates/report-template.html (reported line 8)May include surrounding context.

html
<meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>健康趋势分析报告</title>

    <!-- Tailwind CSS v3.4 -->
    <script src="https://cdn.tailwindcss.com"></script>

    <!-- Lucide Icons v0.263 -->

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The documented safety boundary says the skill does not predict suicide/self-harm risk, while the operational steps later instruct it to assess crisis risk and score warning signs including suicidal thoughts and self-harm. In a mental-health skill, inconsistent safety claims are dangerous because they create false assurances and increase the chance of unsafe reliance on automated outputs.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill explicitly states it does not predict suicide or self-harm risk, yet later defines a scoring system using PHQ-9 item 9, suicidal thoughts, self-harm signals, and crisis-risk tiers. This contradiction can mislead operators and users about the model’s role, causing unqualified automated triage of self-harm risk in a highly sensitive clinical domain.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The file says the skill does not handle acute psychiatric crises, but later instructs it to trigger crisis intervention, urgent action windows, and immediate care decisions. This is dangerous because a user or integrator may trust the declared boundary while the actual workflow performs acute-crisis triage, where errors can have severe real-world consequences.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill proposes generating a complete HTML report from highly sensitive mental-health data, including crisis indicators and treatment information, without any explicit privacy, consent, storage, or sharing controls. HTML output can amplify exposure risk because it is easy to save, forward, embed, or render with active content if templating is not tightly controlled.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill states safety boundaries around not providing treatment or prescriptions, yet its documented output includes concrete TCM formula selection, ingredient lists, dosages, and administration instructions. In a health-management skill handling real user data, this can function as de facto medical advice and may cause users to self-medicate, delay proper care, or suffer adverse reactions despite the disclaimer text.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The safety section says the skill does not issue TCM prescriptions, but the report template still presents a concrete prescription-like regimen. This contradiction weakens safety controls and makes it likely that downstream agents or users will treat the generated content as actionable treatment guidance.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
83% confidence
Finding

The skill instructs obtaining client credentials and storing an OAuth access token, but it does not define a secure token-handling mechanism within the documented workflow. In a health-data integration context, insecure storage or leakage of these tokens could grant ongoing access to Fitbit account data and associated sensitive health information.

Content

Scanner excerpt · references/wellally-tech/SKILL.md (reported line 513)May include surrounding context.

  1. Create app on Fitbit Developer Platform
  2. Get CLIENT_ID and CLIENT_SECRET
  3. Run OAuth authentication flow
  4. Store access token

Import Data:

bash