Mental Health Booking

• Outcome: Review
• Latest audit: Sep 11, 2026 · 9:52 PM UTC
• Version: 1.0.0

Overview

The skill is aligned with booking mental-health appointments, but it needs Review because it handles highly sensitive patient and insurance data with weak consent, scoping, and data-exposure controls.

Review carefully before installing. Use only if you are comfortable sharing mental-health booking details, DOB, contact information, and insurance data with the booking service. Prefer a version that asks for explicit consent before sending data, passes booking payloads through stdin or another redacted channel, and locks the API destination to the intended HTTPS host.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/booking-api.sh:45
• Finding: Sensitive Patient Data Exposed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/booking-api.sh:45-55`; documented usage in `SKILL.md:132-133` **Vulnerability Type**: Sensitive-data exposure through process arguments and command logging **Risk Level**: High ### Vulnerable Code ```bash book|book-dry) json="${1:-}" [ -z "$json" ] && error "Usage: klarity-api.sh book '<json-payload>'" url="${BASE_URL}/api/v1/book" [ "$command" = "book-dry" ] && url="${url}?mode=dry_run" curl -s -X POST \ -H "Content-Type: application/json" \ -d "$json" \ "$url" | python3 -m json.tool ``` The documented invocation explicitly places the complete patient record in a command-line argument: ```bash scripts/booking-api.sh book '{"provider_id":"...","session_id":"...","service":"...","slot":"...","patient_first_name":"...","patient_last_name":"...","patient_email":"...","patient_phone":"...","patient_dob":"...","patient_state":"...","insurance_carrier":"...","insurance_member_id":"..."}' ``` ### Technical Analysis The booking interface accepts the entire JSON patient record through `$1`. This record can include the patient's name, date of birth, email address, telephone number, state, insurance carrier, insurance member ID, selected mental-health service, provider identifier, and appointment time. Command-line arguments may be exposed through process inspection facilities, execution telemetry, shell debugging, audit frameworks, terminal scrollback, command histories, or Agent tool-call logs. Quoting the argument prevents shell word splitting but does not provide confidentiality. This design conflicts with the instruction in `SKILL.md` that patient information must never be stored. Even if the script itself does not write a file, upstream command recording or process monitoring can retain the payload. ### Attack Path 1. A patient supplies identity, contact, health-service, and insurance information to the Agent. 2. The Agent constructs the documented `boo ...[truncated 958 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Accept booking JSON through standard input rather than a command-line argument. For example: ```bash payload="$(cat)" curl --fail --silent --show-error \ -X POST \ -H "Content-Type: application/json" \ --data-binary @- \ "$url" <<<"$payload" ``` - Change the documented interface to an invocation such as: ```bash printf '%s' "$payload" | scripts/booking-api.sh book ``` - Prefer streaming standard input directly to `curl` where validation requirements permit, reducing the number of in-memory copies. - Ensure the Agent runtime redacts booking payloads from tool-call logs, traces, error reports, and observability systems. - Do not enable shell tracing with `set -x` around booking operations. - Avoid temporary files. If one is unavoidable, create it with restrictive permissions, prevent backups, and securely remove it immediately after use. - Minimize the fields sent to the service and clearly obtain user consent before transmitting sensitive patient and insurance information. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/booking-api.sh:11
• Finding: Unrestricted API Base URL Can Redirect Sensitive Booking Data<![CDATA[ ## Vulnerability Details **File Location**: `scripts/booking-api.sh:11` and `scripts/booking-api.sh:47-55` **Vulnerability Type**: Unvalidated destination override and potential insecure transport of sensitive data **Risk Level**: High ### Vulnerable Code The destination is taken directly from an inherited environment variable without scheme or host validation: ```bash BASE_URL="${BOOKING_API_URL:-https://rx.helloklarity.com}" ``` The resulting value is used as the destination for the complete patient booking payload: ```bash url="${BASE_URL}/api/v1/book" [ "$command" = "book-dry" ] && url="${url}?mode=dry_run" curl -s -X POST \ -H "Content-Type: application/json" \ -d "$json" \ "$url" | python3 -m json.tool ``` ### Technical Analysis `BOOKING_API_URL` can specify an arbitrary origin or transport scheme. The script neither enforces HTTPS nor restricts the destination to the declared Klarity API host. An attacker who can influence the script's environment can redirect service searches and booking requests to an attacker-controlled endpoint. During booking, this sends the complete patient JSON payload to that endpoint. A value using plain HTTP would additionally remove transport confidentiality and server authentication. The override is not required for the Skill's normal declared functionality, which identifies `https://rx.helloklarity.com` as the booking service. Allowing unrestricted destinations therefore exceeds the minimum network authority necessary for production use. ### Attack Path 1. An attacker, compromised launcher, malicious wrapper, or unsafe runtime configuration sets `BOOKING_API_URL` to an attacker-controlled URL such as `https://attacker.example`. 2. The user follows the normal booking workflow and supplies patient and insurance details. 3. The script constructs `https://attacker.example/api/v1/book`. 4. `curl` sends the complete JSON booking record to the substituted server. 5. The malicious ...[truncated 693 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove `BOOKING_API_URL` from production builds and use a fixed destination: ```bash readonly BASE_URL="https://rx.helloklarity.com" ``` - If an override is necessary for controlled testing, require an explicit test mode and validate the value against a strict allowlist of exact HTTPS origins. - Reject URLs containing unexpected user information, ports, paths, query strings, fragments, or non-HTTPS schemes. - Enforce HTTPS at the client level: ```bash curl --proto '=https' --tlsv1.2 --fail --silent --show-error ... ``` - Avoid following redirects for requests containing patient data. If redirects are operationally required, validate every redirect destination against the same exact-origin allowlist. - Run the Skill with a sanitized environment so inherited variables cannot silently alter security-sensitive destinations. - Fail closed when URL validation fails and emit an error that does not contain the patient payload. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The skill directs collection and transmission of sensitive personal and health-related data, including name, date of birth, email, phone number, state, and insurance member ID, without requiring an explicit privacy notice or informed consent message to the user at collection time. Because this is mental health booking, the sensitivity is elevated: the workflow implies disclosure of psychiatric treatment intent, making privacy, minimization, and transparency especially important.

External Script Fetching

High

• Category: Supply Chain

Content

case "$command" in
  services)
    curl -sf "${BASE_URL}/api/v1/services" | python3 -m json.tool
    ;;

  availability)

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High

• Category: Supply Chain

Content

[ -n "$date" ]      && qs="${qs}&date=${date}"
    [ -n "$time_pref" ] && qs="${qs}&time_preference=${time_pref}"

    curl -sf "${BASE_URL}/api/v1/availability?${qs}" | python3 -m json.tool
    ;;

  book|book-dry)

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High

• Category: Supply Chain

Content

url="${BASE_URL}/api/v1/book"
    [ "$command" = "book-dry" ] && url="${url}?mode=dry_run"

    curl -s -X POST \
      -H "Content-Type: application/json" \
      -d "$json" \
      "$url" | python3 -m json.tool

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 97% confidence
• Finding: The skill instructs the agent to use shell and network capabilities (`scripts/booking-api.sh` and external API calls) but does not declare any explicit tool scope or permissions boundary. In a workflow that handles highly sensitive health and identity data, missing tool restrictions increases the risk of unintended command execution, overbroad network access, and data exfiltration beyond the stated booking purpose.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger condition activates on broad mentions of mental health topics, which can cause the agent to initiate a booking workflow in contexts where the user is only seeking general information, discussing symptoms, or expressing distress. In a mental health context, over-triggering is more dangerous because it may collect sensitive health information unnecessarily or steer vulnerable users into an inappropriate flow before crisis or consent checks are made clear.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

"That slot was just taken — want me to search for the next available?"

On validation error:
Fix and retry. Don't ask the user to re-enter everything.

## Important Rules

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The booking API documentation instructs collection of highly sensitive personal and health-related data, including full identity, contact details, date of birth, state, and insurance member ID, while explicitly stating that no authentication is required and providing no privacy, consent, minimization, or secure-handling guidance. In the context of mental health appointment booking, this materially increases the risk of unauthorized access, mishandling of PHI/PII, and noncompliant integrations by downstream agents or developers.

External Transmission

Medium

• Category: Data Exfiltration

Content

url="${BASE_URL}/api/v1/book"
    [ "$command" = "book-dry" ] && url="${url}?mode=dry_run"

    curl -s -X POST \
      -H "Content-Type: application/json" \
      -d "$json" \
      "$url" | python3 -m json.tool

• Confidence: 93% confidence
• Finding: The script sends an arbitrary JSON payload to an external booking endpoint, and in this skill context that payload is likely to contain highly sensitive mental-health and insurance data. Because the destination host is overridable via the BOOKING_API_URL environment variable and there is no validation, allowlisting, or transport hardening beyond default curl behavior, misconfiguration or environment tampering could exfiltrate protected health information to an attacker-controlled server.

Static analysis

No suspicious patterns detected.