T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate_record.js:86- Finding
Shared Nested Template Leaks Patient Data Across Generated Records
- Content
View full analysis
- Remediation
View remediation
Security audit
Medical Record Generator
Security checks for vulnerabilities and agentic risk
Overview
This medical-record skill is coherent in purpose but needs review because it can invent missing clinical facts and save sensitive records to local files without adequate safeguards.
Review carefully before installing or using with real patient information. Do not treat generated records as clinical facts without authorized clinician review, avoid entering unnecessary identifiers, and do not use the save/logging paths for sensitive records unless storage location, access controls, retention, and filename handling are corrected.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate_record.js:150- Finding
Caller-Controlled Filename Allows Path Traversal and Plaintext Medical-Record Storage
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
test.js:18- Finding
Complete Medical Records Are Disclosed Through Standard Output
- Content
View full analysis
- Remediation
View remediation
other
Error
- Location
SKILL.md:30- Finding
Missing Clinical Facts Are Replaced With Unverified Normal Findings
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (17)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill handles highly sensitive medical data but does not warn users about privacy risks, data minimization, or appropriate use. This can lead users to disclose unnecessary protected health information without informed awareness, increasing confidentiality and compliance risk.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Instructing the system to fill unspecified medical fields as 'normal' or with clinical defaults can fabricate health facts that were never provided or verified. In a medical-record workflow, this is especially dangerous because false documentation can mislead clinicians, create legal/compliance exposure, and corrupt sensitive patient records.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The trigger keyword "入院记录" is broad enough to match many ordinary requests about admission notes, which can cause the skill to activate outside a narrowly intended workflow. In a medical context, over-broad invocation is more sensitive because it may steer users into generating or handling clinical documentation when they only intended a general discussion, increasing privacy and safety risk.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The English trigger "medical record" is highly generic and overlaps with common conversation, making accidental activation likely. Because this skill concerns medical documentation, unintended activation can expose sensitive workflows, collect health information unnecessarily, or generate formal-looking records in situations where the user did not request that specific function.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger phrases are broad enough that normal conversation about medical records could activate the skill unintentionally, causing collection or generation of sensitive health content without clear user intent. In a medical context, accidental activation is more dangerous because it may prompt for or expose protected health information.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill description and workflow are written to operate in Chinese and present Chinese trigger phrases and output expectations, while not offering a language choice or stating that the skill is intentionally limited to a Chinese-speaking or region-specific context. This creates a natural-language locale policy concern under the rule for forced language without user opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The description and most trigger phrases are specified only in Chinese, presenting the skill as a Chinese-language workflow without documenting any user choice of language or locale. This can violate language/locale policy when the skill effectively assumes a specific language by default instead of offering opt-in or alternatives.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger list contains generic phrases such as “入院记录” and “medical record” that can plausibly appear in ordinary conversation, increasing the chance the skill activates when the user did not explicitly request it. In a medical context, unintended invocation is more sensitive because it can steer the conversation into handling personal health information or generating clinical documentation without clear user intent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The example explicitly saves a generated medical record containing highly sensitive patient data to a file, but provides no guidance on secure storage, access controls, encryption, retention, or de-identification. In a medical-record generation skill, this omission is more dangerous than in ordinary content because users may copy the pattern directly and persist protected health information in insecure locations, creating confidentiality and compliance risks.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script persists generated medical records to a local file, which expands the skill from drafting text into storing sensitive health information on disk. In a medical-record context, local persistence increases confidentiality and compliance risk because patient data may be written to insecure locations, retained longer than intended, or accessed by other local users/processes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The code writes potentially sensitive patient records to disk without any explicit warning, confirmation, or privacy notice. In the context of medical documentation, silent persistence of PHI materially increases the chance of accidental disclosure, mishandling, and noncompliant data storage.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The saveToFile function accepts an arbitrary filename and joins it with process.cwd(), allowing callers to choose essentially any writable path relative to the current working directory, including parent-directory traversal such as ../../file. This is more than a privacy issue: it creates a generic local file-write primitive that could overwrite other files the process can access.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This markdown file is entirely written as a Chinese admission-record template and does not offer any language or locale choice. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is clearly documented and justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This JavaScript file uses Chinese exclusively in comments, test data values, and console output strings, with no indication that the user can choose another language or locale. That creates a natural-language policy concern when a skill implicitly enforces a specific language without documented opt-in or justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 70% confidence
- Finding
The natural-language instructions and primary invocation phrases are Chinese-only, which can amount to a language-policy constraint if users are not given an explicit language or locale choice. The file does include one English trigger phrase, but it does not clearly state that users may interact in multiple languages or that the Chinese focus is intentionally region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
All headings, instructions, sample data, and output are written in Chinese, which can amount to a language-policy issue if the skill effectively forces a specific language without user opt-in. The file does not indicate that the skill is China-specific or that users may choose another language.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The code uses toLocaleTimeString('zh-CN') and all user-facing text is fixed in Chinese, which imposes a specific language/locale choice. The file does not provide an opt-in, configuration option, or explanation that this skill is intentionally limited to a Chinese-language or region-specific context.
- Content
Static analysis
No suspicious patterns detected.