Medpilot

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:21 AM UTC
• Version: 1.0.1

Overview

The skill is mostly a local medication-tracking helper, but it includes patient-specific medical interpretation and follow-up advice that conflicts with its own non-diagnostic scope.

Review carefully before installing. It appears safe from a system-security standpoint, but users could receive overly specific medical guidance from examples that contradict the stated safety limits. Use it only for local tracking and summaries, avoid relying on it for diagnosis or follow-up decisions, and confirm privacy/storage handling before entering real health data.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

other

Warning

• Location: SKILL.md:22
• Finding: Predetermined Medical Guidance Exceeds the Skill's Declared Safety Boundaries## Vulnerability Details **File Location**: `SKILL.md`, lines 22-24; duplicated in `README.md`, lines 20-23 **Vulnerability Type**: `other: Unsafe medical guidance` **Risk Level**: Medium **Complete Relevant Snippet from `SKILL.md` (English translation):** ```markdown ### Scenario 4: Unable to understand a medical examination report **User input:** "This year's company medical examination report says I have a 'TI-RADS category 3 thyroid nodule' and 'elevated low-density lipoprotein.' Is this serious?" **Expected output:** Interpret the examination indicators: TI-RADS category 3 means that the thyroid nodule has a relatively low malignancy risk (probability of being benign greater than 95%). Recommend follow-up imaging in 6-12 months to observe size changes. Elevated low-density lipoprotein (LDL-C greater than 3.4 mmol/L) indicates a need for lifestyle intervention: reduce red meat and fried foods, increase vegetable and fiber intake, and perform at least 150 minutes of aerobic exercise per week. Recommend further consultation with the endocrinology department of a tertiary hospital. If this is the first occurrence, repeat the four-item blood lipid panel after three months. Also state that this interpretation cannot replace a doctor's diagnosis. ``` **Duplicated Relevant Snippet from `README.md` (English translation):** ```markdown **3. Unable to understand a medical examination report** > User: "This year's company medical examination report says I have a > 'TI-RADS category 3 thyroid nodule' and 'elevated low-density lipoprotein.' > Is this serious?" > Agent: Explain that TI-RADS category 3 has a relatively low malignancy risk > (probability of being benign greater than 95%) and recommend follow-up in > 6-12 months. For elevated low-density lipoprotein, recommend lifestyle > intervention: reduce red meat and fried foods, increase vegetable fiber, > and perform at least 150 minutes of aerobic exer ...[truncated 2641 chars]
• Remediation: ## Remediation Suggestions 1. Remove predetermined malignancy probabilities, repeat-testing intervals, referral destinations, and intervention schedules from example outputs. 2. Replace the scenario with a neutral workflow that asks for the complete report, reference ranges, symptoms, relevant history, current medications, and whether a clinician has already reviewed the findings. 3. Present only general educational information and clearly identify uncertainty and contextual limitations. 4. Require qualified clinicians to determine individualized follow-up timing, testing, diagnosis, and treatment. 5. Add explicit escalation guidance for urgent warning signs while avoiding claims that a limited report is benign or non-urgent. 6. Add a safety rule prohibiting the Agent from converting example scenarios into fixed patient-specific recommendations. 7. Make the same changes in both `SKILL.md` and `README.md` so public documentation does not reintroduce the unsafe behavior. 8. Add test cases verifying that incomplete medical data produces clarification questions and professional-referral guidance rather than predetermined conclusions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The README states the skill is for self-use medication and health tracking, but the example expands into medical report interpretation and lifestyle/clinical advice. In a healthcare context, this scope drift can cause users to rely on the agent for quasi-diagnostic guidance, increasing the risk of unsafe self-management or delayed professional care.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The documentation explicitly says the skill is not for diagnosis or treatment decisions, yet the example gives condition-specific risk interpretation, follow-up interval guidance, lifestyle intervention recommendations, and specialist referral advice. This contradiction undermines user trust boundaries and may lead users to treat the output as medical advice despite the stated disclaimer.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The documented scenario gives concrete medical interpretation and follow-up guidance for exam findings, which exceeds the stated boundary of record-keeping and explicitly moves into clinical interpretation and triage. In a medication/health-tracking skill, users may reasonably rely on this output as medical advice, creating risk of delayed care, inappropriate self-management, or false reassurance.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The boundaries section says the skill must not provide diagnosis or autonomous medication advice, but the example behavior already does so by interpreting findings and recommending follow-up actions. This contradiction is dangerous because operators and downstream agents may trust the permissive example over the safety boundary, leading to unsafe health guidance being delivered as if it were endorsed behavior.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill requests and stores highly sensitive health information, including identity, medications, and home metrics, but provides no privacy, retention, or handling warning. In this context, omission of privacy guidance increases the chance that users disclose protected or sensitive data without informed consent or adequate local safeguards.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The quickstart shows API calls carrying patient-identifying and health-related data over plain HTTP, and it does so without any warning that this is only acceptable for strictly local loopback development. Even though the examples target localhost, documentation like this is often copied into real deployments, which can lead to sensitive medical data being sent without transport protection or clear privacy guidance.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Create patient
```bash
curl -X POST http://localhost:3456/api/patients -H 'Content-Type: application/json' -d '{"displayName":"Demo User"}'
```

### Ingest order

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The README presents an example scenario entirely in Chinese after earlier English content, but it does not state whether the skill supports multiple languages by user choice or defaults to a specific locale. This can violate language/locale policy expectations when users are not explicitly offered a language preference or opt-in.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The file mixes English documentation with a scenario that is entirely in Chinese and provides a Chinese-only expected response. This can amount to a language/locale policy violation because the skill appears to force a specific language for at least one use case without user opt-in or an explicit statement that the skill is intended for Chinese-language users.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The quickstart demonstrates core operations using Chinese-only medication and symptom text, which implies a language-specific usage pattern, but the document does not state that the skill is limited to Chinese input or offer any user language choice. This is a natural-language locale policy concern because the examples effectively privilege a specific language without opt-in or justification.

Static analysis

No suspicious patterns detected.