Security audit

tcm-medical-tech-manual-2026

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Chinese medical reference skill, but it exposes highly detailed invasive and forceful treatment instructions without enough user-facing safety scoping for licensed clinical use only.

Install only if you want a Chinese-language clinical reference and can ensure the agent will not provide lay users with procedural self-treatment instructions. Add or require clear guardrails: clinician-only framing, no diagnosis or treatment substitution, emergency/referral guidance, and high-level summaries instead of step-by-step invasive procedures for non-professional users.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (15)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This chapter contains extensive step-by-step descriptions of invasive and surgical procedures, including cutting, dissection, injection, osteotomy, bleeding, and use of powered orthopedic tools, yet it lacks a prominent top-level warning that the material is only for licensed, trained medical professionals and must not be used for self-treatment. In a general-purpose agent skill, such content can be surfaced directly to unqualified users, increasing the risk of serious injury, hemorrhage, infection, nerve or vascular damage, and delayed proper medical care.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This chapter provides extensive, highly actionable instructions for spinal manipulation, fracture/dislocation reduction, traction, external fixation, and other invasive or forceful techniques, including step-by-step procedures, indications, and equipment, but it does not present a clear user-facing warning that the material is only for licensed, trained clinicians and not for self-treatment or lay use. Because the skill is a searchable knowledge base, an end user could retrieve dangerous procedural guidance out of context and attempt high-risk maneuvers, creating substantial risk of paralysis, vascular injury, fracture worsening, infection, or death.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This skill catalogs invasive and semi-invasive medical procedures, contraindications, and operating methods, but it does not warn users that the content is informational only and cannot replace licensed, patient-specific clinical judgment. In a medical context, omission of that warning can encourage unsafe self-treatment or unqualified use of procedures such as needling, moxibustion, bone-setting, anorectal techniques, and micro-invasive interventions, creating meaningful risk of patient harm.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file is entirely written in Chinese and does not provide any opt-in, alternative language, or justification that it is intended only for a Chinese-language or region-specific audience. Under the policy, forcing a specific language without user choice is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This section gives step-by-step instructions for invasive bloodletting procedures, including needle selection, puncture angles, depth, blood volume, venous puncture technique, and example applications, but it does not place a prominent high-level warning that these are invasive medical acts requiring licensed clinical supervision. Even though contraindications and precautions are listed, the content is operational enough that an untrained user could attempt it, creating risks of bleeding, infection, vascular injury, syncope, and delayed proper medical care.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This section provides detailed instructions for forceful skin-manipulation techniques, including target body regions, hand positions, repetition counts, and desired visible tissue effects such as bruising-like marks, without a prominent warning against self-application or unsupervised use. Although framed as a medical manual and accompanied by contraindications, the procedural specificity could encourage misuse and lead to skin injury, worsening of underlying illness, or unsafe treatment of urgent conditions such as heat illness or throat infection.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This markdown file presents all instructions and medical guidance exclusively in Chinese, and nowhere indicates that the user may choose another language or that the content is intentionally restricted to a Chinese-speaking audience. Under the policy rule for language/locale, forcing a single language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The description and usage instructions are written entirely in Chinese and implicitly require Chinese-language interaction, but there is no indication that the user can choose another language or that the locale restriction is intentional and documented. SQP-3 covers natural-language policy violations where a skill forces a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The section explicitly warns that the original title is missing and only tentatively infers the technique, yet the body then presents the content as a definitive named technique and states it is one of the Nine Needles. In a medical procedural knowledge base, this unresolved contradiction can mislead users into treating uncertain, OCR-corrupted source material as authoritative, increasing the risk of selecting or applying the wrong procedure.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file is written exclusively in Chinese and does not indicate that the user can select another language or that the content is intentionally limited to a Chinese-speaking or region-specific audience. Under the policy rule for natural-language constraints, forcing a specific language without opt-in can be a locale-policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file presents all instructions and content exclusively in Chinese, with no indication that the user can choose another language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 75% confidence
Finding: A file-wide language constraint can be a natural-language policy issue when content is effectively forced into a single language without offering an alternative or documenting that the material is intended for a Chinese-only audience. Here, the document provides no explicit language-selection context or opt-in despite being entirely Chinese-language content.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The entire skill content is presented only in Chinese, with no indication that language choice is optional or that the locale restriction is intentional and documented. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown file presents all instructions and procedural content exclusively in Chinese, and nowhere indicates that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.