T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:40- Finding
Default Persistent Collection and Cross-Skill Sharing of Sensitive Health Data Without Prior Consent
- Content
View full analysis
- Remediation
View remediation
Security audit
Doctor
Security checks for vulnerabilities and agentic risk
Overview
The skill is transparent and appears locally focused, but it defaults to reading and persistently updating very sensitive health and related personal records without prior user confirmation.
Review this skill before installing if you do not want a health assistant to keep a durable local medical record. It is best suited for users who intentionally want longitudinal health notes shared with other local Clawic skills; otherwise set health_logging to off or require manual approval before any read, write, move, or deletion.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (53)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill instructs the agent to write, create, and even delete health-record content in the same turn without any warning or confirmation from the user. In a medical assistant context this is especially dangerous because it can modify or erase sensitive records, produce inaccurate longitudinal data, and do so under the authority of a routine advice request.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file states that writes and deletions remain inside the skill's configPaths, but elsewhere directs writes to shared paths outside the doctor directory. This contradiction undermines trust and can cause the agent to exceed its declared storage boundary, leading to unauthorized modification of sensitive shared data.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill directs writing highly sensitive reproductive and sexual health information—pregnancy status, breastfeeding status, contraception, menstrual history, and STI screening data—into user files in the same turn, without any visible requirement to warn the user or obtain consent. In this domain, the context makes the issue more dangerous because these details are especially privacy-sensitive and could cause serious harm if stored unexpectedly, exposed, or later reused in unrelated medical decisions.
- Content
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 80% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md - Make them choose the word: **spinning** (vertigo — inner ear, vestibular neuritis, BPPV) · **about to black out** (presyncope — cardiac, blood pressure, anaemia, dehydration) · **unsteady** (neurological, medication, joint) · **fuzzy** (anxiety, hyperventilation, medication). - Vertigo triggered by rolling over in bed, lasting under a minute → BPPV; continuous for days after a viral illness → vestibular neuritis; with new deafness or neurological signs → same-day assessment. - **Faint red flags**: happened during exertion, happened while lying down, preceded by palpitations, no warning at all, or a family history of sudden death under 40. Any of these is a cardiac work-up, not a vasovagal faint. - A vasovagal faint has a prodrome (hot, nauseated, greying vision), a trigger (standing, pain, blood, heat) and a quick full recovery on the floor. ## Fever
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill tells the agent to write episode details, outcomes, and suspected medicine reactions into persistent files without notifying the user that medical records are being modified. In a medical context this is especially dangerous because inferred causality, mis-triage, or hallucinated details could become durable records and affect future recommendations or clinician discussions.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill reads sensitive health records by default without any user-facing warning, consent flow, or transparency about accessing private files. In a medical assistant context, silent access to diagnoses, medicines, allergies, and pregnancy status is especially dangerous because users may disclose highly sensitive information without realizing records are being consulted.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill directs automatic writes to persistent medical logs and artifacts after any triage, again without warning the user that files will be modified. Silent creation or updating of longitudinal medical notes can cause privacy harm, inaccurate records, and downstream reliance on machine-generated entries in future health decisions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The activation scope is extremely broad, covering symptoms, labs, medications, chronic disease, mental health, reproductive health, pediatrics, and older adults. Such breadth increases the chance the skill is invoked outside validated competence boundaries, where incomplete context or overgeneralized rules can produce dangerous advice in a safety-critical medical setting.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The file says the skill 'does not diagnose,' but later directs the agent to provide candidate explanations and condition-linked actions. That inconsistency can cause boundary drift, where the agent presents quasi-diagnostic guidance or treatment-like recommendations that users may treat as medical advice, increasing the risk of unsafe self-management or delayed care.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill explicitly provides emergency intervention actions such as aspirin use, adrenaline administration, and other time-critical first-response steps while simultaneously claiming it is not for first-aid drills. In a health-triage context, these action instructions can be followed without clinician oversight and may be wrong for the specific patient, creating a real risk of physical harm from inappropriate self-treatment or delayed professional care.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The catch-all 'Anything else health-related' trigger removes meaningful activation constraints and encourages use on undefined medical topics. In a medical skill, ambiguous routing is dangerous because users may rely on this skill for issues requiring specialized workflows, immediate escalation, or refusal due to insufficient competence.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill instructs reading sensitive medical records from persistent files without an explicit warning, consent checkpoint, or explanation of how that data will be used. Because the content includes conditions, medicines, allergies, and episodes, silent access materially increases privacy risk and may surprise users who expect conversational triage rather than file inspection.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Handling insurance plan and premium data in a shared finances file is outside the core purpose of symptom triage and medical interpretation. Mixing medical and financial administration creates unnecessary exposure of sensitive data and enables unintended modification of unrelated records from a health-oriented skill.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file goes beyond appointment prep and medical triage by directing writes across multiple persistent stores, including bookings, contacts, health profile, episodes, artifacts, and finances. This broad cross-domain data management increases the blast radius of mistakes or prompt-injection-induced actions and violates least-privilege for a medical guidance skill.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file directs creation and modification of several persistent records in the same turn, but gives no explicit warning that user files will be written or changed. Silent writes across multiple repositories are dangerous because they can permanently store incorrect medical details, create privacy issues, and propagate errors into future decisions.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The instructions direct the skill to update shared bookings and contacts repositories, which are administrative systems not strictly required for clinical guidance. In context, this expands access from advice generation into broader personal-information management, increasing the chance of unauthorized or accidental persistence, duplication, or corruption of user data.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file explicitly instructs the agent to create and update persistent records in multiple shared locations, including health, contacts, and episode files, which exceeds narrow symptom triage and introduces durable handling of sensitive personal data. Because this is a doctor skill dealing with children, the data is highly sensitive and the cross-linking across shared files increases unauthorized access, unintended reuse, and privacy harm.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill directs the agent to store a child's health information in shared files without any warning about sensitivity, consent, or who can access those records. In a pediatric medical context, missing privacy safeguards is dangerous because it normalizes collecting and redistributing protected health data without clear boundaries or user awareness.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The instruction to persist and broadly reuse a child's allergies, weight, medications, vaccines, and episodes across future interactions creates a long-lived sensitive profile that can be accessed or repurposed beyond the immediate medical question. In the context of a doctor skill, especially for minors, this materially increases privacy, safety, and compliance risk if the data is exposed, inferred, or used outside the user's expectations.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly instructs persistent writes to local health profile, memory, and artifact files as part of the response flow, extending beyond providing medical advice. In a health context, this can silently store sensitive medical data, create long-lived records, and alter future agent behavior without clear user consent or authorization boundaries.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill instructs reading local medical profile files containing medicines, allergies, and emergency-use drugs before advising anything, but gives no notice that sensitive health data will be accessed. In a medical skill this may be contextually relevant, but undisclosed access to highly sensitive local records is still a privacy vulnerability because users may not expect file reads during symptom triage.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file directs the agent to persistently modify multiple health records after an emergency, which exceeds the skill's stated triage and interpretation role. Even if medically useful, silent scope expansion creates a data-integrity and privacy risk because the agent may write sensitive facts, outcomes, and medications into long-lived files without explicit user approval.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The instruction to pull emergency contact names from a separate contacts file introduces access to unrelated personal data not necessary for immediate emergency triage. This broadens data access beyond least privilege and could expose or propagate sensitive contact information into new artifacts without informed consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill tells the agent to record emergency episodes, allergies, due items, and summary artifacts into persistent health files in the same turn, without warning the user that their data will be modified. In a healthcare context these writes are sensitive and durable, so silent modification risks incorrect records, unwanted retention, and downstream medical consequences if inaccurate data is later relied upon.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The instruction to read a personal health profile from a fixed path causes the skill to access sensitive medical data such as anticoagulants, osteoporosis, diabetes, and steroid use without any notice, consent check, or least-privilege limitation. In a healthcare skill, that context makes the privacy risk more serious because the data is highly sensitive even if clinically relevant.
- Content
Static analysis
No suspicious patterns detected.