T09 · Insecure Skill Coding Practices
Error
- Location
references/method-patterns.md:303- Finding
Prescription-drug dosage guidance contradicts the skill's safety policy
- Content
View full analysis
- Remediation
View remediation
Security audit
Barefoot Doctor (EN)
Security checks for vulnerabilities and agentic risk
Overview
The skill is not a system-security threat, but it gives broad, high-stakes medical, emergency, dosing, pediatric, herbal, and invasive acupuncture guidance with insufficient safety boundaries.
Install only for tightly supervised educational or historical reference use, not for direct diagnosis, emergency triage, medication dosing, pediatric dosing, herbal prescribing, acupuncture, bloodletting, or moxibustion advice. It should be revised to use local emergency-services language, remove invasive and prescription-style instructions, and require licensed clinician or pharmacist oversight before user-facing medical recommendations.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
01-implement-method.md:121- Finding
Invasive acupuncture, bloodletting, and burn-producing moxibustion instructions may be provided for home use
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
references/method-patterns.md:371- Finding
Coarse age-fraction tables enable unsafe individualized pediatric and herbal dosing
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (13)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The emergency first-aid template instructs the model to provide step-by-step emergency guidance but does not prominently state that AI output is only interim information and not a substitute for immediate professional emergency care. In a medical-emergency context, users may delay calling local emergency services or over-trust possibly incomplete instructions, increasing the risk of serious injury or death.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The acupuncture template provides detailed point-selection and treatment parameters, including needle retention and stimulation methods, without a strong warning against unsupervised self-needling. Because acupuncture is invasive and can cause infection, bleeding, organ injury, or harm in special populations, the omission materially increases the chance of unsafe self-treatment.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The herbal medicine template asks for formula recommendation, composition, and dosage, but lacks a prominent up-front warning that herb-drug interactions, contamination, dosing variability, and condition-specific contraindications require clinician or pharmacist oversight. In a population likely to have concurrent medications or pregnancy risks, this can lead to adverse reactions, treatment interference, or delayed evidence-based care.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This file contains broad diagnostic logic, medication dosing, herbal protocols, acupuncture, and first-aid instructions, including for emergencies and special populations, but does not present a clear user-facing limitation that it is not a substitute for licensed medical care. In a medical advice skill, omission of strong safety boundaries materially increases the chance of unsafe self-treatment, delayed emergency care, incorrect dosing, or misuse of invasive techniques.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Hard-coding '120' as the emergency number assumes a specific regional context and may misdirect users in other countries where a different number is required. In emergencies, even small delays or confusion about whom to call can materially worsen outcomes, making this especially risky in a first-aid skill.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The checklist instructs the agent to always output "Call 120" for emergencies without stating that this number is region-specific. In a medical triage skill, hard-coding a single emergency number can delay access to urgent care for users outside the intended locale, especially if the agent is used globally or the user's region is unknown.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill advertises very broad activation scenarios spanning diagnosis, treatment, emergency first aid, TCM, herbal medicine, acupuncture, and multiple specialties without clear gating on when it should decline, defer, or require clinician oversight. In a medical context, overbroad triggering increases the chance the agent will engage on high-risk cases it is not safe to handle, producing unsafe advice or delaying real medical care.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The diagnostic flow hard-codes '120 + stop' as the emergency action, assuming a China-specific emergency number without checking user location or clarifying regional scope. For users outside that locale, this can delay emergency response at precisely the moment rapid escalation is most important.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The code example returns a fixed action token 'CALL_120' for emergency cases, baking locale-specific emergency behavior into implementation logic. If reused directly, downstream systems may surface the wrong emergency instruction to non-China users, causing confusion or dangerous delay.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The first-aid instructions for cardiac arrest/unconsciousness explicitly tell users to 'Call 120 immediately' without qualifying geography. In an emergency-medicine context, incorrect locale assumptions are especially risky because they can waste critical minutes during resuscitation scenarios.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The poisoning protocol again directs users to a fixed emergency number with no regional clarification. Poisoning events are time-sensitive and may also require poison-control resources specific to the user's country, so a hard-coded number can misroute or delay help.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The error-code guidance embeds 'advise 120' as the standardized handling for emergencies, spreading the same locale-specific assumption into internal policy text. Because this appears to shape runtime behavior, it can systematically produce wrong emergency advice across the skill.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The schema sets
language: en, and the changelog notes the skill was rewritten in English, but the document does not indicate that users may choose another language. This can violate a language/locale policy when a specific language is imposed without explicit opt-in or justification.- Content