Security audit

Build Orthopedic Physical Therapy Practice Service Comparison Landing Page

Security checks for vulnerabilities and agentic risk

Overview

This is a low-risk, instruction-only marketing copy skill for physical therapy landing pages, with no code, install steps, credentials, or persistence.

Reasonable to install for marketing landing-page drafts. Do not provide patient-identifiable health information, and have qualified human review before publishing medical claims, pricing, or patient-facing healthcare content.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The description ends with an ellipsis and does not clearly bound when the skill should be invoked, which increases the chance of over-broad triggering. In an agent ecosystem, vague invocation criteria can cause the skill to activate for generic healthcare or physical therapy requests, leading to inappropriate use of specialized marketing output in contexts that may involve regulated or patient-facing content.

Vague Triggers

Low

Confidence: 88% confidence
Finding: The suggested prompt is generic enough that it can match ordinary requests about a physical therapy practice rather than clearly signaling a landing-page comparison-copy task. This can cause accidental routing to the skill when the user intended broader business, clinical, or informational assistance, increasing confusion and the risk of producing unsuitable healthcare-adjacent content.

Static analysis

No suspicious patterns detected.