ClawHub
Back to skill

Security audit

CareMax OCR

Security checks for vulnerabilities and agentic risk

Overview

This CareMax OCR skill mostly matches its medical-report upload purpose, but it also exposes deletion of sensitive health records and sessions without clear confirmation safeguards.

Review before installing. Use this only with medical reports you are comfortable sending to CareMax, inspect the required caremax-auth helper package, and require a separate explicit confirmation naming the exact session_id or record_id before any delete operation.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The skill is presented as an upload/OCR workflow, but it also documents destructive delete endpoints for individual records and entire sessions. Exposing deletion capabilities inside a skill handling sensitive medical data increases the chance an agent invokes high-impact actions outside user intent, especially because these operations are adjacent to routine session-management steps.

Context-Inappropriate Capability

Medium
Confidence
86% confidence
Finding
Delete-record and delete-session capabilities are not justified by the stated upload/OCR purpose, so they expand the action surface beyond what users would reasonably expect. In a medical-report workflow, unnecessary destructive commands create avoidable risk of data loss or abuse if an agent overgeneralizes from broad instructions like 'clean up' or 'remove old items'.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger list includes generic terms such as 'upload', 'scan', and 'extract', which are common in many unrelated tasks. That makes accidental invocation more likely, and because this skill processes sensitive medical files and can later access session operations, unintended activation has meaningful privacy and integrity implications.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill documents irreversible delete operations but does not prominently warn about data loss or require cautionary disclosure. In a healthcare context, silent exposure of destructive actions is dangerous because users and agents may assume the skill is only for OCR and not realize it can permanently remove files and reports.

Static analysis

No suspicious patterns detected.