ClawHub
Back to skill

Security audit

CareMax OCR

Security checks for vulnerabilities and agentic risk

Overview

The skill’s medical-report OCR workflow is mostly coherent, but it needs review because it can send sensitive health files to an external API, uses broad activation terms, depends on unpinned external auth scripts, and exposes unguarded delete commands for records and sessions.

Review this skill before installing. Only use it if you trust CareMax Health and the caremax-auth dependency to handle medical files, credentials, and extracted health data. Avoid broad automatic activation, require explicit user consent before uploads/OCR, pin or verify the dependency source, and add strong confirmation before any record or session deletion.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:9
Finding

Unpinned Third-Party Skill Installation Creates a Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 9
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

markdown
> **Requires `caremax-auth` as a sibling directory** (`../caremax-auth/`). If missing, tell the user to install caremax-auth first (e.g. `npx skills add KittenYang/caremax-skills`).

Technical Analysis

The documented installation command invokes an npm-distributed CLI without pinning its version and installs Skill content from a mutable third-party repository reference. Neither the skills CLI version nor an immutable commit, release artifact, checksum, or signature for KittenYang/caremax-skills is specified.

The installed caremax-auth component is subsequently trusted to provide authentication, API request, file-upload, and OCR-streaming scripts. Those scripts are outside this project and were not available for audit. Consequently, the behavior that will process credentials and sensitive medical reports can change after this Skill has been reviewed.

This is a supply-chain weakness rather than evidence that the currently referenced project is malicious.

Attack Path

  1. An attacker compromises the npm package, its publisher account, the referenced repository, or another upstream distribution component.
  2. The attacker publishes a modified CLI or changes the mutable repository content to include malicious Skill instructions or shell scripts.
  3. A user follows the documented unpinned command:
    bash
    npx skills add KittenYang/caremax-skills
  4. The mutable, attacker-controlled content is downloaded and installed as the trusted sibling dependency.
  5. This Skill invokes the installed authentication, upload, or API scripts.
  6. The malicious dependency executes with the invoking agent's local privileges and receives access to data supplied to those scripts.

Impact Assessment

Successful exploitation could execute arbitrary commands with the privileges of the us ...[truncated 505 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the npm CLI to an explicitly reviewed version instead of resolving the latest available package:
    bash
    npx skills@<reviewed-version> add ...
  2. Pin the Skill source to an immutable commit digest or cryptographically signed release rather than a mutable repository reference.
  3. Publish and verify cryptographic checksums or signatures for the installed artifacts.
  4. Document the canonical package name, publisher identity, official repository, expected revision, and verification procedure to reduce dependency-confusion and impersonation risks.
  5. Vendor the required caremax-auth scripts into a reviewed release where feasible, or audit the exact pinned dependency revision together with this Skill.
  6. Execute dependency installation and its scripts with least privilege, restricted filesystem access, limited environment-variable exposure, and narrowly scoped network access.
  7. Require explicit user approval before installing external components, and display the exact pinned source and revision that will be installed.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (12)

Vague Triggers

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The trigger list contains very broad terms like upload, scan, and extract, which can cause the skill to activate in unrelated contexts. Because the skill handles sensitive medical documents and initiates external API uploads/OCR by default, over-broad triggering materially increases the risk of unintended disclosure and unwanted processing.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill processes medical reports through an external API but does not prominently warn users that sensitive health information will be transmitted off-platform. For health data, lack of informed consent and transparency is particularly dangerous because it can expose highly regulated personal information to third-party services.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
94% confidence
Finding

The skill documents direct DELETE operations parameterized by <session_id> and <record_id> with no described validation or confirmation safeguards. If an agent accepts attacker-influenced identifiers or guesses the wrong target, it could irreversibly delete sensitive medical records.

Content

Scanner excerpt · SKILL.md (reported line 243)May include surrounding context.

Delete a single report (does NOT affect other reports in the same session):

bash
$APICALL DELETE "/api/skill/sessions/<session_id>/records/<record_id>"

Delete an entire session (cascade deletes ALL files + reports):

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

Deleting an entire session cascades to all files and reports, making this a high-impact destructive capability. In a healthcare context, accidental or malicious invocation can wipe multiple sensitive documents and OCR outputs in one request, amplifying harm.

Content

Scanner excerpt · SKILL.md (reported line 249)May include surrounding context.

Delete an entire session (cascade deletes ALL files + reports):

bash
$APICALL DELETE "/api/skill/sessions/<session_id>"

Other session operations

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
94% confidence
Finding

Repetition of the single-record DELETE endpoint in the general operations section normalizes a destructive action without adding safety guidance. This increases the chance an agent will treat deletion as routine and invoke it without adequate user verification or contextual checks.

Content

Scanner excerpt · SKILL.md (reported line 268)May include surrounding context.

md
$APICALL GET "/api/skill/sessions/<session_id>/status"

# Delete single report (keeps session and other reports intact)
$APICALL DELETE "/api/skill/sessions/<session_id>/records/<record_id>"

# Delete entire session (undo everything: files + reports)
$APICALL DELETE "/api/skill/sessions/<session_id>"

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

Reiterating full-session DELETE in the catch-all operations section exposes a broad destructive primitive in a skill primarily meant for OCR. Because the skill resumes sessions and handles unfinished medical uploads, misuse here could erase active work and protected health data with a single parameterized call.

Content

Scanner excerpt · SKILL.md (reported line 271)May include surrounding context.

$APICALL DELETE "/api/skill/sessions/<session_id>/records/<record_id>"

Delete entire session (undo everything: files + reports)

$APICALL DELETE "/api/skill/sessions/<session_id>"

text

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The instruction hard-codes a Chinese message for the user when step=resume appears, which forces a specific language in user-facing output without opt-in or explanation. This can violate language/locale policy when the user has not chosen Chinese or the skill is not explicitly limited to a Chinese-only audience.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.

md
## Step 3: Review results (MANDATORY)

Parse the `step=done` data. Show formatted summary. **Do NOT auto-confirm.**

Each report has a `reportType` field: `lab`, `genetic`, `imaging`, `pathology`, or `other`.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill's stated purpose is upload/OCR of medical reports, but the documentation also exposes deletion of individual records and entire sessions. Expanding capability into destructive data operations increases the chance an agent will invoke risky actions outside the user's expected intent, especially when handling sensitive medical data.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

Deletion endpoints are not necessary to fulfill the advertised upload-and-OCR workflow, so including them violates least privilege and broadens the attack surface. In a medical-document context, accidental or induced deletion could destroy reports or pending OCR results that users expect to be preserved.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation includes destructive delete commands without any mandatory confirmation or warning language. In the context of medical records and session state, an agent could delete reports or entire sessions due to ambiguity, prompt injection, or simple operator error, causing data loss.

Content

No source excerpt is available for this finding.