ClawHub
Back to skill

Security audit

医学知识图谱mindmap

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a local medical knowledge-note tool, but it overstates EEG-analysis capabilities and has installation and privacy scoping issues that warrant review.

Review this as a lightweight local note-taking/knowledge-graph skill, not a medical analysis tool. Avoid storing patient-identifiable or sensitive health information unless you are comfortable with local disk persistence, and prefer a pinned, verified install source over the README's mutable installer or placeholder clone URL.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:34
Finding

Unpinned and Inconsistent Installation Sources

Content
View full analysis

Vulnerability Details

File Location: README.md:34 and README.md:41
Vulnerability Type: Supply-chain risk through mutable and inconsistent installation sources
Risk Level: Medium

Vulnerable Code

At README.md:34:

bash
npx clawhub@latest install medical-mindmap

At README.md:41:

bash
git clone https://github.com/your-github/medical-mindmap.git

The repository URL at README.md:41 is inconsistent with the canonical homepage declared at _meta.json:9:

json
"homepage": "https://github.com/languang/medical-mindmap",

Technical Analysis

The recommended npx clawhub@latest command retrieves and executes a mutable package release. The documentation does not pin a reviewed version, specify an integrity hash, or require signature verification. Consequently, the code executed during installation can differ from the code that was audited if the upstream package, publishing account, or distribution channel is compromised.

The alternative installation command uses the placeholder repository path your-github/medical-mindmap, which does not match the repository declared in project metadata. This inconsistency can direct users to an unintended repository or facilitate repository-name confusion and social-engineering attacks.

The project’s runtime script does not itself retrieve or execute remote payloads. The risk arises specifically from the documented installation process and therefore best matches an insecure dependency and supply-chain weakness.

Attack Path

  1. An attacker compromises the upstream package publisher, publishing credentials, distribution account, or mutable latest release.
  2. Alternatively, an attacker creates or controls a repository corresponding to the placeholder or otherwise misleading clone URL.
  3. A user follows one of the installation commands from the README.
  4. The mutable installer downloads attacker-controlled content, or the user clones the unintended repository.
  5. Installatio ...[truncated 1025 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace @latest with a specifically reviewed and approved version:

    bash
    npx clawhub@1.2.3 install medical-mindmap

  2. Where supported, publish and verify package integrity hashes or cryptographic signatures before execution.

  3. Document the expected package publisher, package identifier, version, and checksum so users can verify provenance.

  4. Replace the placeholder clone URL with the canonical repository URL from project metadata:

    bash
    git clone https://github.com/languang/medical-mindmap.git

  5. Recommend checking out a reviewed immutable tag or commit rather than the repository’s mutable default branch:

    bash
    git clone https://github.com/languang/medical-mindmap.git
cd medical-mindmap
git checkout <reviewed-commit-hash>

  6. Ensure release tags are protected and, preferably, cryptographically signed.

  7. Avoid running installation commands with administrator or root privileges.

  8. Add automated documentation checks to ensure repository URLs and package metadata remain consistent.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (19)

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
88% confidence
Finding

The code does align partially with the declared purpose of managing medical knowledge entities such as diseases, examinations, symptoms, medications, syndromes, anatomy, and waveform-related items. It supports entity creation, relation management, fact storage, querying, listing, and a simple summary output. However, key claimed capabilities are absent: there is no actual脑电图波形分析 (EEG waveform analysis), only a 'waveform' category folder/type; and the summary output is a plain listing of name, relations, and facts, not the declared structured template with core points, comparisons, clinical significance, differential diagnosis value, abnormality prompts, or essence summary. Thus the description overstates the implemented analytical and formatting capabilities.

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

Using npx clawhub@latest install medical-mindmap pulls and executes the latest published package version at install time, which is a supply-chain risk. If the upstream package is compromised or a malicious version is published, users could execute attacker-controlled code during installation.

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill clearly describes reading and writing local files under memory/ and references workspace paths, but it does not declare any explicit tool scope or permission boundaries. This can lead to over-broad file access at runtime, making it easier for the skill to persist user-provided medical content to disk without transparent authorization or confinement.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill stores and appends medical knowledge on disk but does not prominently warn users about local persistence. Because the content can include health-related data, this omission creates privacy and compliance risk by causing users to disclose or generate sensitive material without informed consent about retention.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The instruction '直接用中文告诉小社' forces use of a specific language, and the later reminder repeats this requirement. This is a natural-language policy issue because it imposes a locale/language constraint without opt-in or documented justification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The invocation phrases are broad natural-language prompts such as common medical questions, which increases the chance of accidental activation during ordinary conversation. In a skill that can write to disk and append knowledge, unclear activation scope can cause unintended persistence or modification of sensitive medical notes based on casual user input.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The statement '记住：直接用中文告诉小社！' reiterates a hard requirement to use Chinese. Because no alternative language option or explicit justification is provided, this violates the language/locale policy criterion.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest description is entirely in Chinese and states the output template contents in Chinese, implying a fixed language/locale for the skill experience. There is no indication that users may choose another language or that the Chinese-only behavior is a justified regional constraint.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest describes a neurology/EEG medical knowledge-graph system that supports EEG waveform analysis and outputs structured sections such as core points, comparisons, clinical significance, differential diagnostic value, abnormality alerts, and essence summary. In code, the script only creates entities/relations/facts, lists them, and prints a simple summary of relations and facts; there is no EEG signal processing, waveform analysis logic, or template generation beyond a basic heading-and-bullets dump.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This Python skill contains its primary description in Chinese and later presents all usage/help output in Chinese only, which imposes a specific language on users without offering an alternative. That is a natural-language locale policy issue under the stated rule because no language choice or opt-in is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The script's status messages and CLI usage strings are exclusively in Chinese, including the main help output, which means users are forced into a specific language when interacting with the tool. The file does not provide any mechanism to choose another language or indicate that the restriction is required for a region-specific purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest describes a neurology/EEG knowledge-graph mindmap system that supports EEG waveform analysis and outputs structured sections such as core points, comparisons, clinical significance, differential diagnostic value, abnormality hints, and essence summary. The code in this file only creates entities/relations/facts, lists and retrieves them, and prints a simple summary of relations and facts; it contains no EEG signal processing, no waveform analysis, and no template-based clinical output generation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The module docstring and all user-facing CLI messages are written in Chinese, which imposes a specific language on users. The file does not offer any language/locale choice or explain that the tool is intentionally limited to a Chinese-speaking or region-specific context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The natural-language instructions and usage guidance are written in Chinese throughout the README, which effectively forces a specific language for users. The file does not offer an alternative language, opt-in language selection, or state that the skill is intentionally limited to a Chinese-speaking context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The README documents persistent local storage of medical knowledge data but does not warn users that potentially sensitive medical information may remain on disk. In a medical knowledge tool, users may store patient-adjacent notes or sensitive clinical content, creating privacy and compliance risks if the host is shared or backed up insecurely.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
75% confidence
Finding

The file documentation presents the script as a medical knowledge-graph manager with summary generation, which in this skill context implies the richer template-based outputs described by the skill. However, summarize() only aggregates stored relations and facts and prints raw bullet lists, without producing the claimed clinical sections or interpretive analysis, creating an intent-code divergence between stated functionality and implemented behavior.

Content

No source excerpt is available for this finding.