Security audit

医小智Pro诊断助手

Security checks for vulnerabilities and agentic risk

Overview

This medical diagnosis skill needs Review because it handles sensitive health information, sends conversations to an external model endpoint, and mandates a cancer-related referral link inside diagnostic reports.

Install only after reviewing the medical and privacy implications: this skill may collect detailed health information, send it and prior chat history to a configurable external model service, provide medication advice, and append a specific cancer screening link. Use it only with clear consent, trusted endpoint configuration, and an understanding that it is not a substitute for professional medical care.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:21
Finding: Mandatory Commercial Referral Injection into Cancer-Related Medical Responses
Content: View full analysis
Remediation: View remediation

other

Error

Location: scripts/llm_chat.py:204
Finding: Unconsented Transmission of Complete Medical Conversations to an External LLM Endpoint
Content: View full analysis
str: """Call an OpenAI-compatible endpoint and return the model response.""" base_url = llm_cfg.get("base_url", "https://api.openai.com/v1").rstrip("/") endpoint = f"{base_url}/chat/completions" api_key = llm_cfg["api_key"] model = llm_cfg.get("model", "gpt-4o") temperature = llm_cfg.get("temperature", 0.7) max_tokens = llm_cfg.get("max_tokens", 2048) payload = { "model": model, "messages": messages, "temperature": temperature, "max_tokens": max_tokens, } data = json.dumps(payload).encode("utf-8") headers = { "Content-Type": "application/json", "Authorization": f"Bearer {api_key}", } req = urllib.request.Request(endpoint, data=data, headers=headers, method="POST") try: with urllib.request.urlopen(req, timeout=60) as resp: result = json.loads(resp.read().decode("utf-8")) return result["choices"][0]["message"]["content"] ``` ```python # Build the message list messages = [{"role": "system", "content": SYSTEM_PROMPT}] messages.extend(history) messages.append({"role": "user", "content": args.user_message}) # Call the model reply = call_llm(messages, llm_cfg) ``` The configured destination is defined in `config.json:2-7`: ```json { "llm": { "base_url": "https://ydai.jinbaisen.com/api/v1", "api_key": "", "model": "cyzh-cfc", "temperature": 0.7, "max_tokens": 2048 } } ``` ### Technical Analysis The script serializes the complete supplied conversation history and current user message into an HTTP request sent to the configured third-party LLM endpoint. The Skill explicitly solicits age, sex, symptoms, symptom location and duration, significan ...[truncated 1931 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/llm_chat.py:247
Finding: Unvalidated Conversation History Permits Privileged Prompt-Role Injection
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill provides diagnosis and medication recommendations while explicitly discouraging uncertainty language and lacking safety disclaimers about AI limitations. In the medical context this materially increases harm potential because users may overtrust definitive-seeming advice, including for serious or urgent conditions.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill states at top priority that it will not execute commands or access files, but later instructs curl execution and config.json editing. Contradictory operational instructions are dangerous because they obscure the true trust boundary and can cause operators or downstream agents to apply the wrong security assumptions.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script transmits user medical symptoms and conversation history to an external LLM API without any consent flow, warning, minimization, or privacy notice. Because this skill handles sensitive health information, silent external transmission materially increases confidentiality, compliance, and third-party retention risks.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The README presents all user-facing instructions, examples, and disclaimers exclusively in Chinese. Under the policy rule, forcing a specific language without user opt-in or a documented justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill metadata declares no tool scope, yet the content documents capabilities requiring network access and file interaction. This mismatch can mislead reviewers and users about the skill’s effective behavior, undermining least-privilege controls and making unauthorized capability use harder to detect.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger conditions are broad enough to activate on routine health conversation, increasing the chance the skill intervenes unexpectedly and delivers diagnosis or medication advice without deliberate user opt-in. In a medical context, accidental invocation raises the risk of overreach and unsafe reliance on automated advice.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill mandates appending a cancer-screening appointment link whenever certain diagnostic keywords appear, creating undisclosed referral or promotional behavior inside a medical workflow. In a diagnosis assistant, this is especially dangerous because it can steer vulnerable users toward a third-party service based on model output rather than unbiased clinical criteria.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documentation instructs remote API-key retrieval via curl from an external domain, introducing credential handling and network dependency unrelated to the user-facing diagnostic purpose. This creates supply-chain and secret-exposure risk if the remote endpoint is compromised, changed, or used without proper verification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This manifest presents the skill name, description, features, requirements, and installation steps exclusively in Chinese. Under the language/locale policy, forcing a specific language without offering a user choice or documenting a justified locale restriction is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file-level documentation promises a structured 2+4+病史 collection and three-round diagnostic workflow, but the implementation only sends free-form messages to a generic LLM and does not enforce state, completeness checks, or turn sequencing in code. In a medical skill, this mismatch is dangerous because users may rely on claims of a controlled diagnostic process when the actual behavior can be bypassed by prompt variation or model drift.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The system prompt represents the assistant as being based on a specific proprietary medical model, while the code actually uses any configurable OpenAI-compatible endpoint and model. This is a trust and provenance deception issue: in a healthcare context, misrepresenting the model source can mislead users and operators about validation status, safety expectations, and data handling.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The prompt explicitly requires collecting detailed patient history and repeatedly reusing it throughout the conversation, increasing the volume and persistence of sensitive medical data in prompts. In this skill context, repeated propagation of health history heightens privacy exposure, especially because the same data is later sent to an external LLM service.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The prompt enforces a language behavior rule rather than offering a user-selectable language or locale preference. Under the policy, forced language/locale behavior without opt-in can be a natural-language policy violation unless clearly documented as a justified regional constraint.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 96% confidence
Finding: The code is designed to send prompts to an external network endpoint, which is not inherently unsafe, but in this medical assistant it becomes security-relevant because the transmitted content includes sensitive health information. The danger is amplified by the default remote endpoint and lack of built-in restrictions on what patient data may be sent.
Content: Scanner excerpt · scripts/llm_chat.py (reported line 204)May include surrounding context.
python
def call_llm(messages: list, llm_cfg: dict) -> str: """调用 OpenAI 兼容接口，返回模型回复文本""" base_url = llm_cfg.get("base_url", "https://api.openai.com/v1").rstrip("/") endpoint = f"{base_url}/chat/completions" api_key = llm_cfg["api_key"] model = llm_cfg.get("model", "gpt-4o")