Security audit

ICD-Coding

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Chinese ICD/DRG medical coding reference package with local lookup data and no hidden execution, persistence, credential use, or data exfiltration behavior found.

Install only if you need Chinese medical coding and CHS-DRG reference support. Treat outputs as coding assistance, not a substitute for current official policy, clinical judgment, or billing compliance review.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (22)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.
md
| **`data/drg3.0_adrg.json`** 🆕 | **DRG 3.0 492 ADRG 目录** |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.
md
| **`data/drg3.0_adrg_compare.json`** 🆕 | **DRG 2.0 ↔ 3.0 ADRG 对比（409→492，含统计）** |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.
md
| **`data/drg3.0_mdc_dx.json`** 🆕 | **DRG 3.0 MDC 主诊表（29,174 条）** |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.
md
| **`data/drg3.0_adrg_to_icd.json`** 🆕 | **DRG 3.0 ADRG→入组 ICD 明细（含 67,329 条入组规则）** |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.
md
| **`data/drg3.0_icd_to_adrg.json`** 🆕 | **DRG 3.0 ICD→ADRG 反向索引（38,427 个编码）** |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.
md
| **`data/drg3.0_ops.json`** 🆕 | **DRG 3.0 9,629 条手术或操作目录** |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.
md
| **`data/drg3.0_cc.json`** 🆕 | **DRG 3.0 6,337 条 CC 合并症** |

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file uses a single fixed language throughout the skill instructions and command descriptions, which can constitute a language/locale policy issue when no user opt-in or alternative is provided. The document does not state that the skill is limited to Chinese-speaking users or a China-only deployment context, so the language constraint appears implicit rather than explicitly justified.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This JSON file uses Chinese-only natural-language labels and descriptions, such as the top-level explanatory string on L0002, with no indication that the skill offers a language choice or that the locale restriction is explicitly documented as region-specific. Under the policy rule for natural-language locale constraints, forcing a specific language without opt-in can be a policy issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The file uses Chinese-only natural-language labels and description fields such as "说明" and disease names, which imposes a single language/locale in the skill data without indicating user opt-in or documenting a justified region-specific scope. Under the stated policy, language constraints should either offer a choice or be clearly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The file’s natural-language metadata and all diagnostic labels are presented exclusively in Chinese, beginning with the top-level description on L00002. Under the policy, forcing a specific language or locale without user opt-in or a documented region-specific justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This JSON manifest/data file uses Chinese-only natural-language labels and descriptions, such as the top-level field and description on L0002. Under the policy, forcing a specific language without user choice or documented locale justification can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This JSON dataset uses Chinese-only field names and descriptions (for example, the top-level label and diagnosis text) with no indication that language choice is configurable or limited to a China-specific context. Under the policy, forcing a specific language without opt-in can be a natural-language locale violation even in config/data files.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This JSON file uses Chinese-only natural-language labels and description text, such as the top-level field name and description on L0002. Under the stated policy, forcing a specific language without offering user choice or documenting a justified locale constraint is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: SQP-3 applies to all file types and covers language or locale policy violations. The top-level description and all visible content are Chinese-only, but the file does not document that it is intended specifically for Chinese-language or region-specific medical coding use, nor does it offer any language choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This JSON dataset uses Chinese field names and procedure descriptions throughout, starting with the top-level description on L00002 and continuing for the full file. Because the file provides no indication that Chinese is optional or that the dataset is intentionally region-specific, it may impose a fixed language/locale on downstream users or agents.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This JSON file uses Chinese field names and descriptions throughout, which imposes a specific language/locale on users or downstream systems. Under the stated policy, a forced language choice without opt-in or documented justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown file is written entirely in Chinese, including the title, headings, and operational guidance, with no indication that the user can choose another language. Under the policy rule for language/locale constraints, this can be considered a natural-language policy violation unless the locale restriction is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This Python file presents its purpose, examples, CLI descriptions, and output labels entirely in Chinese, which imposes a specific language on users without offering any language or locale selection. The policy explicitly calls out forced language or locale behavior as a natural-language policy violation when no opt-in is provided.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The argparse description, help text, examples, table headers, and error messages are all hardcoded in Chinese, which forces a single locale for interaction. Because the file does not offer an opt-in or alternative language path, this matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.