Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **`data/drg3.0_mdc_dx.json`** 🆕 | **DRG 3.0 MDC 主诊表（29,174 条）** |
Security audit
ICD-Coding 疾病分类与手术操作编码技能
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent Chinese medical coding reference skill that uses local DRG/ICD data and a local lookup script without hidden persistence, credential access, or network execution.
Install only if you need China CHS-DRG/ICD coding support. Treat outputs as coding assistance, not authoritative billing or clinical advice, and verify important reimbursement decisions against official policy and qualified coding review.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (18)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **`data/drg3.0_adrg_to_icd.json`** 🆕 | **DRG 3.0 ADRG→入组 ICD 明细（含 67,329 条入组规则）** |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **`data/drg3.0_icd_to_adrg.json`** 🆕 | **DRG 3.0 ICD→ADRG 反向索引（38,427 个编码）** |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **`data/drg3.0_ops.json`** 🆕 | **DRG 3.0 9,629 条手术或操作目录** |
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The natural-language instructions, commands, and operational guidance are presented exclusively in Chinese, which effectively forces a specific language for use of the skill. The policy allows locale constraints only when explicitly justified or when the user is given a language or locale choice, neither of which is stated here.
- Content
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
This JSON file uses Chinese-only field names and description text, such as "说明" and "数据", which imposes a specific language/locale on downstream consumers. Under the policy, locale constraints should either offer user choice or be clearly documented and justified as region-specific; this file provides neither within the content shown.
- Content
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The file uses Chinese-only natural language labels and descriptions such as the top-level field and dataset description, but does not state that the dataset is intentionally China-specific or offer any language/locale choice. Under the policy rule, a forced locale in natural-language content can be a violation unless it is explicitly documented and justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
This JSON uses Chinese-only natural-language labels and descriptions, starting with the top-level description field on L0002, but does not document whether the skill is intentionally scoped to Chinese-speaking users or offers any language choice. Under the policy rule, forced language/locale can be a natural-language policy concern when no opt-in or justification is provided.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
This JSON manifest-like data file uses Chinese-only natural-language labels and descriptions, such as the top-level "说明" field, with no indication that users can opt into another language. Under the stated policy, forcing a specific language without user choice can be a natural-language locale violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This JSON file uses Chinese-only natural-language fields such as the top-level description, which can impose a specific language/locale on downstream users without opt-in. The stated policy flags language-forcing behavior unless the locale restriction is explicitly justified or users are offered a choice.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
Rule SQP-3 applies to all file types and includes language/locale policy violations. The top-level description and all diagnosis names in the file are presented only in Chinese, with no metadata indicating that the dataset is intentionally region-specific or that users can choose another language.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
SQP-3 applies to all file types and covers language or locale policy violations. This JSON dataset uses Chinese-only field names and values throughout, with no indication that the user can opt into this locale or that the file is intentionally limited to a Chinese-language regional workflow.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This JSON file uses Chinese-only natural-language field names and description text (for example, the top-level key and description on L0002), with no indication that the dataset is intentionally region-specific or that users can opt into this locale. Under the language/locale policy rule, forcing a specific language without documented choice or justification is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This markdown file uses only Chinese throughout, including headings, instructions, and examples, and does not indicate that the skill or documentation is region-specific or that another language is available. Under the policy rule for language or locale constraints, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The query interface is documented entirely with Chinese command verbs and examples such as "DRG3.0查MDC" and related commands, with no indication that other language or locale variants are supported. Under the policy rule, a skill that prescribes a single language without user opt-in can be a natural-language policy concern unless the locale restriction is explicitly justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This Python file contains user-facing natural-language strings that effectively force Chinese as the only interaction language. Under the language/locale policy, this is a violation unless the skill offers user opt-in or clearly justifies that it is a region-specific tool.
- Content