T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:52- Finding
Path Traversal Through Unsanitized Member and Medication Filenames
- Content
View full analysis
- Remediation
View remediation
Security audit
Medication Manager
Security checks for vulnerabilities and agentic risk
Overview
The skill is not clearly malicious, but it handles sensitive family health data and reminder delivery with under-specified privacy and command-safety controls.
Install only if you are comfortable storing family medical data in local plaintext files and sending reminder content through the chosen notification provider. Keep the data directory out of shared folders and repositories, restrict filesystem access, prefer minimal reminder text, avoid webhooks for sensitive details, and sanitize filenames and command arguments before creating records or cron jobs.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:80- Finding
Command Injection Risk in Reminder Command Templates
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (20)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README encourages reminder delivery through webhook and messaging platforms such as DingTalk, WeChat Work, and Slack, but does not warn that reminder contents may transmit medication names, schedules, or member identifiers to third-party services. In a medical context, even routine reminder text can reveal protected health information, creating privacy and compliance risk if sent over external channels or retained in chat histories.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README promotes storing family medication histories, prescriptions, allergies, and other health records in plain local markdown files without a clear warning that this is sensitive medical data requiring device, filesystem, and backup protections. Because the skill is designed for multiple family members and longitudinal health records, loss of the laptop, malware, shared-user access, or accidental backup/sync exposure could disclose highly sensitive health information.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill describes reading and managing local medical records but does not declare an explicit tool scope such as allowed-tools or permissions. That creates an authorization ambiguity: an agent may gain file-read capability without clear least-privilege constraints, increasing the chance of unintended access to sensitive family health data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill is built to collect and store highly sensitive medical and family profile data, including allergies, birth dates, chronic conditions, and medication history, in local markdown files. Without a clear warning about the sensitivity of this data and the risks of file-based storage, users may unknowingly store protected health information in insecure locations, leading to disclosure, theft, or accidental sharing.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill tells users to configure webhook URLs and send reminder messages through them, but does not warn that medication names, schedules, and member-related health details may be transmitted to third-party services. This can expose sensitive health information to external processors, logs, or misconfigured endpoints, especially when test notifications are sent automatically.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This skill directs the agent to create plaintext per-member files containing highly sensitive health data, allergy history, medications, birth dates, and phone numbers, but provides no guidance on consent, minimization, access control, retention, or secure storage. In the context of a family medication manager, this materially increases the risk of privacy breaches, unsafe downstream sharing, and regulatory noncompliance because the stored data is both medical and identifying.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The manifest describes a file-based family medication management skill that works with reminder platforms, but this document instructs the agent to create and manage reminder delivery through OpenClaw cron, platform targets, and direct webhook posting examples. That goes beyond merely managing medication records and into implementing outbound notification infrastructure across multiple external channels.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The notification messages and multiple later templates are written in Chinese as the default content, while the document does not state that language is optional or user-selected. This can violate language/locale policy because it imposes a specific language without user opt-in.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The implementation guide tells the agent to detect user platform and use channel-specific delivery mechanisms such as the Telegram bot API, QQ reminder tools, and webhook endpoints. For a skill framed primarily as file-based medication management, this introduces active cross-platform messaging capabilities that are not an obvious requirement unless explicitly declared as part of the skill's operational scope.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The guidance instructs storing notification targets, schedules, and missed-dose logs in local markdown files tied to named member profiles without any warning about sensitive health data handling. Because medication names, dose schedules, member identities, and contact targets can reveal protected health information, this creates a real risk of privacy leakage, unauthorized local access, or accidental disclosure through backups, sync, or repository inclusion.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The guide directs the agent to collect and store highly sensitive health data including allergies, birth dates, weights, and health records in local markdown files without any privacy notice, access controls, retention policy, or consent guidance. In a medication-management context, this creates meaningful confidentiality and safety risk because exposed or modified records could reveal private medical information or lead to unsafe medication decisions.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The file presents the agent interaction in Chinese as the expected user-facing language, and later repeats Chinese trigger examples, without indicating that users may interact in other languages. This creates a language/locale policy concern because it effectively forces a specific language without opt-in or justification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This documentation defines a file-based layout for highly sensitive medical and personal data, including names, birth dates, allergies, chronic conditions, prescriptions, medication history, and photos, but provides no access control, encryption, retention, redaction, or privacy guidance. In the context of a family medication-management skill, this materially increases the risk of unauthorized disclosure, insecure local storage, accidental syncing/backups, and mishandling of regulated health data.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script prints user-facing results such as headings and status text entirely in Chinese while other parts of the tool, including the module docstring and usage text, are in English. This creates a language-policy issue because the skill imposes a specific locale on users without offering opt-in, configuration, or justification for being region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The table presents medication names in both English and Chinese, which imposes a specific bilingual locale format on the user without any stated opt-in or explanation. Under the policy, language or locale constraints should either be optional for the user or clearly justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The file requires Chinese content such as role, gender, allergy, and medication entries, and later prescribes Chinese prompts for collecting the data. There is no indication that the user can choose another language or that the Chinese locale is mandatory for a justified regional use case.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The file embeds Chinese drug names throughout the dosage tables, which creates a language/locale constraint in the skill content. Because the document does not state that it is intended specifically for Chinese-speaking users or offer an alternative language-only version, this is a natural-language locale policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This line gives a Chinese phrase as the way to configure reminders and does not indicate that equivalent commands in other languages are supported. In the absence of a documented locale restriction, this is a natural-language policy issue.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The example asks users to invoke the skill with a Chinese phrase, but the document does not offer language choice or explain a locale-specific limitation. That can violate language policy when a skill appears to require one language by default.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The examples and required filename/data-field conventions are written in Chinese and use Chinese-specific naming patterns and medical labels, with no indication that other languages or locales are supported. This can constitute a language/locale policy issue because the skill appears to prescribe a specific language format without offering user choice or documenting a justified locale restriction.
- Content