Security audit

Bytesagain Clinical Brief

Security checks for vulnerabilities and agentic risk

Overview

This is a local clinical-formatting helper with disclosed commands and no evidence of exfiltration, remote code, or privilege abuse, though it should be used carefully with sensitive medical text.

Install only if you are comfortable with a local CLI that prints the clinical text you provide, including raw inputs, to the terminal. Use de-identified notes where possible, avoid shared or logged shells for PHI, remove branding before copying into clinical records, and rely on qualified clinicians for decisions.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Note

Location: scripts/script.sh:44
Finding: Hard-Coded Promotional Content in Clinical Output
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description partially matches the code's domain and some functions: it does summarize clinical notes and can output specialty briefs and a differential-diagnosis-style section. However, the implementation materially exceeds that scope. In addition to summarization, it includes a dedicated lab interpretation command that evaluates values against reference ranges, a case presentation formatter, and several independent command modes. The differential generator is also more of a fixed template with symptom-specific pointers than true note summarization. The script also creates a local data directory under the user's home directory, which is an undeclared filesystem interaction, though minor. Overall, the skill's description is too narrow and does not accurately represent the full set of behaviors.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script directly reflects raw clinical notes back into terminal output, which can expose sensitive health information to shell history captures, logs, screenshots, CI job output, terminal multiplexers, or other shared environments. In a healthcare context, this is especially risky because the input is likely to contain PHI/PII, and the tool provides no minimization, masking, or explicit privacy safeguards before redisplay.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.