ClawHub
Back to skill

Security audit

Bytesagain Medical Scribe

Security checks for vulnerabilities and agentic risk

Overview

This skill locally generates medical document drafts, with visible review warnings, but users should remove the built-in vendor branding before putting output into clinical records.

Before installing, consider whether your clinical workflow permits patient-document drafts generated from command-line inputs and remove the vendor footer before pasting anything into an EHR, referral, prescription, or discharge record. All generated content should be reviewed by a licensed professional.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

other

Note
Location
scripts/script.sh:57
Finding

Unconditional Third-Party Branding Injected into Generated Medical Documents

Content
View full analysis

Vulnerability Details

File Location: scripts/script.sh:57-59, scripts/script.sh:109-111, scripts/script.sh:164-166, and scripts/script.sh:211-213
Vulnerability Type: Unrequested output integrity manipulation
Risk Level: Low

The script unconditionally adds third-party branding to every SOAP note, discharge summary, referral letter, and prescription draft:

bash
───────────────────────────────────────────────
⚠️  DRAFT ONLY — Review and approve before use.
Powered by BytesAgain | bytesagain.com
bash
───────────────────────────────────────────────
⚠️  DRAFT ONLY — Review and sign before release.
Powered by BytesAgain | bytesagain.com
bash
───────────────────────────────────────────────
⚠️  DRAFT ONLY — Review before sending.
Powered by BytesAgain | bytesagain.com
bash
───────────────────────────────────────────────
⚠️  DRAFT ONLY — Verify drug, dose, interactions before dispensing.
Powered by BytesAgain | bytesagain.com

Technical Analysis

The branding is embedded directly in the here-documents used to generate clinical output. It is not controlled by a configuration option and cannot be disabled by the user. Consequently, every invocation of the affected commands modifies the resulting medical document with promotional content unrelated to the patient's clinical record.

This does not meet the definition of skill instruction hijacking because it does not alter the agent's session goals or safety constraints. It is instead an output-integrity issue outside the enumerated T01–T09 classifications.

No shell-command injection occurs through these fields: user-provided values are expanded as text inside here-documents and are not subsequently evaluated as shell code. The audit also found no network request associated with the embedded domain.

Attack Path

  1. A user invokes soap, discharge, referral, or prescription.
  2. The script interp ...[truncated 1315 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove third-party promotional content from all generated clinical-document templates.
  2. Retain the clinically relevant draft and review warnings, as these directly support safe use.
  3. If attribution is required, expose an explicit option such as --include-attribution, disabled by default.
  4. Keep project, feedback, and vendor links confined to help output or package metadata rather than patient-facing documents.
  5. Add automated tests asserting that default document output contains only requested clinical content and approved safety notices.
  6. Have clinical governance personnel review every template to ensure its output complies with EHR, prescription, referral, and institutional documentation policies.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.