Healthcare Chatbot Pro

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:15 AM UTC
• Version: 1.0.0

Overview

This healthcare chatbot skill is not clearly malicious, but it asks users to deploy opaque mutable code and connect sensitive healthcare systems with broad patient-data authority.

Review before installing. Only deploy this with a pinned, reviewed package and widget build, narrowly scoped non-production credentials during installation, runtime-only production secrets, HIPAA/BAA review, explicit patient consent and notice for EMR access and logging, de-identification/minimization for analytics, and strict limits on EMR write operations.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:235

Finding

Unpinned and Unaudited npm Package Installation

Content

View full analysis

Remediation

View remediation

``` 2. Commit and enforce a package lockfile using `npm ci` in deployment workflows. 3. Verify package ownership, provenance, signatures, and registry integrity metadata before installation. 4. Publish or vendor the corresponding source so the installed implementation can be audited. 5. Generate an SBOM and continuously scan the package and its transitive dependencies. 6. Disable lifecycle scripts during installation where operationally possible: ```bash npm ci --ignore-scripts ``` 7. If lifecycle scripts are necessary, review them explicitly and run installation in an isolated, unprivileged build environment without production secrets. 8. Inject production credentials only at runtime, after dependency installation, and scope every account to the minimum required permissions. 9. Use separate credentials for EMR read and write operations, with write access disabled unless explicitly required. ]]>

T03 · Remote Payload Retrieval and Execution

Warning

• Location: SKILL.md:247

Finding

Execution of Mutable Remote JavaScript Without Version or Integrity Pinning

Content

View full analysis

``` ### Technical Analysis The recommended integration loads JavaScript directly from a mutable external URL. It does not specify an immutable version or provide a Subresource Integrity (`integrity`) hash. JavaScript loaded this way executes within the embedding clinic website's browser context. The effective payload can therefore change after this repository has been audited. If the CDN, publishing account, DNS path, or upstream build pipeline is compromised, modified code could be served to all users of the integration without any change to `SKILL.md`. The remote widget is also initialized with a browser-visible API key. The placeholder does not establish the key's actual privileges, so privileged-key exposure cannot be confirmed; nevertheless, any deployed browser key must be treated as public and constrained accordingly. ### Attack Path 1. An attacker compromises the CDN origin, widget publishing credentials, DNS configuration, or upstream release pipeline. 2. The attacker replaces `chatbot-widget.js` with a malicious payload while retaining the documented URL. 3. Patients or staff visit a clinic page containing the recommended integration. 4. Their browsers retrieve and execute the modified script under the page's browser context. 5. The script can inspect or modify DOM content available to it, intercept information submitted through the widget, issue same-context browser requests where permitted, or collect browser-exposed configuration. 6. Captured data is transmitted to attacker-co ...[truncated 897 chars]

Remediation

View remediation

" crossorigin="anonymous"> ``` 3. Configure a restrictive Content Security Policy that allows scripts and outbound connections only to required origins. 4. Isolate the widget in a sandboxed, cross-origin iframe rather than granting it direct access to the clinic page DOM. 5. Treat every browser-delivered API key as public. Restrict it by origin, operation, rate, environment, and expiration, and never expose EMR, CRM, Twilio, or other privileged credentials client-side. 6. Require backend authorization for sensitive actions and validate patient consent server-side. 7. Apply short-lived tokens, key rotation, audit logging, anomaly detection, and revocation procedures. 8. Pin and review every widget release before deployment, and monitor the delivered artifact for unauthorized hash changes. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md

"files": ["SKILL.md"],

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 389)May include surrounding context.

md

- **Data Encryption**: All patient data encrypted in transit (TLS 1.3) and at rest (AES-256)
- **Access Logs**: Audit trail of who accessed what patient data and when
- **Consent Management**: Chatbot must confirm patient consent before pulling EMR records
- **Retention Policy**: Automatically purge conversation logs per your compliance requirements (typically 7 years)

---

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly promotes logging all patient conversations and producing analytics reports in a healthcare context, where transcripts may contain PHI. Although the document later mentions HIPAA controls, it does not pair the logging behavior with clear user-facing notice, consent boundaries, minimization, or de-identification requirements, creating a real privacy and compliance risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.

md

# EMR Systems (choose one or more)
EMR_SYSTEM=epic  # or: cerner, nextgen, athena
EMR_API_KEY=xxxxxxxxxxxxxxxx
EMR_BASE_URL=https://api.epic-fhir.com/

# CRM Integration
CRM_SYSTEM=salesforce_health_cloud  # or: hubspot, pipedrive

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Auto-detecting and defaulting to a patient's preferred language without user choice can infer sensitive attributes and alter how healthcare information is presented without confirmation. In a medical support workflow, incorrect inference could also lead to misunderstanding of instructions or disclosures.

Content

No source excerpt is available for this finding.