Security audit
Security checks for vulnerabilities and agentic risk
This skill transparently automates a real Shanghai hospital booking flow on the user's Android phone and includes explicit confirmation gates before final submission, though it handles sensitive medical and identity information.
Install only if you are comfortable letting the agent control a USB-connected Android phone in WeChat for hospital booking. Confirm the hospital, department, date, visit card, fee, and SMS code handling yourself before allowing submission, and avoid retaining screenshots or logs containing patient names, ID numbers, phone numbers, or verification codes.
The description understates that the skill can perform a real, irreversible appointment submission and is framed partly as helper/navigation guidance. That mismatch can mislead operators, reviewers, or automated policy checks into authorizing a skill that can take consequential real-world actions involving PII and user accounts.
The skill clearly instructs use of shell commands and environment variables but does not declare any tool scope such as allowed-tools or permissions. In a skill system, missing explicit scope weakens policy enforcement and can let an agent invoke broader host capabilities than users or reviewers expect.
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
won't have to guess. (Older versions fell through to RapidOCR and died with a cryptic
`cannot identify image file`.)
- Confirm by hand if needed: `ls -la ~/.cache/ocr-bridge/sc.png` — 0 bytes is FLAG_SECURE,
not a broken cable.
- Recover: tap an inert part of the page to blur the field, wait ~2 s, re-shoot.
`$BASE/ocr_bridge.py a11y` still reads these screens via the accessibility tree.
The metadata describes a workflow involving hospital appointment booking, SMS verification, and medical context, but it does not warn users that the skill may handle sensitive personal and health-related information. In this context, the omission increases the risk of unsafe operation, accidental exposure of phone numbers, appointment details, identifiers, or medical data during automation, logging, screenshots, or OCR processing.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
else: # paste, then submit
D.set_clipboard("华山医院")
time.sleep(0.5)
subprocess.run(["adb", "shell", "input", "keyevent", "279"])
time.sleep(2)
tap(1004, 2272, settle=5) # keyboard 搜索 key
wait_for("华山医院")
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
tap(lbl[3] + 180, (lbl[2] + lbl[4]) // 2, settle=1.5)
D.set_clipboard(code)
time.sleep(0.5)
subprocess.run(["adb", "shell", "input", "keyevent", "279"]) # PASTE
time.sleep(2)
if not any(code in b[0] for b in shot()):
die("code does not appear in the field")
No suspicious patterns detected.