Dental Clinic Assistant

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:53 PM UTC
• Version: 1.0.0

Overview

This dental WhatsApp assistant is mostly purpose-aligned, but it needs review because it handles patient data and calendar-write access while giving conflicting emergency medication guidance and weak privacy/credential instructions.

Review before installing. Remove or clinically approve the emergency medication and first-aid guidance, fix emergency numbers by clinic jurisdiction, disclose what patient data is collected and where it is stored, minimize calendar event descriptions, restrict calendar sharing and service-account permissions, store credentials outside the project or in a secret manager, and define retention, consent, and staff-access controls.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: config/faq-template.json:106

Finding

Service-account credential stored within the project configuration directory

Content

View full analysis

Remediation

View remediation

other

Warning

• Location: config/messages-template.json:38

Finding

Emergency response provides unscreened medication advice despite an explicit prohibition

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly states it must never diagnose or suggest medications, but the emergency triage section later gives specific first-aid and OTC medication guidance such as ibuprofen use. In a dental WhatsApp assistant context, that contradiction is dangerous because users may rely on the bot for medical advice during emergencies, creating safety and liability risk if the guidance is inappropriate for the patient.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The Portuguese emergency note directs users of a US clinic configuration to call 192 (SAMU), which is a Brazil-specific service and inconsistent with the clinic's US location. In an emergency-assistance context, presenting the wrong emergency number can delay urgent care and create real patient safety risk, especially for bilingual users relying on the bot during distress.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · config/faq-template.json (reported line 108)May include surrounding context.

json

"note_pt": "Para emergencias com risco de vida, ligue 192 (SAMU)"
  },
  "google_calendar": {
    "credentials_path": "./config/google-calendar-credentials.json",
    "calendar_id": "[e-mail]"
  },
  "staff_alert": {

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation describes collecting patient identifiers, appointment details, and syncing with Google Calendar via service-account credentials, but it does not clearly warn operators about the sensitivity of that data or the security implications of credential handling. This can lead to insecure deployment practices, overbroad calendar permissions, accidental credential exposure, and inadequate consent/privacy disclosures for patient data.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README asserts the bot never gives medical advice, but the emergency flow explicitly provides first-aid and medication guidance such as bleeding control and ibuprofen use. In a dental triage context, that contradiction can cause unsafe reliance on automated advice, create regulatory/compliance exposure, and increase patient harm risk if the guidance is incomplete, inappropriate, or delayed.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill claims it should never store sensitive health data in chat, yet it later instructs collection of patient intake information and states that the information is saved. Even if the collected items are not detailed medical history, the contradiction encourages collection and retention of personal patient data in a health-related channel without clear data handling boundaries, which increases privacy and compliance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The Google Calendar integration stores patient phone and email in event descriptions without any user-facing notice or consent step. In a healthcare-adjacent workflow, this can expose personal data to calendar viewers, delegates, sync tools, backups, and third-party integrations beyond what the patient expects from a chat conversation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The handoff workflow instructs the bot to send patient name, phone, conversation summary, and urgency to staff without telling the patient that their conversation details will be shared internally. In a clinic setting, this can result in unexpected dissemination of sensitive or potentially health-related information, creating privacy and trust issues.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest-style JSON sets default_language to en, which can enforce an English-first behavior across the skill without any documented user language selection. Under the policy rule, locale or language constraints should either be user-selectable or clearly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The emergency template embeds locale-specific instructions ('911' in English and '192 (SAMU)' in Portuguese) as if language alone determines the user's emergency jurisdiction. In a WhatsApp dental assistant, users may speak either language from any country, so incorrect emergency guidance could delay access to urgent care during a life-threatening situation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The README presents a fixed language scope and later labels all plans as including 'bilingual support (EN/PT)'. This can be a natural-language locale policy issue because it constrains interaction languages without explicit user opt-in or justification that the skill is intentionally limited to English and Portuguese users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The instruction says to detect language automatically and default to the language configured in a file when the user's language is mixed or unclear. This can force a specific language choice without confirming the user's preference, which is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The manifest describes a patient-facing WhatsApp assistant for scheduling, reminders, triage, FAQs, intake, and review requests. The separate requirement to track operational metrics and post-interaction satisfaction expands the skill into analytics/monitoring behavior that is not mentioned in the stated purpose.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.