Back to skill

Security audit

Tcm System Medicine

Security checks for vulnerabilities and agentic risk

Overview

This markdown-only TCM skill has no system-level malware behavior, but it can guide symptom classification and herbal treatment choices without adequate medical safety boundaries.

Install only if you want an educational TCM analysis framework and will keep it away from real diagnosis, emergency triage, medication changes, or herbal self-treatment decisions. Users with acute symptoms, serious conditions, pregnancy, medication use, allergies, liver or kidney disease, or worsening symptoms should consult qualified medical professionals rather than rely on this skill.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

other

Error
Location
references/TCM_YingWei_Deep_Dive.md:112
Finding

Unsafe and Overconfident Medical Diagnosis and Herbal Treatment Guidance

Content
View full analysis

Vulnerability Details

File Location: references/TCM_YingWei_Deep_Dive.md:112,114-118; SKILL.md:195-204,214
Vulnerability Type: other: Unsafe Medical Guidance
Risk Level: High

Vulnerable Content

references/TCM_YingWei_Deep_Dive.md:112 (English translation of the audited source):

markdown
| Treatment | Pungent-cool exterior-releasing therapy (Yuebi Decoction/Yinqiao Powder) | Pungent-warm exterior-releasing therapy (Mahuang Decoction/Guizhi Decoction) | Tonify deficiency and reduce fire (Xiaojianzhong Decoction/Shenqi Pill) |

references/TCM_YingWei_Deep_Dive.md:114-118 (English translation of the audited source):

markdown
**Important warning — misuse of Yinqiao Powder:**
- Misuse scenario: Classifying a wind-cold illness accompanied by sore throat as an externally contracted wind-heat illness and using Yinqiao Powder.
- Consequence: The pungent-cool ingredients in Yinqiao Powder suppress defensive qi, causing fever and sore throat to improve temporarily, after which the cold pathogen penetrates more deeply and develops into cough, spleen-stomach deficiency-cold, and prolonged illness.
- Key distinction: Fever, thirst, and absence of aversion to cold must all be present before externally contracted wind-heat disease can be diagnosed.
- Systems-medicine interpretation: Defensive qi equals immune response; cold-natured medicine weakens defensive qi through immunosuppression, further weakens healthy qi, allows the pathogen to penetrate more deeply, and further destabilizes the neuroendocrine-immune network.

SKILL.md:195-204 (English translation of the audited source):

markdown
All diseases are essentially disorders of homeostatic regulation in the neuroendocrine-immune network.

| Disease | Systems-medicine interpretation | TCM pathogenesis | Treatment direction |
| Diabetes | Tissue and organ malnutrition | Dysfunction of spleen-stomach transportation and transformation; 
...[truncated 4748 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace mandatory diagnostic rules with cautious educational language. State that symptom patterns are neither sufficient nor necessary to establish a medical diagnosis.
  2. Prohibit the Agent from recommending or selecting named herbal formulas for an individual unless a qualified clinician has evaluated that person.
  3. Expand the professional-review requirement beyond dosage to include formula selection, diagnosis, contraindications, preparation, duration, and monitoring.
  4. Require screening for pregnancy, breastfeeding, age, allergies, current medications and supplements, liver or kidney disease, bleeding risk, cardiovascular disease, and relevant comorbidities before discussing herbal products.
  5. Add explicit interaction warnings and advise consultation with a physician or licensed pharmacist before combining herbs with prescription or over-the-counter medication.
  6. Remove or qualify universal biomedical claims, including the assertion that all diseases are neuroendocrine-immune dysregulation and direct equivalences between defensive qi and immune response.
  7. Clearly distinguish historical or theoretical TCM interpretations from evidence-based biomedical conclusions.
  8. Expand emergency triage beyond the current limited examples. Include altered mental status, severe dehydration, persistent high fever, cyanosis, neurological deficits, anaphylaxis, uncontrolled bleeding, severe abdominal pain, and rapid clinical deterioration.
  9. For serious conditions such as tumors, diabetes, hypertension, chronic infection, and immune disease, require the Agent to prioritize licensed medical assessment and explicitly state that TCM discussion must not replace established treatment.
  10. Add a safe-response template that summarizes uncertainty, gives non-pharmacological general information, identifies red flags, and directs users to appropriate professional care.
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill provides structured symptom questioning, syndrome classification, disease reinterpretation, and treatment-direction guidance, but does not clearly warn that outputs are informational only and not a substitute for licensed medical evaluation. In a health context, this omission can cause users to over-rely on the model for diagnosis or treatment decisions, especially because the content presents a confident, systematic clinical framework.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

This section provides a structured symptom-triage and syndrome-differentiation workflow that can be used to elicit medical history, infer diagnostic conclusions, and suggest treatment directions, yet it lacks a clear, prominent warning that it is not medical advice and not a substitute for licensed care. In the medical context, that omission is risky because users may rely on the model's questioning and conclusions for real health decisions, potentially delaying appropriate evaluation or emergency care.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger list is overly broad and includes many common medical and TCM terms, so the skill can activate in loosely related health conversations without clear user intent. In a medical-analysis skill, unintended activation is risky because it can steer users into diagnostic-style guidance or treatment framing when they did not explicitly request this specialized modality.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The trigger list includes very broad, common medical and wellness terms such as '中医', '辨证', '证候', '方剂', and '病机', which can cause the skill to activate during general health discussions far outside the author's intended scope. Because this skill then shifts into a detailed diagnostic-style framework, over-triggering increases the chance of unsolicited medical guidance being delivered in inappropriate contexts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

This markdown file is entirely written in Chinese, starting with a Chinese title, and does not indicate that the language is optional or region-specific. Under the language/locale policy rule, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.