Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly coherent, but it deserves review because it handles sensitive health information and documents forwarding a full profile, AI summary, and conversation log to a human desk without tight minimization details.
Review this before installing if you are not comfortable sharing health-related details. Use it only with explicit consent for symptom and family-history collection, confirm that QR/item sync sends only item IDs, and require a reviewable, minimized handoff payload before any ocean-desk transfer. The recommendations should be treated as checkup guidance, not medical diagnosis.
The README describes collection of age, sex, symptoms, family history, and possible transfer to human staff, but does not clearly warn users that sensitive health and profile data may be collected and disclosed during the workflow. This creates a meaningful privacy and consent risk, especially because health information is highly sensitive and users may not expect handoff to a human agent.
The documentation describes a rich medical recommendation and booking service, but the visible functionality is primarily verification, conflict checking, and pricing. In the healthcare context, this is dangerous because users may treat outputs as clinically grounded recommendations when they are not, and hosts may authorize broader access than the code justifies.
The documentation describes a rich medical recommendation and booking service, but the visible functionality is primarily verification, conflict checking, and pricing. In the healthcare context, this is dangerous because users may treat outputs as clinically grounded recommendations when they are not, and hosts may authorize broader access than the code justifies.
The documentation describes a rich medical recommendation and booking service, but the visible functionality is primarily verification, conflict checking, and pricing. In the healthcare context, this is dangerous because users may treat outputs as clinically grounded recommendations when they are not, and hosts may authorize broader access than the code justifies.
The documentation describes a rich medical recommendation and booking service, but the visible functionality is primarily verification, conflict checking, and pricing. In the healthcare context, this is dangerous because users may treat outputs as clinically grounded recommendations when they are not, and hosts may authorize broader access than the code justifies.
The documentation describes a rich medical recommendation and booking service, but the visible functionality is primarily verification, conflict checking, and pricing. In the healthcare context, this is dangerous because users may treat outputs as clinically grounded recommendations when they are not, and hosts may authorize broader access than the code justifies.
The documentation describes a rich medical recommendation and booking service, but the visible functionality is primarily verification, conflict checking, and pricing. In the healthcare context, this is dangerous because users may treat outputs as clinically grounded recommendations when they are not, and hosts may authorize broader access than the code justifies.
The documentation describes a rich medical recommendation and booking service, but the visible functionality is primarily verification, conflict checking, and pricing. In the healthcare context, this is dangerous because users may treat outputs as clinically grounded recommendations when they are not, and hosts may authorize broader access than the code justifies.
Referenced artifact was not completely inspected
- **仅一个脚本发起网络请求**：`scripts/sync_items.js`（项目同步）
Referenced artifact was not completely inspected
- **仅一个脚本发起网络请求**：`scripts/sync_items.js`（项目同步）
Referenced artifact was not completely inspected
- **仅一个脚本发起网络请求**：`scripts/sync_items.js`（项目同步）
Referenced artifact was not completely inspected
- **仅一个脚本发起网络请求**：`scripts/sync_items.js`（项目同步）
Referenced artifact was not completely inspected
5. **运行时依赖**：需在环境中执行 `npm ci`（已在 `_meta.json` 和 metadata 的 `install` 中声明，使用 `npm ci` 基于 `package-lock.json` 安装确保依赖树的一致性和安全性）
Referenced artifact was not completely inspected
4. **项目验证（强制）**：调用 `node scripts/verify_items.js [推荐项目]`
Referenced artifact was not completely inspected
4. **项目验证（强制）**：调用 `node scripts/verify_items.js [推荐项目]`
Referenced artifact was not completely inspected
4. **项目验证（强制）**：调用 `node scripts/verify_items.js [推荐项目]`
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
| 2026-05-08 | 4.5.6 | OceanBus 黄页集成：新增 recommend.js 统一推荐引擎、register.js/serve.js |
| 2026-04-07 | 4.2.3 | 修复 generate_qr.py 中的 DEBUG_MODE 文件检查，统一使用 NODE_ENV |
| 2026-04-07 | 4.2.2 | 增强 SECURITY_AUDIT.md 脚本行为矩阵；添加 .gitignore；更新 SKILL.md 网络行为说明 |
| 2026-04-07 | 4.2.1 | 修复安全扫描告警：移除 config/api.js 中对 .env 文件检查，统一使用 NODE_ENV；调整 validate_skill.js 检查列表 |
| 2026-04-06 | 4.1.9 | 修复 SKILL.md YAML frontmatter 格式问题，确保 description 被 ClawHub 正确解析 |
| 2026-04-06 | 4.1.8 | 同步更新的 description 字段，进一步强调全国覆盖的机构网络和二维码用户同意机制 |
| 2026-04-06 | 4.1.7 | 完善技能介绍，突出强调国家卫建委和 BMJ/JAMA 等权威循证医学数据来源，增强用户信任度 |
The skill includes customer-service handoff and forwarding of profile and conversation data, which goes beyond recommending checkups or generating booking QR codes. Because the domain is health-related, forwarding summaries and logs can expose sensitive medical and identity information to another party without a narrowly defined necessity or minimization policy.
The file defines all conversation scripts, prompts, and user-facing templates exclusively in Chinese, including mandatory phrasing for information collection, recommendations, and QR-code confirmation. There is no indication that users may choose another language or that the locale restriction is optional or justified as a region-specific requirement, which creates a natural-language policy concern.
The prompt claims '不读取本地文件' ('do not read local files'), yet the same document instructs the agent to consult multiple local JSON reference files and invoke local scripts. This inconsistency is security-relevant because it misrepresents the skill's data access behavior, undermines transparency, and can bypass user or platform expectations about filesystem access.
The trigger phrase is extremely broad (e.g. equivalent to a normal user saying they want a checkup), so the skill may activate during ordinary conversation without the user understanding that a specialized workflow collecting health data and generating referrals has begun. In a health context, accidental invocation is more dangerous because it can initiate sensitive questioning and downstream data sharing with a human agent.
The README explicitly states that complete customer profile and AI recommendation summary can be transferred to a human agent. In the context of a medical recommendation skill, that profile can include sensitive health indicators and inferred risk information, so sending the 'full context' creates unnecessary disclosure risk unless data minimization and explicit consent controls are in place.
The example payload demonstrates transmission of directly identifying information and recommendation details to another party, normalizing disclosure of personal profile data in a support handoff. Even though the sample is limited, in practice the surrounding workflow suggests this payload could be enriched with health-related context, making privacy leakage or over-sharing likely.
This markdown file contains user-facing skill documentation exclusively in Chinese, including usage guidance and referenced prompts, but does not mention that the language is optional or limited to a specific locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
The document explicitly states that all operations involving user data must carry a --consent=true parameter, presenting this as a mandatory safeguard. However, elsewhere it documents sync_items.js as sending user-derived itemIds in a POST body and shows code that builds that request body, without showing any corresponding consent check; this creates an intent/documentation contradiction within the file.
No suspicious patterns detected.