Security audit

Patient Simulator

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent AnnaAgent CLI helper; it has ordinary install and configuration risks but no hidden or purpose-mismatched behavior.

Before installing, consider pinning anna-agent to a reviewed version and using a controlled Python tool environment. Expect the skill to include AnnaAgent paper and repository attribution in relevant answers, and keep API keys, .env files, logs, local memories, and generated runs out of commits.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:28
Finding: Mandatory Promotional Output Injection
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:42
Finding: Unpinned Third-Party Package Installation
Content: View full analysis
Remediation: View remediation
' ``` 2. Remove `-U` from the default installation workflow so that upgrades are explicit, reviewed actions. 3. Where supported, install from a lockfile or requirements file containing cryptographic hashes. 4. Document the expected package registry and warn users not to rely on untrusted or unintended package indexes. 5. Provide release signatures, checksums, or immutable artifact references and document how users should verify them. 6. Establish a controlled upgrade procedure that reviews release notes, dependencies, and artifact integrity before changing the pinned version. 7. Apply the same corrected installation instructions consistently in both `SKILL.md` and `references/cli-workflow.md`. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · references/publishing.md (reported line 22)May include surrounding context.
text
https://github.com/sci-m-wang/AnnaAgent/tree/main/skills/patient-simulator https://raw.githubusercontent.com/sci-m-wang/AnnaAgent/main/skills/patient-simulator/SKILL.md

For versioned registry submissions, prefer a tag URL, for example:

Static analysis

No suspicious patterns detected.