T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/clinic_manager.py:120- Finding
Spreadsheet Formula Injection Through Untrusted Cell Values
- Content
View full analysis
- Remediation
View remediation
Security audit
TCM Clinic - English Edition
Security checks for vulnerabilities and agentic risk
Overview
This clinic-management skill is coherent, but it handles patient health and billing records with weak privacy safeguards.
Review carefully before installing. Use only on a secured, single-user machine or protected clinic environment, keep the data directory out of shared, synced, public, or source-controlled folders, and assume the Excel files and command output may contain sensitive patient health and billing information. Do not use it for real regulated clinical records unless you add appropriate privacy, access-control, encryption, retention, backup, and spreadsheet-formula sanitization safeguards.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/clinic_manager.py:40- Finding
Sensitive Patient and Medical Data Stored in Unencrypted Excel Files
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Rogue AgentSelf-Modification, Session Persistence
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The medical-record creation flow prints the complete clinical record to stdout, including complaint, diagnostic observations, diagnosis, prescription, and notes. Because this is highly sensitive health data, exposing it in console output can leak PHI through terminal visibility, job runners, transcript logs, or agent/tool logging systems; the clinic context makes this especially dangerous.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README explicitly positions the skill to collect, manage, and store highly sensitive health and billing data, and states that all data is stored as local Excel files without any warning about privacy, access controls, encryption, or operational safeguards. In a medical context, this can lead users to handle protected health information insecurely, increasing the risk of unauthorized disclosure, accidental sharing, device compromise, or regulatory noncompliance.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 88% confidence
- Finding
The skill is designed to create, search, update, and list persistent patient records and related clinic data stored in local Excel files, which is session persistence involving highly sensitive health and financial information. Without explicit safeguards for consent, access control, minimization, retention, and secure storage, this creates a meaningful privacy and confidentiality risk; the medical context makes it more dangerous because the persisted data includes patient identities, diagnoses, prescriptions, appointments, and billing records.
- Content
text User Request ├── Patient-related? → Patient Management Module │ ├── "new patient" / "register patient" → Create patient record │ ├── "find patient" / "search patient" → Search by name/phone/ID │ ├── "update patient" → Update patient record │ └── "patient list" / "all patients" → Output patient summary
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Line L180 instructs the skill to 'Use TCM professional terminology in conversation' unconditionally. This imposes a specific language/style constraint on all users without offering a choice or opt-in, which matches the policy's language/locale-style violation criteria.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This markdown file describes storage of patient identities, medical records, appointments, and financial data in local Excel files, but it provides no warning about the sensitive nature of this information or the need to protect it. Under the markdown-file criteria, descriptions that could affect user data or privacy should include warnings when handling medical and financial records.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script stores patient demographics, medical records, prescriptions, appointments, and financial data in unencrypted local Excel files. In a clinic-management context this is protected health information and personal data, so local persistence without access controls, encryption, retention notice, or consent handling materially increases confidentiality and compliance risk if the host is shared, compromised, backed up insecurely, or the files are exfiltrated.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
After registration, the program prints the full patient record as formatted JSON to stdout, including contact details, address, allergies, chronic diseases, and notes. Terminal output is often logged, captured in shell history tooling, or visible to nearby users, so this creates an avoidable disclosure channel for sensitive personal and medical information.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 71% confidence
- Finding
The document defines user-facing categorical values such as gender, constitution types, appointment statuses, and payment methods exclusively in English, with no indication that localization is optional or configurable. This can violate language/locale policy when a skill implicitly forces one language without user opt-in or documented justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
All help text, prompts, and operational messages in this clinic management tool are fixed in English, and there is no option for locale or language selection. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Static analysis
No suspicious patterns detected.