Security audit

中医诊所管理系统

Security checks for vulnerabilities and agentic risk

Overview

This clinic skill is purpose-aligned, but it stores sensitive patient, medical, and payment records in ordinary Excel files without adequate safeguards, so users should review it carefully before installing.

Install only if you are comfortable managing patient and financial records as local Excel files yourself. Use a private, access-controlled, backed-up location, avoid shared or synced folders, treat terminal output as sensitive, and do not use it for production PHI unless you add appropriate privacy, security, retention, and compliance controls.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/clinic_manager.py:129
Finding: Spreadsheet Formula Injection Through Untrusted Cell Values
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/clinic_manager.py:104
Finding: Sensitive Patient and Medical Data Stored Without Encryption or Explicit Access Controls
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill is designed to collect and persist patient medical, appointment, prescription, and financial records in local Excel files, but it provides no user-facing privacy warning, consent guidance, retention notice, or security expectations for local storage. This is dangerous because users may disclose regulated or highly sensitive data without understanding it will be stored on disk in a potentially unencrypted, easily copied format.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README explicitly states that patient records, medical charts, appointments, and financial data are stored as local Excel files, but provides no warning about access control, encryption, backups, or regulatory/privacy obligations. In a healthcare context this is dangerous because Excel files are easy to copy, email, or leave unprotected on disk, creating a high risk of unauthorized disclosure or tampering of sensitive medical and financial data.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest description includes broad trigger terms spanning patients, prescriptions, inventory, appointments, billing, and finances, which can cause the skill to activate on loosely related healthcare or business conversations. In this skill's context, over-triggering is risky because activation exposes workflows that handle highly sensitive medical and financial data and may lead the agent to solicit, process, or store that data unnecessarily.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The instruction requires using TCM professional terminology in conversation, effectively imposing a specific language/locale style. There is no indication that the user can opt for another language or simpler wording, which creates a natural-language policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The tool stores highly sensitive medical, financial, and personal data in local Excel files with no access controls, encryption, permission hardening, or user warning. In a clinic-management context, this materially increases the risk of privacy breaches, accidental disclosure, device compromise exposure, and regulatory noncompliance because the data includes patient identifiers, medical complaints, diagnoses, prescriptions, and payment records.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The search/list functionality prints patient and medical information directly to stdout, which can leak protected data into terminal scrollback, logs, shell history capture systems, remote session recordings, or shared consoles. In a healthcare setting this is especially risky because even routine lookups expose names, phone numbers, diagnoses, and visit details without masking or confirmation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The natural-language instructions and examples throughout the file assume Chinese as the required interaction language, but the README does not state that this is optional or provide an alternative language path. Under the language/locale policy, forcing a specific language without user opt-in can be a policy concern unless clearly documented as a justified locale-specific tool.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: 标题及整份文档均以中文撰写，并将字段说明、状态枚举和业务术语默认限定为中文语境，但未说明这是仅面向特定中文用户群的区域性工具，也未提供其他语言选项。根据规则，若技能强制特定语言而没有用户选择或明确、合理的地域限定，应视为自然语言政策风险。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: Natural-language strings in the docstring and user-facing interface are exclusively Chinese, with no option to select another language or indication that the tool is intentionally region-specific. This can violate a language/locale policy when user opt-in or language choice is required.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.