Security audit

PathClaw 病理助手

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for PathClaw slide analysis, but it uploads highly sensitive pathology files to an external service without a clear pre-upload consent or privacy disclosure step.

Review this skill before installing if you handle patient or regulated medical data. It should only be used when the user understands that the selected .svs slide will be uploaded to 华银康集团 PathClaw for processing and when that transfer is allowed by applicable privacy, consent, and data-governance requirements.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill instructs the agent to upload .svs pathology slide files to a third-party external service but does not require an explicit user-facing warning or consent step before transfer. Because pathology slides can contain highly sensitive medical data, silent exfiltration to an external processor creates material privacy, compliance, and data-governance risk.

Static analysis

No suspicious patterns detected.