T09 · Insecure Skill Coding Practices
Error
- Location
scripts/daily_health_report_pro.sh:53- Finding
Report-Controlled Python Code Injection Through Unquoted Heredocs
- Content
View full analysis
- Remediation
View remediation
Security audit
Health Mate
Security checks for vulnerabilities and agentic risk
Overview
Health-Mate is a coherent health-report skill, but its shell runners handle report and config text unsafely enough to require review before installation.
Before installing, review or avoid the shell runner scripts until the heredoc handling and .env loading are fixed. Keep config/.env owner-only and do not enable webhook, Telegram, Tavily, public PDF publishing, or runtime font download unless you intend health report data to leave the local machine.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/daily_health_report_pro.sh:11- Finding
Project Environment File Is Executed as Shell Code
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (102)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The supplied code does not match the declared skill description well. The declared purpose describes a broader executable reporting skill with Chinese/English/Japanese report flows, setup/config templating, sanitization of local-LLM output, disease-vs-lifestyle mode separation, and conditional external integrations. This code chunk only implements a helper/archive function that reads Markdown files from a caller-supplied directory, extracts specific health fields, summarizes them, and optionally writes JSON locally. That narrower behavior is not itself problematic as a component, but there is a material mismatch because the declaration claims restrictive file access ('only from an explicitly configured MEMORY_DIR') while this code accepts any memory_dir path and even demonstrates hard-coded absolute paths in the test block. Also, most of the declared major capabilities are absent from this chunk. While absence alone can be acceptable for a partial component, the inconsistent resource-access constraint and materially different primary purpose of this chunk justify flagging a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description is for an executable health-report skill with file access, reporting workflows, setup behavior, sanitization, mode separation, and conditional networking. The supplied code chunk does none of those things. It is a data/constants module for a nutrition parser, containing dictionaries of default portions, nutrition values, and aliases. This is not merely an incomplete view of one helper function implementing the declared behavior; the chunk’s purpose is materially different from the declared skill description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The code generally aligns with parts of the description: it loads a project-local .env, requires MEMORY_DIR, reads only the dated Markdown file from that directory, and writes logs locally. It also performs network actions only when corresponding configuration variables are present. However, there is a material mismatch because this chunk has an additional outbound delivery capability not accurately represented by the declared description. Specifically, it sends the generated report to DingTalk, Feishu, and Telegram, including direct calls to the Telegram Bot API. The description's network clause references Tavily, webhook, or font-download activity, which does not clearly disclose Telegram API delivery and understates the remote distribution behavior present in the code. Other declared items such as multilingual flows, sanitization, mode separation, and setup template creation are not evidenced in this chunk, but absence within this partial chunk alone is not enough to count as mismatch. The key issue is the undeclared/insufficiently declared remote messaging capability.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description presents a comprehensive health-report skill with multiple language flows, configuration/setup behaviors, sanitization of LLM-generated commentary, mode separation, and conditional network integrations. This code chunk instead implements a focused local exporter: it converts existing Markdown health memory files into normalized English Markdown summaries. The biggest concrete mismatch is resource access: although it sets MEMORY_DIR by default, the script actually reads from a positional CLI argument when provided, so it is not restricted to an explicitly configured MEMORY_DIR. Also, the chunk does not implement most of the declared higher-level capabilities (Japanese/Chinese flows, AI commentary sanitization, setup template generation, or mode separation). While absence of unrelated declared features alone is not always a mismatch for a partial chunk, the stated purpose here materially overstates and mischaracterizes what this code actually does, and the source-directory behavior directly conflicts with the resource constraint in the description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
The declared description is for a broader health-report skill with multiple language report flows, configuration/setup features, AI commentary sanitization, mode separation, and constrained input handling from an explicitly configured MEMORY_DIR. The supplied code chunk is much narrower: it is a Japanese export utility that parses source markdown memory files and writes translated Japanese mirrors. It does stay local and performs no network activity, which is consistent with part of the declaration, but several key claimed behaviors are absent. Most importantly, the script can read from and write to directories passed on the command line, so its resource access is not limited to only an explicitly configured MEMORY_DIR. Therefore the description does not accurately represent this code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The main purpose is broadly aligned with a monthly health-report workflow, and the code does keep network activity conditional on configuration. However, there is a material undeclared capability: sending report content to Telegram via the Telegram Bot API. The description only mentions Tavily, webhook, or font-download activity; Telegram is an additional outbound channel and should be declared. Also, this chunk actively sources config/.env at runtime, which is more than the narrowly stated setup-time template creation behavior. Several declared features are simply not evidenced in this code chunk, though absence alone is weaker than a direct contradiction because they may live in monthly_report_pro.py. The strongest mismatch is the undeclared Telegram exfiltration/delivery capability.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
There is substantial overlap with the description: the code clearly supports Chinese/English/Japanese localization, monthly report logic, reading date-based Markdown files from MEMORY_DIR, and distinct lifestyle versus disease-oriented report flows. However, the chunk also contains a large, substantive capability not reflected in the description: generating and ranking hospital/doctor recommendations, including residence-aware fallbacks and prompts for LLM-generated referral suggestions. That is more than an internal implementation detail and should be declared. Conversely, several declared behaviors are not supported by this supplied chunk: local report/log writing, setup that creates a commented config/.env template, sanitizing local-LLM stdout before embedding into reports, and option-gated webhook/font-download behavior. Some of those may exist elsewhere, but based on this chunk alone they are not represented. Therefore the description does not accurately represent this code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The code broadly matches a multilingual monthly-report skill with disease/lifestyle branching and optional Tavily usage. It reads month-based Markdown files from MEMORY_DIR-derived paths, generates AI commentary, builds local text/PDF reports, and only invokes Tavily when an API key is present. However, there are notable description/behavior gaps. First, the code can publish reports to a web-served directory and return a public/base URL via REPORT_WEB_DIR and REPORT_BASE_URL, which is a meaningful distribution capability beyond simply writing reports locally. Second, the code performs substantial hospital and doctor recommendation logic, including mining user medical history and recent visits for follow-up guidance; this is more than a simple health-report generator and should be disclosed if the description is meant to accurately characterize primary behavior. Third, the claimed sanitization of local LLM stdout before embedding is not evidenced in this chunk: AI review output is passed through section-format enforcement, but no clear stdout sanitization step is shown here. Finally, the description mentions webhook network activity as conditional behavior, but that capability is not present in this code chunk. Overall, the description is directionally related but not fully accurate for the supplied code, so this should be flagged as a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description emphasizes a health-report skill with optional network activity for Tavily, webhook, or font-download options, but this code specifically implements outbound delivery to DingTalk, Feishu, and Telegram. DingTalk/Feishu fit the broad 'webhook' claim, but Telegram Bot API usage is a separate explicit network capability not mentioned in the description. The code also primarily serves as an execution-and-delivery wrapper: it loads environment variables from config/.env, computes a target date, invokes another Python report generator, parses a delivery payload, and sends notifications. The visible code chunk does not itself demonstrate the claimed multilingual flows, Markdown-only reading from MEMORY_DIR, stdout sanitization, mode separation, or setup template creation; those may exist elsewhere, but they are not evidenced here. The strongest concrete mismatch is the undeclared Telegram delivery capability.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The provided code only covers weekly PDF/chart generation. Parts of the declared description are consistent at a high level: it supports localization, writes a local report PDF, sanitizes embedded text, and clearly separates lifestyle vs disease-style weekly report sections. However, several declared capabilities are not represented in this code chunk at all: reading Markdown logs from MEMORY_DIR, setup-time config/.env template creation, controlled network features, and local log writing. Because the evaluation asks whether the declared description accurately represents what the supplied code chunk actually does, the description is materially broader than this code and includes capabilities/resources/triggers not present here. That makes this a mismatch for this chunk.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md { "_comment": "Sample Health-Mate configuration. Copy this file to user_config.json and replace the demo values with your own settings. Multiple conditions, custom scoring modules, and medication tracking are supported. For ClawHub manual upload, review the top-level env block below. The setup wizard can create a commented project-local config/.env file from these keys when the file does not already exist.", "_version": "1.5.2", "config_version": "1.5.2", "language": "zh-CN",
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md { "_comment": "Sample Health-Mate configuration. Copy this file to user_config.json and replace the demo values with your own settings. Multiple conditions, custom scoring modules, and medication tracking are supported. For ClawHub manual upload, review the top-level env block below. The setup wizard can create a commented project-local config/.env file from these keys when the file does not already exist.", "_version": "1.5.2", "config_version": "1.5.2", "language": "zh-CN",
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
json { "_comment": "Sample Health-Mate configuration. Copy this file to user_config.json and replace the demo values with your own settings. Multiple conditions, custom scoring modules, and medication tracking are supported. For ClawHub manual upload, review the top-level env block below. The setup wizard can create a commented project-local config/.env file from these keys when the file does not already exist.", "_version": "1.5.2", "config_version": "1.5.2", "language": "zh-CN",
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
json { "_comment": "Sample Health-Mate configuration. Copy this file to user_config.json and replace the demo values with your own settings. Multiple conditions, custom scoring modules, and medication tracking are supported. For ClawHub manual upload, review the top-level env block below. The setup wizard can create a commented project-local config/.env file from these keys when the file does not already exist.", "_version": "1.5.2", "config_version": "1.5.2", "language": "zh-CN",
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
json { "_comment": "Sample Health-Mate configuration. Copy this file to user_config.json and replace the demo values with your own settings. Multiple conditions, custom scoring modules, and medication tracking are supported. For ClawHub manual upload, review the top-level env block below. The setup wizard can create a commented project-local config/.env file from these keys when the file does not already exist.", "_version": "1.5.2", "config_version": "1.5.2", "language": "zh-CN",
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
json { "_comment": "Sample Health-Mate configuration. Copy this file to user_config.json and replace the demo values with your own settings. Multiple conditions, custom scoring modules, and medication tracking are supported. For ClawHub manual upload, review the top-level env block below. The setup wizard can create a commented project-local config/.env file from these keys when the file does not already exist.", "_version": "1.5.2", "config_version": "1.5.2", "language": "zh-CN",
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
json { "_comment": "Sample Health-Mate configuration. Copy this file to user_config.json and replace the demo values with your own settings. Multiple conditions, custom scoring modules, and medication tracking are supported. For ClawHub manual upload, review the top-level env block below. The setup wizard can create a commented project-local config/.env file from these keys when the file does not already exist.", "_version": "1.5.2", "config_version": "1.5.2", "language": "zh-CN",
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh { "_comment": "Sample Health-Mate configuration. Copy this file to user_config.json and replace the demo values with your own settings. Multiple conditions, custom scoring modules, and medication tracking are supported. For ClawHub manual upload, review the top-level env block below. The setup wizard can create a commented project-local config/.env file from these keys when the file does not already exist.", "_version": "1.5.2", "config_version": "1.5.2", "language": "zh-CN",
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh { "_comment": "Sample Health-Mate configuration. Copy this file to user_config.json and replace the demo values with your own settings. Multiple conditions, custom scoring modules, and medication tracking are supported. For ClawHub manual upload, review the top-level env block below. The setup wizard can create a commented project-local config/.env file from these keys when the file does not already exist.", "_version": "1.5.2", "config_version": "1.5.2", "language": "zh-CN",
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python { "_comment": "Sample Health-Mate configuration. Copy this file to user_config.json and replace the demo values with your own settings. Multiple conditions, custom scoring modules, and medication tracking are supported. For ClawHub manual upload, review the top-level env block below. The setup wizard can create a commented project-local config/.env file from these keys when the file does not already exist.", "_version": "1.5.2", "config_version": "1.5.2", "language": "zh-CN",
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python { "_comment": "Sample Health-Mate configuration. Copy this file to user_config.json and replace the demo values with your own settings. Multiple conditions, custom scoring modules, and medication tracking are supported. For ClawHub manual upload, review the top-level env block below. The setup wizard can create a commented project-local config/.env file from these keys when the file does not already exist.", "_version": "1.5.2", "config_version": "1.5.2", "language": "zh-CN",
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python { "_comment": "Sample Health-Mate configuration. Copy this file to user_config.json and replace the demo values with your own settings. Multiple conditions, custom scoring modules, and medication tracking are supported. For ClawHub manual upload, review the top-level env block below. The setup wizard can create a commented project-local config/.env file from these keys when the file does not already exist.", "_version": "1.5.2", "config_version": "1.5.2", "language": "zh-CN",
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python { "_comment": "Sample Health-Mate configuration. Copy this file to user_config.json and replace the demo values with your own settings. Multiple conditions, custom scoring modules, and medication tracking are supported. For ClawHub manual upload, review the top-level env block below. The setup wizard can create a commented project-local config/.env file from these keys when the file does not already exist.", "_version": "1.5.2", "config_version": "1.5.2", "language": "zh-CN",
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python { "_comment": "Sample Health-Mate configuration. Copy this file to user_config.json and replace the demo values with your own settings. Multiple conditions, custom scoring modules, and medication tracking are supported. For ClawHub manual upload, review the top-level env block below. The setup wizard can create a commented project-local config/.env file from these keys when the file does not already exist.", "_version": "1.5.2", "config_version": "1.5.2", "language": "zh-CN",
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python { "_comment": "Sample Health-Mate configuration. Copy this file to user_config.json and replace the demo values with your own settings. Multiple conditions, custom scoring modules, and medication tracking are supported. For ClawHub manual upload, review the top-level env block below. The setup wizard can create a commented project-local config/.env file from these keys when the file does not already exist.", "_version": "1.5.2", "config_version": "1.5.2", "language": "zh-CN",
Static analysis
No suspicious patterns detected.