Pilot Healthcare Triage Setup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:01 AM UTC
• Version: 1.0.0

Overview

The skill’s healthcare-triage purpose is coherent, but it handles patient medical data with under-documented safeguards and installs mutable dependencies, so it needs review before use.

Do not use this skill with real patient data until the dependencies are pinned and reviewed, peer identities are verified, hostnames are validated, and the deployment has approved PHI controls for transport, storage, audit logs, retention, access control, and command-history/process-argument exposure. Treat the provided medical payloads as illustrative only and replace them with synthetic test data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:47

Finding

Unpinned Third-Party Skill Installation Creates Supply-Chain Risk

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:38

Finding

Unvalidated User-Controlled Prefix Is Inserted into Shell Commands

Content

View full analysis

- ``` ```bash # intake <-> symptom-analyzer: pilotctl --json handshake -symptom-analyzer "setup: healthcare-triage" pilotctl --json handshake -intake "setup: healthcare-triage" # symptom-analyzer <-> scheduler: pilotctl --json handshake -scheduler "setup: healthcare-triage" pilotctl --json handshake -symptom-analyzer "setup: healthcare-triage" # symptom-analyzer <-> records: pilotctl --json handshake -records "setup: healthcare-triage" pilotctl --json handshake -symptom-analyzer "setup: healthcare-triage" # scheduler <-> records: pilotctl --json handshake -records "setup: healthcare-triage" pilotctl --json handshake -scheduler "setup: healthcare-triage" ``` ### Technical Analysis The deployment prefix originates from user input and is intended to be substituted directly into commands executed through Bash. The skill does not define a hostname allowlist, reject whitespace or shell metacharacters, or require the resulting argument to be passed through a shell-safe mechanism. If an agent performs literal textual substitution, characters such as command separators, substitutions, redirections, or newline characters could change the shell command's structure. Merely surrounding arbitrary input with quotes would not be sufficient if commands are dynamically assembled or evaluated; strict validation and argument-based process i ...[truncated 1220 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: README.md:91

Finding

Protected Health Information Is Exposed Through Command-Line Arguments

Content

View full analysis

-symptom-analyzer — subscribe to patient intake: pilotctl subscribe -intake patient-intake # On -intake — publish a patient intake: pilotctl publish -symptom-analyzer patient-intake '{"patient_id":"P-20240315-001","age":45,"symptoms":["chest_pain","shortness_of_breath","dizziness"],"duration":"2 hours","severity":"high","history":["hypertension","diabetes_type2"]}' # On -scheduler — subscribe to triage results: pilotctl subscribe -symptom-analyzer triage-result # On -symptom-analyzer — publish a triage result: pilotctl publish -scheduler triage-result '{"patient_id":"P-20240315-001","urgency":"emergent","score":9.2,"differentials":["acute_coronary_syndrome","pulmonary_embolism","panic_attack"],"recommended":"cardiology_stat"}' # On -records — subscribe to encounter records: pilotctl subscribe -symptom-analyzer encounter-record pilotctl subscribe -scheduler appointment-record # On -scheduler — publish an appointment record: pilotctl publish -records appointment-record '{"patient_id":"P-20240315-001","provider":"Dr. Chen","specialty":"cardiology","time":"2024-03-15T14:30:00Z","urgency":"emergent","location":"ER-Bay-3"}' ``` ### Technical Analysis The documented workflow places patient identifiers, symptoms, medical history, differential diagnoses, urgency assessments, provider information, and appointment details directly in command-line arguments. Sensitive command-line values may be retained in interactive shell history, terminal session recordings, command auditing systems, support transcripts, or copied deployment logs. Depending on the operating syste ...[truncated 1767 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The example commands publish richly identifying medical and appointment data, including symptoms, history, urgency, provider, specialty, and location, without instructing users to use synthetic or de-identified test data only. Because the skill is specifically for healthcare triage, users are likely to copy these examples into real environments, creating a direct PHI exposure and unsafe operational precedent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README describes a healthcare workflow that collects, transmits, analyzes, and logs highly sensitive patient data, but it does not include any explicit warning about PHI handling, environment hardening, consent, minimum-necessary use, or that the example is not production-safe by default. In a medical/HIPAA context, omission of privacy and deployment safeguards materially increases the risk that operators will handle real patient data insecurely or assume compliance from the description alone.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

The trust model auto-approves communication once both sides send a handshake, with no documented independent verification step such as out-of-band identity validation, approval workflow, or key fingerprint confirmation. In a sensitive healthcare deployment, this can enable mistaken trust relationships, misrouting of PHI, or easier abuse if hostnames or setup procedures are spoofed or misconfigured.

Content

Scanner excerpt · README.md (reported line 64)May include surrounding context.

2. Establish trust

Agents are private by default. Each pair that communicates must exchange handshakes. When both sides send a handshake, trust is auto-approved -- no manual step needed.

bash

# On intake:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill sets up a healthcare workflow that processes PHI and includes external integrations, but it provides no explicit warning, consent step, or guidance to avoid using real patient data during setup and testing. In a medical context, silent handling of sensitive data materially increases the risk of privacy violations, accidental disclosure, and regulatory noncompliance.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 79% confidence

Finding

The skill instructs the agent to write a persistent manifest under ~/.pilot/setups containing role, peer hostnames, data flows, and healthcare workflow metadata. Persisting operational configuration for a PHI-handling system can expose sensitive architecture details to other local users, backups, or later sessions if file permissions and retention are not controlled.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

pilotctl --json set-hostname -

text

**Step 4:** Write the setup manifest:
```bash
mkdir -p ~/.pilot/setups
cat > ~/.pilot/setups/healthcare-triage.json << 'MANIFEST'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The workflow example publishes patient data, including symptoms and a patient identifier, across agents without any accompanying privacy or safety warning. Even though the example is illustrative, it normalizes transmitting potentially sensitive medical data and may lead operators to test with real PHI over unvalidated channels.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.