ClawHub
Back to skill

Security audit

unisound-med-mental-health

Security checks for vulnerabilities and agentic risk

Overview

This mental-health helper is mostly coherent, but it sends sensitive user text and a bearer key to a configurable remote API without destination safeguards.

Review before installing. Use only a trusted HTTPS model endpoint, avoid overriding --api-url unless you control the destination, use a scoped key, and de-identify any real patient or personal mental-health information before sending it through this skill.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/run.py:87
Finding

Unrestricted API Endpoint Override Exposes Credentials and Sensitive Prompts

Content
View full analysis

Vulnerability Details

File Location: scripts/run.py, lines 87-101, 222, and 271-279
Vulnerability Type: Unrestricted transmission of credentials and sensitive data to a user-controlled endpoint
Risk Level: Medium

Vulnerable Code

python
req = Request(
    api_url,
    data=json.dumps(payload, ensure_ascii=False).encode("utf-8"),
    headers={
        "Content-Type": "application/json",
        "Authorization": f"Bearer {appkey}",
    },
)
resp = urlopen(req, timeout=timeout)
body = json.loads(resp.read().decode("utf-8"))
python
p.add_argument("--api-url", default=DEFAULT_API_URL, help="OpenAI-compatible API endpoint")
python
out["answer"] = call_llm(
    api_url=args.api_url,
    model=args.model,
    appkey=args.appkey,
    system_prompt=system_prompt_for(task_key, args.system_prompt),
    user_prompt=user_prompt,
    temperature=float(args.temperature),
    timeout=int(args.timeout),
)

Technical Analysis

The --api-url command-line argument is passed directly to urlopen without validating its scheme or destination. The request always includes the supplied application key in the Authorization header and the user's mental-health question in the JSON body.

Consequently, any actor able to influence the script arguments can redirect the request to an attacker-controlled server. The implementation does not require HTTPS, enforce an approved-host allowlist, or prevent production credentials from being attached when a custom endpoint is selected.

Because this skill processes potentially sensitive medical and mental-health information, disclosure of the request body can have privacy and regulatory consequences beyond ordinary prompt leakage.

Attack Path

  1. A deployment or automation layer supplies a valid application key through --appkey.
  2. An attacker gains control over, or injects into, the configurable --api-url argument. 3 ...[truncated 1476 chars]
Remediation
View remediation

Remediation Suggestions

  1. Enforce HTTPS

    • Parse the endpoint with urllib.parse.urlsplit.
    • Reject every scheme except https.
    • Reject URLs containing embedded user information or malformed hostnames.

  2. Allowlist trusted destinations

    • Permit only the documented API hostname by default.
    • If custom providers are required, use an administrator-managed allowlist rather than accepting arbitrary runtime URLs.
    • Validate the normalized hostname and port, not a string prefix.

  3. Separate credentials by endpoint

    • Never send the production medical-model key to a custom endpoint.
    • Require a separate credential explicitly configured for each approved provider.
    • Consider disabling --api-url entirely in production deployments.

  4. Control redirects

    • Disable automatic redirects or validate every redirect target before following it.
    • Do not forward authorization headers to a different origin.

  5. Restrict internal and local destinations

    • Resolve the destination and reject loopback, link-local, private, multicast, and otherwise prohibited address ranges unless explicitly required.
    • Revalidate after DNS resolution and when processing redirects to reduce server-side request forgery risk.

  6. Protect sensitive inputs

    • Warn operators that questions may contain protected health information.
    • Minimize transmitted data and avoid logging credentials or raw health-related prompts.
    • Add automated tests confirming that unapproved hosts and plaintext HTTP endpoints are rejected.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill declares no explicit tool scope or permissions in SKILL.md even though its implementation reportedly has file read, file write, and network capabilities. In an agent setting, undocumented capabilities weaken least-privilege controls and make it easier for a caller or downstream platform to invoke the skill with broader access than intended, which is more concerning here because the skill handles potentially sensitive mental-health input and sends data to a remote API.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Natural-language strings that define the skill identity, prompts, task titles, and hints are all fixed in Chinese, which effectively forces a specific language/locale. The file does not provide an option for users to select another language or document a justified locale restriction.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

Manifest 将该技能描述为心理健康疏导与科普问答，并强调仅包含单文件可独立部署；从描述上看更像是一个本地可拷贝运行的 skill。代码却在 L015 定义远程 API 地址，并在 L097-L106 通过 HTTP 请求将 system/user prompt 发往外部服务处理，这一远程数据传输行为并未在 manifest 描述中体现。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This skill sends mental-health questions and associated metadata to a remote API, and those inputs may contain highly sensitive health or crisis-related personal information. There is no explicit user-facing consent, minimization, redaction, or privacy warning before transmission, which creates a real confidentiality and compliance risk in this context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.