T09 · Insecure Skill Coding Practices
Error
- Location
scripts/run.py:131- Finding
Patient information is transmitted without the promised de-identification
- Content
View full analysis
int: prompt = f"""请根据以下信息，为患者提供处方开具辅助建议。 【处方信息】 {prescription_info.strip()} 请严格按照要求输出 JSON + 摘要。""" print("正在分析处方信息...") result = llm([sys_msg(SYSTEM_PROMPT), user_msg(prompt)]) ``` ### Technical Analysis There is no de-identification, redaction, field filtering, or validation between loading the clinical record and transmitting it to the model API. `prescription_info` is interpolated into the outbound prompt without modification. Although the documentation discourages users from supplying names, identification numbers, and telephone numbers, a warning is not a technical control. Unstructured clinical records commonly contain direct and indirect identifiers, including names, contact details, dates, record numbers, addresses, and rare diagnoses. This discrepancy creates a false security expectation: operators may reasonably rely on the explicit statement that de-identification occurs automatically and therefore submit records containing protected health information. ### Attack Path 1. A clinician supplies a text or JSON input containing patient identifiers and clinical information. 2. `load_input()` reads the record and returns its contents without redaction. 3. `run_prescription()` interpolates the entire record into `prompt`. 4. `make_llm_caller()` pas ...[truncated 958 chars]- Remediation
View remediation