Security audit

aky-tcm-prescription

Security checks for vulnerabilities and agentic risk

Overview

This skill is not malware, but it asks the agent to provide individualized TCM diagnosis, prescriptions, and dosages for potentially risky herbs with incomplete clinical guardrails.

Review this skill carefully before installing. It should only be used as educational or clinician-supervised reference material, not as a source for self-diagnosis, self-prescribing, pregnancy care, pediatric care, emergency symptoms, or medication-interaction decisions. Users should expect to share sensitive health details if they use the clinical workflow.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This reference file provides specific herb indications and dosage ranges that can directly enable users to self-prescribe or self-administer potentially unsafe substances without clinical oversight. The risk is heightened because the skill is explicitly designed for TCM prescription assistance, and the content includes toxic or high-risk herbs such as 附子, 朱砂, 细辛, 半夏, 天南星, and pregnancy-sensitive agents, yet the file itself lacks a clear safety disclaimer, clinician-only boundary, emergency guidance, or contraindication-first framing.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This file provides detailed syndrome differentiation and formula-selection guidance for medical conditions, including named prescriptions for symptom clusters, without any warning that the content is educational only or that diagnosis and treatment require licensed clinical supervision. In the context of an AI prescription assistant, users may rely on this as actionable treatment advice, creating risk of misdiagnosis, delayed conventional care, inappropriate herbal use, contraindication exposure, and harm in vulnerable groups such as pregnant patients or people with serious infections.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger description is very broad and ends with a catch-all phrase covering 'any TCM clinical guidance,' which can cause the skill to activate in situations beyond narrow prescription assistance. In a medical context, over-broad activation increases the chance the assistant will provide formula, dosage, or treatment guidance when the user did not explicitly seek this specialized workflow, raising safety and misrouting risks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This section gives actionable constitution-based treatment modifications, including adding potent herbs such as Fuzi, Rougui, and Ganjiang, without an explicit warning that TCM diagnosis and prescribing require qualified clinical supervision. In a prescription-assistant skill, users may treat these tables as direct self-medication guidance, increasing the risk of misdiagnosis, contraindicated herb use, dosing mistakes, and harm in vulnerable groups such as pregnant, pediatric, geriatric, or medically complex patients.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The quick-reference symptom-cluster-to-formula table provides simplified mappings from symptoms to classical formulas, which can be mistaken for diagnostic rules or direct treatment instructions. In the context of an AI TCM prescription assistant, omission of a clear warning materially increases the chance that users or downstream agents will apply formulas without adequate differentiation, safety screening, or escalation for urgent symptoms.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This file provides detailed diagnostic guidance for tongue, pulse, symptom, and gynecological assessment without any user-facing disclaimer that it is educational information rather than medical advice or a substitute for licensed care. In the context of a prescription assistant that supports syndrome differentiation and clinical guidance, users may rely on this content for self-diagnosis or treatment selection, creating a meaningful risk of delayed care, misdiagnosis, and unsafe treatment decisions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This markdown file includes many key instructional and reference elements in Chinese script alongside English, beginning with the title and continuing throughout the document. Because the skill does not state that Chinese is optional, provide a translation policy, or explain that it is intended only for Chinese-reading users, it can be interpreted as imposing a language requirement without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The note states that herb names use standard Chinese names with Pinyin, which imposes a language/locale presentation requirement. The file does not indicate that users may choose another language or naming convention, so this can violate language-choice policy unless clearly optional or justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: SQP-3 applies to all file types and covers language or locale policy violations. The title explicitly uses Chinese alongside English, but the document does not indicate that the user opted into Chinese output or that this locale constraint is required for a region-specific audience.
Content: No source excerpt is available for this finding.