Health Ai Applications

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:18 AM UTC
• Version: 1.0.3

Overview

The skill is mostly a health-industry reference library, but it tells agents to automatically install and load an unpinned external skill dependency before use.

Review before installing. Do not allow automatic installation of `universal-task-os` unless you can verify its publisher, source, version, and permissions, and approve loading it. Treat the health-marketing and customer-service templates as drafts only; avoid entering secrets, regulated health data, or unnecessary personal/customer data, and require legal or compliance review before production use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:42

Finding

Unverified Automatic Installation and Loading of an External Skill Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 42-45 and line 57
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code Snippet

The following is a faithful English translation of the relevant instructions:

markdown

**Loading check process** (run every time the Skill is activated):

1. Detect whether the `universal-task-os` Skill is installed.
2. **Not installed** → Automatically install the `universal-task-os` Skill.
3. **Installation succeeds** → Load UTOS at the same time and execute according to this Skill's usage rules.
4. **Installation fails** → Fall back to read-only reference mode.

1. **Dependency check**: When activated, detect and install UTOS according to the process above.

Technical Analysis

The Skill instructs the Agent to install an external dependency automatically whenever universal-task-os is absent and then immediately load that dependency. The project does not specify:

• An authoritative package registry or repository URL
• An immutable version, commit, or content digest
• Cryptographic signature or checksum verification
• Package publisher or namespace validation
• A dependency review process
• Explicit user approval before installation
• The permissions or tools the dependency is allowed to use

Name-only dependency resolution can expose the workflow to dependency confusion, namespace substitution, typosquatting, registry compromise, or later modification of an otherwise legitimate package. Immediate loading after installation means that instructions supplied by the resolved dependency may affect the current Agent session before the dependency has been reviewed.

The declared project functionality is primarily a reference library containing task catalogs, requirements, questionnaires, and exemplars. Read-only access to these documents does not inherently require automatic third-party installation. Consequently, mandator ...[truncated 2148 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove automatic dependency installation from the activation path.
2. Preserve read-only reference mode as the default when the dependency is unavailable.
3. Require explicit, informed user approval before installing or loading any external Skill.
4. Identify the dependency using a trusted repository or registry and an unambiguous publisher namespace.
5. Pin an immutable release version or commit rather than resolving the latest package by name.
6. Publish and verify a cryptographic checksum or signed provenance record before installation.
7. Review the dependency's instructions, scripts, transitive dependencies, and requested permissions before loading it.
8. Use a permission manifest that limits the dependency to the minimum file, network, and tool access required.
9. Install and evaluate the dependency in an isolated environment before enabling it in a session containing sensitive data.
10. Fail closed if source, identity, integrity, or permission validation cannot be completed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (13)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description and core skill content are written entirely in Chinese and present the skill as the default operating mode, with no indication that users may choose another language. This is a natural-language locale policy concern because the file effectively imposes a specific language without documented opt-in or a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file presents its title, description, and operating instructions entirely in Chinese, with no indication that other languages are supported or that Chinese is an optional locale. Under the stated policy, a skill that effectively requires a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The document claims to model compliance review, but the surrounding exemplar content undermines that framing by later supplying examples that would likely fail the very checks listed in the audit table. This contradiction is dangerous because it can create false assurance: users may believe they are following a compliant workflow while being guided toward non-compliant health advertising practices.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This exemplar presents health-marketing copy for a supplement while including claims that appear medically suggestive, exaggerated, or insufficiently substantiated, such as bowel-function improvement, weight-related outcomes, detox implications, and quantified efficacy. Because the skill is positioned as a reusable template for healthcare marketing, users may directly copy these claims into production content, creating regulatory, consumer-protection, and platform-enforcement risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This exemplar describes automated handling and routing based on customer identifiers, order status, loyalty tier, and issue type, but includes no privacy notice, data minimization guidance, consent basis, retention limits, or restrictions on exposing personal/order data in replies. In a health-related customer service context, even seemingly routine after-sales data can become sensitive when tied to product usage, complaints, or special populations (for example pregnancy-related questions), increasing compliance and privacy risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This markdown file presents all instructional content, labels, and examples exclusively in Chinese, and it does not indicate that Chinese is optional or that the skill is intended only for a Chinese-speaking or region-specific audience. Under the policy rule for language/locale, forcing a single language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file contains end-user-facing natural-language instructions entirely in Chinese, and nowhere indicates that the user may choose another language or that the skill is intentionally restricted to a Chinese-speaking or region-specific context. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The questionnaire explicitly asks enterprises to submit operational details such as team size, tools, internal workflows, bottlenecks, budget, and priority automation targets, then states an LLM will use the responses to generate a customized plan. That is potentially sensitive business information, yet the document provides no privacy notice, data minimization guidance, retention policy, or warning not to include confidential or personal data, which increases the risk of overcollection and unintended disclosure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This markdown exemplar is written entirely in Chinese and presents the skill as a content-creation template without any indication that users may choose another language or locale. Under the policy, a language or locale constraint should either be optional or explicitly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

This markdown file consists entirely of Chinese-language instructions and examples, but it does not state that the skill is intended only for Chinese-speaking users or provide any user opt-in for language/locale. Under the policy rule for natural-language violations, forcing a specific language without user choice can be a locale-policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file contains natural-language instructions exclusively in Chinese and does not indicate that the user can choose another language or locale. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This file presents all instructions, labels, and fields exclusively in Chinese, which effectively forces a specific language for users. There is no indication that the skill is intentionally limited to Chinese-speaking users or that an alternative language option is available.

Content

No source excerpt is available for this finding.