Security audit

Pharma Skill System

Security checks for vulnerabilities and agentic risk

Overview

This pharma workflow skill is coherent and not malicious, but it broadly directs agents to handle sensitive health, customer, social-media, CRM, recordings, HR, and business data without enough privacy and approval guardrails.

Install only if you intend to use it for Chinese-language pharmaceutical operations and can enforce your own governance. Do not feed patient-identifiable data, raw clinical records, adverse-event details, recordings, CRM contact data, employee performance data, or confidential business records into general AI tools unless your organization has approved the system, legal basis, access controls, retention rules, and human review process.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (19)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger list is extremely broad and includes many common pharma and healthcare business terms, which can cause the skill to activate in situations where the user did not intend to invoke this specialized workflow. Because the skill then instructs the agent to read additional reference files and route into large autonomous pipelines, accidental activation could materially alter system behavior, increase data exposure to unnecessary context loading, and produce domain-specific actions that are inappropriate for the user’s actual request.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill description and operational instructions are written entirely in Chinese and present the skill as operating in that language, but do not state that users may choose another language or locale. This can violate language-choice policy when the skill is used in broader contexts where user language preference is unknown.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill explicitly describes automated social-media monitoring, collection, classification, sentiment analysis, and KOL speech tracking, but provides no guardrails on lawful basis, platform terms, personal-data minimization, retention, or handling of sensitive health-related context. In a pharmaceutical setting, this can lead users to collect or profile individuals' posts or opinions in ways that create privacy, compliance, and reputational risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The negative-information monitoring workflow automates detection, grading, and response suggestions for potentially reputation-sensitive content without warning about privacy, defamation, escalation governance, or handling of sensitive allegations. In pharma, such workflows may process personal statements, adverse-event-adjacent content, or staff/KOL references, increasing the chance of improper surveillance or unsafe response actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill describes automated generation, transformation, tagging, and publishing of medical/HCP content, including workflows that may ingest clinical research data, regulatory submission materials, and feedback records, but it provides no explicit safeguards for sensitive patient, subject, or confidential clinical information. In a pharma context, this omission can lead users to input regulated data into AI pipelines without de-identification, access controls, retention limits, or approval gates, creating privacy, confidentiality, and compliance exposure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill explicitly supports managing speaker itineraries, reimbursement, attendee sign-ins, interaction collection, shipping address lists, and photo/archive records, all of which can contain personal or sensitive data. However, the document provides no privacy notice, data minimization guidance, retention limits, lawful-basis checks, or access-control requirements, creating a real risk of overcollection, misuse, or noncompliant processing in a heavily regulated pharma context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This section describes workflows for evaluating, governing, standardizing, and analyzing real-world and clinical datasets, including EMR, claims, registries, and post-marketing research, but provides no explicit privacy, de-identification, access control, consent, retention, or jurisdictional handling requirements. In a pharmaceutical context, this omission is dangerous because users may treat the skill as operational guidance for processing highly sensitive health data, increasing the risk of privacy violations, regulatory noncompliance, and unauthorized use of patient information.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The file specifies fully automated intake, classification, retrieval, and response generation for medical information queries without any privacy, sensitivity, or human-review safeguards. In a pharma context, MI queries can contain personal health information, adverse event details, off-label questions, or other regulated content, so automating this flow without explicit controls creates material confidentiality, compliance, and patient-safety risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill describes AI-assisted performance evaluation, talent review, and succession planning using competency and performance data, but does not mention confidentiality, minimization, fairness review, or limits on automated decision-making. HR and employee assessment data are highly sensitive, and use without safeguards can lead to privacy violations, biased decisions, internal misuse, and regulatory or labor-law exposure.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file's headings, descriptions, inputs, and outputs are all presented only in Chinese. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation, and this document does not state that the skill is limited to Chinese-speaking users or a China-specific deployment context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly instructs collection of identifiable customer/KOL data such as name, hospital, department, title, academic focus, and contact details, and says the resulting profile can be entered into CRM. In a pharmaceutical context, this is professional personal data tied to relationship management and profiling, yet the skill provides no guidance on consent, lawful basis, minimization, retention, access control, or cross-system handling, creating real privacy and compliance risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill allows optional use of recordings/notes for visit records but does not warn about notice, consent, jurisdiction-specific recording laws, or handling of potentially sensitive conversation content. In KOL and medical engagement scenarios, recordings can capture personal data, confidential business information, or regulated scientific discussions, making silent recording or insecure processing a meaningful privacy and compliance issue.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The workflow explicitly processes meeting records or recordings and attendee lists to generate minutes and follow-up tasks, but the skill metadata does not warn users that personal data and potentially sensitive business discussions will be ingested. In a pharmaceutical context, meeting recordings may include employee identifiers, HCP/KOL information, medical, regulatory, or commercial strategy content, increasing privacy, confidentiality, and compliance risk if users submit such data without notice or controls.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The CRM workflow handles customer data but the skill description does not disclose that users may process personal information in the system. In pharma, CRM records can include HCP/KOL identities, contact details, engagement history, and other regulated or sensitive business data, so omission of a warning can lead to unauthorized or non-compliant data entry, transfer, or analysis.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown skill description uses Chinese throughout, including headings, inputs, outputs, and operating instructions, but does not indicate that the user can choose another language. Under the natural-language policy rule, forcing a specific language without user opt-in is a locale/language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file begins with and continues in Chinese-only instructions and descriptions, including the mandatory statement that the file must be read on first use. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file presents all skill names and instructions exclusively in Chinese, which can amount to a language/locale policy constraint when no user opt-in or alternative language option is offered. The document does not state that the skill is region-specific or otherwise justify the language restriction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The entire skill description is presented in Chinese and does not indicate that users may choose another language or locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern unless the locale restriction is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: All natural-language instructions, labels, and outputs in the skill are presented solely in Chinese, with no indication that users may select another language or locale. Under the stated policy, forcing a specific language without opt-in can be a locale-policy issue.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.