T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:89- Finding
Mandatory Conversation-Link Solicitation Alters Agent Output
- Content
View full analysis
- Remediation
View remediation
Security audit
QuanMi Fiber Pipeline
Security checks for vulnerabilities and agentic risk
Overview
This skill needs review because it directs AI-driven diabetes monitoring, health advice, patient-data handling, and sales outreach without enough privacy, consent, clinical-oversight, or claim-support safeguards.
Review carefully before installing. Use this only as an internal drafting or planning aid unless qualified medical, legal, privacy, and marketing reviewers approve the workflow. Do not connect real CGM feeds, patient records, CRM data, customer conversations, or automated outreach channels until consent, access controls, retention/deletion rules, opt-out handling, clinician oversight, and claim substantiation are added. Remove the conversation-link solicitation or replace it with optional, redacted feedback.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
references/exemplars/P4-验证引擎域范本.md:110- Finding
Sensitive CGM Health-Data Pipeline Lacks Mandatory Security Controls
- Content
View full analysis
mobile application -> cloud API - Manual: patient uploads photograph -> OCR -> database Data fields: - timestamp: ISO 8601 - glucose_value: mmol/L - device_id: unique sensor ID - patient_id: de-identified patient ID Data quality checks: - Completeness: 96 readings expected per day - Plausibility: discard values above 25 or below 1.1 mmol/L - Continuity: if data is absent for more than two hours, send "Please check sensor attachment" ``` The corresponding requirement states: ```markdown CGM data must be collected continuously, with a target completeness of at least 95%. Alerts must be delivered within five minutes. Patient data must be stored in de-identified form. ``` ### Technical Analysis The Skill requires continuous ingestion and processing of highly sensitive glucose measurements through Bluetooth, mobile applications, cloud APIs, OCR, and storage systems. De-identification is the only substantive data-security measure specified. The design does not mandate: - Transport encryption or certificate validation. - API authentication and scoped authorization. - Encryption at rest or managed key rotation. - Explicit patient consent and purpose limitation. - Data minimization for stable device identifiers. - Retention, deletion, or backup-expiration policies. - Tenant isolation and least-privilege access. - Access logging, anomaly monitoring, or breach ...[truncated 2261 chars]- Remediation
View remediation
other
Error
- Location
references/qfp-requirements.md:19- Finding
Unsupported Medical Assertions Propagate into Patient and Sales Workflows
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (17)
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This is a true issue: the skill explicitly requires competitor rebuttals to avoid inflammatory terms such as “骗局”, yet the exemplar patient-facing copy uses exactly that wording. In a health-marketing skill, this inconsistency can cause the agent to generate defamatory, non-compliant, or escalatory content despite the stated guardrail, weakening downstream compliance controls.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This section describes autonomous patient monitoring, analysis of CGM data, anomaly detection, and personalized health guidance. In a diabetes-management context, these are medical-adjacent functions that can influence treatment behavior, and the document frames them as largely automated with minimal human review, creating safety risk if outputs are wrong, delayed, or overtrusted.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The document claims autonomous outbound engagement, follow-up, and customer interaction for hospitals, pharmacies, and other targets without showing authorization, consent controls, or scope limits. This expands the skill from internal planning into active external persuasion and pipeline manipulation, which can enable spam, misrepresentation, or unreviewed health-related sales claims at scale.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Phrases like '加载即执行' indicate the skill may begin acting immediately when loaded, but the document does not pair that behavior with strong gating, confirmation, or least-privilege constraints. For a pipeline that spans knowledge gathering, content generation, validation, and sales activation, implicit execution can lead to unintended processing of sensitive health, business, or customer data.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Phrases like '加载即执行' indicate the skill may begin acting immediately when loaded, but the document does not pair that behavior with strong gating, confirmation, or least-privilege constraints. For a pipeline that spans knowledge gathering, content generation, validation, and sales activation, implicit execution can lead to unintended processing of sensitive health, business, or customer data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The runtime replacement mechanism instructs the system to substitute real company names, people, brands, products, and prices into outputs, but it does not provide strong warnings or safeguards around confidentiality, authorization, or disclosure risk. If used with real identifiers, the skill could unintentionally expose proprietary business information or generate external-facing materials containing sensitive internal pricing and branding data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The skill advertises continuous monitoring, automatic CGM data collection, tracking, and follow-up capabilities, but the privacy caveats are minimal and not prominently embedded where the capabilities are introduced. In a medical-adjacent workflow, this creates material risk of collecting or processing personal health data without clear consent, minimization, retention, or access-control requirements.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill specifies automated customer follow-up and FAQ auto-reply workflows over channels like WeChat/email using customer-specific status and validation data, but it does not require consent, lawful basis, opt-out handling, or minimization controls. In this healthcare-adjacent sales context, automated outreach can expose sensitive business and potentially health-related information to the wrong recipients, create unlawful profiling/contact practices, and increase privacy and compliance risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The feedback loop explicitly aggregates CRM records, customer-service dialogues, and patient feedback for NLP analysis and clustering, yet provides no concrete safeguards for handling personal data or health-adjacent content. Because the skill targets diabetes-management sales and service workflows, these data sources may contain sensitive personal and medical information, making uncontrolled collection, analysis, and retention a significant privacy and regulatory risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill specifies automatic CGM data collection, analysis, anomaly detection, and personalized recommendations for patients, but it does not state any privacy safeguards, consent requirements, data minimization, retention limits, or access controls. In a health-management context, this omission is dangerous because it normalizes processing sensitive medical data and generating health guidance without clear handling boundaries or mandatory human oversight beyond limited severe-alert review.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill describes automated sales tracking, timed follow-up, case-update sending, and automatic answering of customer questions, but gives no warning or constraints around customer-data use, consent for outreach, or limits on automated outbound actions. This creates risk of unauthorized use of personal or commercially sensitive data, spam/compliance violations, and unintended disclosure through case-based communications.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The skill allows persona switching via a simple natural-language trigger ('启用角色：[角色名]') with only minimal scoping rules, which can let ordinary user phrasing unexpectedly alter the assistant's behavior. In a medically adjacent sales/education pipeline, this increases the risk of the model adopting authority-mimicking roles such as doctor or founder and producing persuasive or misleading health-related content without explicit authorization boundaries.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The invocation examples ('启用角色：创始人', '以内分泌科主任的角度看这份材料') are conversationally broad and could be matched by normal dialogue, causing accidental or adversarial persona activation. Because the available roles include high-trust personas like an endocrinology department director and patient, an attacker or ordinary user can steer outputs into simulated authority or testimonial modes that make health and commercial messaging more persuasive and less safely bounded.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This section gives disease-causation claims and behavior guidance for diabetes management, including positioning the product as having therapeutic effect, without a clear warning to seek clinician supervision or to avoid replacing prescribed treatment. In a diabetes context, users may delay evidence-based care, self-manage based on unsupported claims, or change diet/medication behavior unsafely, creating a meaningful risk of hyperglycemia, hypoglycemia, and delayed treatment.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The service-package language promises rapid blood sugar normalization within days and implies reduced medication burden ('不吃药、不加药、不加重') while framing the offering as a dependable solution, yet provides no safety warning or requirement for medical oversight. For people with diabetes, such claims can directly encourage unsafe self-treatment, medication nonadherence, and reliance on a commercial package instead of clinical management, which can cause severe acute and long-term harm.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This passage proposes automatic patient monitoring and individualized recommendations in a diabetes setting without strong warnings about medical limits or sustained human oversight. Because it includes severe abnormality detection and behavior-changing advice, users may rely on the system as if it were a clinical safety layer, leading to missed emergencies, unsafe dietary changes, or delayed professional care.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The document describes automatic collection, analysis, reporting, and reuse of sensitive patient health data such as CGM readings, age, disease course, medication status, and enrollment timing, but provides no explicit privacy, consent, retention, or access-control safeguards. In a healthcare context, that omission creates substantial risk of unauthorized processing, secondary use, leakage, and regulatory noncompliance.
- Content