Pediatric Health Record

• Outcome: Review
• Latest audit: Aug 7, 2026 · 8:52 AM UTC
• Version: 0.1.0

Overview

The skill is mostly coherent, but it handles children’s health data and payment credentials with weak retention and deployment safeguards that users should review before installing.

Install only if you are comfortable sending a child’s health details to the named merchant server and paying through the WeChat payment flow. Operators should add explicit cache expiration/deletion, avoid synced/shared folders for secrets or health data, use managed secrets or tighter file permissions for private keys, pin reviewed dependency versions, and verify the refund/payment state handling before production use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill describes network transmission of sensitive pediatric health data and dependence on a payment plugin, but it does not declare corresponding permissions. Missing permission declarations undermine transparency and platform enforcement, making it easier for a skill handling children's health information to access network or environment capabilities without explicit review. In the context of minors' medical data, this is more dangerous because even intended data transfer must be tightly declared and auditable.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented purpose says data is submitted to mch.1001058.xyz only for one-time record generation with limited retention, but the analyzed behavior indicates additional payment-processing flows, local content generation, and in-memory caching of orders and generated content. This discrepancy is dangerous because users and reviewers may consent based on a narrower data-flow and retention model than what actually occurs, especially given the data involves children's health and potentially payment metadata. The context makes this more severe because the skill explicitly invokes guardian consent and child privacy protections, so any mismatch directly weakens informed consent and compliance.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The README points to a personal health record path outside the stated pediatric paid-cloud service scope, which suggests repository mixing or accidental inclusion of unrelated sensitive medical data context. In a child health record skill, even a stray reference can indicate poor data segregation and raises the risk of exposing or mishandling personal health information.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The implementation materially exceeds the declared skill scope. Instead of a narrowly scoped pediatric-record submission service to the stated merchant host, it exposes a general WeChat Agent Pay merchant demo with payment orchestration and broader reusable commerce logic, increasing attack surface and creating a mismatch between user expectations and actual server behavior.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The refund callback handler treats REFUND_SUCCESS the same as payment success by setting rec['paid'] = True. That creates a business-logic flaw where a refunded transaction can still qualify as paid and unlock content, enabling post-refund access or inconsistent entitlement state.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The deployment guide mixes a pediatric health-record service with example paths containing '个人健康档案' and a specific person's name, which indicates handling of real identifiable health data in a potentially shared sync location. In the context of a 0–3 year-old health archive service, this inconsistency raises privacy and data-governance concerns because operators may accidentally deploy with real personal medical data or mis-scope what data is being processed.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The instructions tell the operator to place a sensitive .env file containing merchant private keys and API keys into the deployment directory on the NAS, while also describing synchronization workflows. For a health-data processing service, exposure of payment credentials and related service secrets can enable account compromise, forged callbacks, unauthorized service access, and broader compromise of protected pediatric records.

Credential Access

High

• Category: Privilege Escalation

Content

ports:
      - "8080:8080"
    volumes:
      # 把微信支付私钥挂进容器，路径与 .env 的 PRIVATE_KEY_PATH 一致
      - "./apiclient_key.pem:/Users/weiwu/cert/1749040075_20260805_cert/apiclient_key.pem:ro"
      # SkillHub 开发者私钥（PEM），对应 .env 的 SKILLHUB_PRIVATE_KEY_FILE
      - "./skillhub_private_key.pem:/app/skillhub_private_key.pem:ro"

• Confidence: 97% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

volumes:
      # 把微信支付私钥挂进容器，路径与 .env 的 PRIVATE_KEY_PATH 一致
      - "./apiclient_key.pem:/Users/weiwu/cert/1749040075_20260805_cert/apiclient_key.pem:ro"
      # SkillHub 开发者私钥（PEM），对应 .env 的 SKILLHUB_PRIVATE_KEY_FILE
      - "./skillhub_private_key.pem:/app/skillhub_private_key.pem:ro"
      # 微信支付公钥（公钥模式验签用），对应 .env 的 WX_PUB_KEY_FILE / WX_PUB_KEY_ID
      - "./wechat_pub_key.pem:/app/wechat_pub_key.pem:ro"

• Confidence: 96% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

## 你的实际方案：Cloudflare Tunnel（已打通，采用此方式）
- **不需要**路由器开 80/443，也**不需要**群晖自己签证书。Cloudflare 在边缘终止 TLS，NAS 上只把容器 8080 暴露给本机 `localhost` 即可。
- 容器已在 NAS 跑起来并发布 `8080` 到本机（docker-compose 已加 `apiclient_key.pem` 挂载，证书路径与 .env 一致）。
- 在 **Cloudflare Zero Trust → Access → Tunnels → 你的 tunnel → Public Hostname** 添加一条：
  - Subdomain：`mch`　Domain：`1001058.xyz`　Type：`HTTP`　URL：`http://localhost:8080`
  - （子域名随意，只要和 `.env` 的 `PAY_NOTIFY_URL` 对应；当前已设为 `https://mch.1001058.xyz`）

• Confidence: 94% confidence
• Finding: .env

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31
cryptography>=42.0

• Confidence: 93% confidence
• Finding: requests>=2.31

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31
cryptography>=42.0

• Confidence: 94% confidence
• Finding: cryptography>=42.0

Known Vulnerable Dependency: requests==2.31 — 6 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +3 more

Medium

• Category: Supply Chain
• Confidence: 89% confidence
• Finding: requests==2.31

Known Vulnerable Dependency: cryptography==42.0 — 10 advisory(ies): GHSA-537c-gmf6-5ccf (Vulnerable OpenSSL included in cryptography wheels); CVE-2024-26130 (cryptography NULL pointer dereference with pkcs12.serialize_key_and_certificates); CVE-2024-12797 (Vulnerable OpenSSL included in cryptography wheels) +7 more

High

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: cryptography==42.0

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.