ClawHub
Back to skill

Security audit

Personal Health Archive Trend

Security checks across malware telemetry and agentic risk

Overview

The skill mostly describes a paid local health-record tool, but bundled backend code and deployment docs contradict the local-only privacy promise for sensitive health data.

Install only if you are comfortable reviewing the backend and can ensure agents never send health reports to the payment endpoint. The publisher should remove or block the server-side profile/reports handling, align all public deployment docs with the privacy claim, correct the SKILL_ID mismatch, and harden private-key handling before this is treated as a straightforward local-only health skill.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (18)

Lp3

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding
The skill explicitly instructs the agent to use network access and inspect whether a `weixinpay` plugin is installed, yet no permissions are declared. This creates a hidden-capability problem: operators and users cannot accurately assess what the skill can access, and an agent may perform external requests or environment/plugin checks without transparent authorization.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The skill claims that all health data remains local and that the external endpoint is only for payment, but the flagged behavior indicates server-side receipt and processing of health-related inputs and generation of results remotely. For a health-data skill, this is especially dangerous because it can mislead users into disclosing sensitive medical information under false privacy assurances, causing unauthorized transmission and processing of highly sensitive personal data.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The skill metadata promises that health data is handled only locally and never uploaded, but this Caddyfile is explicitly configured to expose the service on a public domain and requires public reachability on ports 80/443. Even if application logic keeps processing on the same machine, internet exposure materially changes the trust boundary and can enable remote access, data disclosure, and metadata leakage to third parties such as the certificate authority.

Intent-Code Divergence

Medium
Confidence
92% confidence
Finding
The comments instruct operators to point a real domain at the host's public IP and make the service reachable from the internet, which contradicts the stated 'purely local' handling model. This can mislead users into trusting the skill with sensitive adult health data under false assumptions about isolation and exposure.

Description-Behavior Mismatch

High
Confidence
99% confidence
Finding
The skill description promises that health data stays entirely local, but `execute_business` explicitly processes `profile` and `reports` on the server when those fields are present. For a health-data skill, this mismatch is dangerous because users may disclose highly sensitive medical information under a false privacy expectation, creating confidentiality, compliance, and trust risks.

Intent-Code Divergence

High
Confidence
99% confidence
Finding
The docstring states the paid endpoint does not receive or consume health data, yet the function intentionally consumes such data and can generate a full medical archive server-side. This kind of contradictory implementation is especially risky in a medical context because it undermines informed consent and can lead to unauthorized processing of sensitive personal data.

Description-Behavior Mismatch

High
Confidence
95% confidence
Finding
The deployment guide explicitly instructs exposing the service on the public Internet, configuring external domains, TLS, and payment callback endpoints, which contradicts the stated 'local-only' privacy model for adult health archives. For a health-data skill, this materially increases confidentiality and attack-surface risk because sensitive requests and metadata can now traverse public infrastructure and be reached remotely.

Intent-Code Divergence

Medium
Confidence
93% confidence
Finding
The Cloudflare Tunnel guidance sends user traffic through a third-party edge service, despite the skill description claiming all health data remains local and is not uploaded to external servers. Even if the origin runs on NAS, Cloudflare terminates TLS and intermediates requests, creating a privacy and trust-boundary violation for sensitive adult health information.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The deployment guide explicitly requires a public HTTPS backend and third-party payment callbacks, which directly contradicts the skill metadata claim that health data is processed entirely locally and never uploaded to external servers. In a health-record skill, this mismatch is dangerous because users may disclose sensitive medical data under false privacy expectations, creating a material privacy and trust violation even if the backend is only intended for payment and resource delivery.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The instructions to publish a remote `/api/resource` endpoint show that the skill depends on a network-accessible service, conflicting with the 'local-only' description in the metadata. Because the skill processes adult health archives, this architectural inconsistency increases the risk of undisclosed transmission or server-side handling of sensitive health information.

Intent-Code Divergence

Medium
Confidence
91% confidence
Finding
The documented `SKILL_ID` references `pediatric-health-record`, which conflicts with the declared adult-health skill. This can cause operators to deploy or bind the wrong backend, potentially mixing data, billing flows, or entitlements across different health services, which is especially risky given the sensitivity of medical records.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The code silently accepts uploaded health reports and processes them server-side without any user-facing warning or consent check at the handling point. In a health-record workflow, silent ingestion of medical data increases privacy risk because users may reasonably believe the advertised local-only processing model still applies.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The guide instructs placing a `.env` containing merchant private keys and API keys on the NAS, but only gives a brief warning about not syncing it to third parties. Storing long-lived secrets in a project directory on shared storage increases the risk of accidental exposure through sync tools, backups, weak NAS permissions, or operator error.

Credential Access

High
Category
Privilege Escalation
Content
ports:
      - "8081:8080"
    volumes:
      # 把微信支付私钥挂进容器，路径与 .env 的 PRIVATE_KEY_PATH 一致
      - "./apiclient_key.pem:/Users/weiwu/cert/1749040075_20260805_cert/apiclient_key.pem:ro"
      # SkillHub 开发者私钥（PEM），对应 .env 的 SKILLHUB_PRIVATE_KEY_FILE
      - "./skillhub_private_key.pem:/app/skillhub_private_key.pem:ro"
Confidence
97% confidence
Finding
.env

Credential Access

High
Category
Privilege Escalation
Content
volumes:
      # 把微信支付私钥挂进容器，路径与 .env 的 PRIVATE_KEY_PATH 一致
      - "./apiclient_key.pem:/Users/weiwu/cert/1749040075_20260805_cert/apiclient_key.pem:ro"
      # SkillHub 开发者私钥（PEM），对应 .env 的 SKILLHUB_PRIVATE_KEY_FILE
      - "./skillhub_private_key.pem:/app/skillhub_private_key.pem:ro"
      # 微信支付公钥（公钥模式验签用），对应 .env 的 WX_PUB_KEY_FILE / WX_PUB_KEY_ID
      - "./wechat_pub_key.pem:/app/wechat_pub_key.pem:ro"
Confidence
96% confidence
Finding
.env

Credential Access

High
Category
Privilege Escalation
Content
## 你的实际方案：Cloudflare Tunnel（已打通，采用此方式）
- **不需要**路由器开 80/443，也**不需要**群晖自己签证书。Cloudflare 在边缘终止 TLS，NAS 上只把容器 8080 暴露给本机 `localhost` 即可。
- 容器已在 NAS 跑起来并发布 `8080` 到本机（docker-compose 已加 `apiclient_key.pem` 挂载，证书路径与 .env 一致）。
- 在 **Cloudflare Zero Trust → Access → Tunnels → 你的 tunnel → Public Hostname** 添加一条：
  - Subdomain：`mch`　Domain：`1001058.xyz`　Type：`HTTP`　URL：`http://localhost:8080`
  - （子域名随意，只要和 `.env` 的 `PAY_NOTIFY_URL` 对应；当前已设为 `https://mch.1001058.xyz`）
Confidence
77% confidence
Finding
.env

Known Vulnerable Dependency: requests==2.31 — 6 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +3 more

Medium
Category
Supply Chain
Confidence
90% confidence
Finding
requests==2.31

Known Vulnerable Dependency: cryptography==42.0 — 10 advisory(ies): GHSA-537c-gmf6-5ccf (Vulnerable OpenSSL included in cryptography wheels); CVE-2024-26130 (cryptography NULL pointer dereference with pkcs12.serialize_key_and_certificates); CVE-2024-12797 (Vulnerable OpenSSL included in cryptography wheels) +7 more

High
Category
Supply Chain
Confidence
95% confidence
Finding
cryptography==42.0

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.