Diagnostics-PMPH-10edition

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:22 AM UTC
• Version: 1.0.0

Overview

This is a medical training skill with no code or install-time system access, but it includes high-risk clinical procedure and treatment instructions that are not consistently scoped to qualified clinician oversight in the runtime skill files.

Review this skill carefully before installing in any setting where non-clinicians may use it. It should be limited to education or clinician-supervised decision support, with local safety policy requiring escalation of diagnosis, procedures, medications, anesthesia, and emergency care decisions to qualified medical professionals using current guidelines.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (187)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill gives concrete diagnostic escalation instructions, including urgent imaging and biopsy triggers, without a prominent warning that it is only decision support and not a substitute for clinician judgment or guideline-based evaluation. In a medical context, this is especially dangerous because users may over-rely on threshold-based output for diagnosis, potentially leading to unnecessary invasive procedures, delayed alternative diagnoses, or unsafe care decisions.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill provides concrete premedication and anesthesia instructions, including specific drugs, doses, routes, and timing, but does not prominently warn that these are high-risk clinical actions requiring licensed clinician oversight, patient-specific assessment, monitoring, and emergency readiness. In a clinical skill that could be reused out of context, this omission increases the risk of unsafe sedation, airway compromise, allergic reaction, or dosing errors if followed by unqualified users or without proper safeguards.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill provides ranked differential diagnosis and next-step testing or initial treatment direction in a clinical context, but it does not include any warning that the content is educational/supportive only, not medical advice, and requires qualified clinician oversight. In a high-stakes medical setting, users may over-rely on the output for real patient care, increasing the risk of misdiagnosis, delayed escalation, or inappropriate treatment.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly recommends '治疗实验验证'—using response to treatment as evidence for diagnosis—without any safety boundary, supervision requirement, or warning that empiric treatment can harm patients, delay correct diagnosis, or create false reassurance. In a clinical reasoning skill, this is especially dangerous because users may interpret it as authorization to initiate therapy as a diagnostic test rather than reserving such decisions for qualified clinicians under appropriate standards of care.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill gives actionable medical management instructions such as immediately stopping suspected drugs and using diuretics, spironolactone, antihistamines, or glucocorticoids, but it does not explicitly require clinician supervision or urgent medical evaluation. In a medical skill, this can lead users to self-manage potentially serious edema, allergic reactions, kidney injury, electrolyte disturbances, or inappropriate cessation of necessary prescription therapy.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This is a true safety vulnerability: the skill gives step-by-step instructions for an invasive lymph node aspiration, including repeated punctures, but does not clearly require performance by qualified clinicians or warn about bleeding, infection, vascular/nerve injury, specimen contamination, or escalation when anatomy is uncertain. In the context of a generally accessible agent skill, this omission could enable unsafe self-performance or use by inadequately trained personnel, increasing risk of serious patient harm.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill gives ECG interpretation guidance tied directly to urgent triage and treatment decisions, including determining ischemia type and suggesting emergency interventions, but it does not clearly state that it is only educational support and not a substitute for clinician judgment, formal protocols, serial ECGs, biomarkers, or emergency escalation. In an acute chest-pain context, overreliance on this standalone guidance could delay MI recognition, misclassify STEMI/NSTEMI or mimics, and lead to unsafe treatment decisions.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This skill provides symptom-based differential diagnosis and high-risk triage cues for serious conditions such as aortic dissection, pulmonary embolism, brain herniation, myocardial infarction, and poisoning, but it does not warn that the content is for educational support only and cannot replace urgent clinical evaluation. In a deployed agent context, users may rely on this structured guidance as actionable medical advice, causing delay in emergency care or unsafe self-triage when red-flag symptoms are present.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This file is a Japanese-language README, and nowhere in the document does it explain that Japanese is required for a region-specific deployment or otherwise justified by policy. While other language versions are linked, this specific file still imposes a locale/language choice on the reader without documenting an opt-in or constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The file presents the skill documentation entirely in Russian, while the policy requires flagging language or locale constraints unless the user is offered an explicit language choice or the constraint is clearly justified. Although links to other language versions appear later, the document itself opens in Russian without any opt-in mechanism or explanation for why this locale is required.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 169)May include surrounding context.

md

<a href="https://www.star-history.com/#xllgreen%2FDiagnostic-Medicine-PMPH-10edition&Date">
 <picture>
   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=xllgreen/Diagnostic-Medicine-PMPH-10edition&type=Date&theme=dark" />
   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=xllgreen/Diagnostic-Medicine-PMPH-10edition&type=Date" />
   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=xllgreen/Diagnostic-Medicine-PMPH-10edition&type=Date" />
 </picture>

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 170)May include surrounding context.

md

<a href="https://www.star-history.com/#xllgreen%2FDiagnostic-Medicine-PMPH-10edition&Date">
 <picture>
   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=xllgreen/Diagnostic-Medicine-PMPH-10edition&type=Date&theme=dark" />
   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=xllgreen/Diagnostic-Medicine-PMPH-10edition&type=Date" />
   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=xllgreen/Diagnostic-Medicine-PMPH-10edition&type=Date" />
 </picture>

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 171)May include surrounding context.

md

<a href="https://www.star-history.com/#xllgreen%2FDiagnostic-Medicine-PMPH-10edition&Date">
 <picture>
   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=xllgreen/Diagnostic-Medicine-PMPH-10edition&type=Date&theme=dark" />
   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=xllgreen/Diagnostic-Medicine-PMPH-10edition&type=Date" />
   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=xllgreen/Diagnostic-Medicine-PMPH-10edition&type=Date" />
 </picture>

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README_EN.md (reported line 166)May include surrounding context.

md

<a href="https://www.star-history.com/#xllgreen%2FDiagnostic-Medicine-PMPH-10edition&Date">
 <picture>
   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=xllgreen/Diagnostic-Medicine-PMPH-10edition&type=Date&theme=dark" />
   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=xllgreen/Diagnostic-Medicine-PMPH-10edition&type=Date" />
   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=xllgreen/Diagnostic-Medicine-PMPH-10edition&type=Date" />
 </picture>

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README_EN.md (reported line 167)May include surrounding context.

md

<a href="https://www.star-history.com/#xllgreen%2FDiagnostic-Medicine-PMPH-10edition&Date">
 <picture>
   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=xllgreen/Diagnostic-Medicine-PMPH-10edition&type=Date&theme=dark" />
   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=xllgreen/Diagnostic-Medicine-PMPH-10edition&type=Date" />
   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=xllgreen/Diagnostic-Medicine-PMPH-10edition&type=Date" />
 </picture>

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README_EN.md (reported line 168)May include surrounding context.

md

<a href="https://www.star-history.com/#xllgreen%2FDiagnostic-Medicine-PMPH-10edition&Date">
 <picture>
   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=xllgreen/Diagnostic-Medicine-PMPH-10edition&type=Date&theme=dark" />
   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=xllgreen/Diagnostic-Medicine-PMPH-10edition&type=Date" />
   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=xllgreen/Diagnostic-Medicine-PMPH-10edition&type=Date" />
 </picture>

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README_FR.md (reported line 128)May include surrounding context.

md

<a href="https://www.star-history.com/#xllgreen%2FDiagnostic-Medicine-PMPH-10edition&Date">
 <picture>
   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=xllgreen/Diagnostic-Medicine-PMPH-10edition&type=Date&theme=dark" />
   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=xllgreen/Diagnostic-Medicine-PMPH-10edition&type=Date" />
   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=xllgreen/Diagnostic-Medicine-PMPH-10edition&type=Date" />
 </picture>

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README_FR.md (reported line 129)May include surrounding context.

md

<a href="https://www.star-history.com/#xllgreen%2FDiagnostic-Medicine-PMPH-10edition&Date">
 <picture>
   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=xllgreen/Diagnostic-Medicine-PMPH-10edition&type=Date&theme=dark" />
   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=xllgreen/Diagnostic-Medicine-PMPH-10edition&type=Date" />
   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=xllgreen/Diagnostic-Medicine-PMPH-10edition&type=Date" />
 </picture>

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README_FR.md (reported line 130)May include surrounding context.

md

<a href="https://www.star-history.com/#xllgreen%2FDiagnostic-Medicine-PMPH-10edition&Date">
 <picture>
   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=xllgreen/Diagnostic-Medicine-PMPH-10edition&type=Date&theme=dark" />
   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=xllgreen/Diagnostic-Medicine-PMPH-10edition&type=Date" />
   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=xllgreen/Diagnostic-Medicine-PMPH-10edition&type=Date" />
 </picture>

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README_JP.md (reported line 129)May include surrounding context.

md

<a href="https://www.star-history.com/#xllgreen%2FDiagnostic-Medicine-PMPH-10edition&Date">
 <picture>
   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=xllgreen/Diagnostic-Medicine-PMPH-10edition&type=Date&theme=dark" />
   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=xllgreen/Diagnostic-Medicine-PMPH-10edition&type=Date" />
   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=xllgreen/Diagnostic-Medicine-PMPH-10edition&type=Date" />
 </picture>

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README_JP.md (reported line 130)May include surrounding context.

md

<a href="https://www.star-history.com/#xllgreen%2FDiagnostic-Medicine-PMPH-10edition&Date">
 <picture>
   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=xllgreen/Diagnostic-Medicine-PMPH-10edition&type=Date&theme=dark" />
   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=xllgreen/Diagnostic-Medicine-PMPH-10edition&type=Date" />
   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=xllgreen/Diagnostic-Medicine-PMPH-10edition&type=Date" />
 </picture>

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README_JP.md (reported line 131)May include surrounding context.

md

<a href="https://www.star-history.com/#xllgreen%2FDiagnostic-Medicine-PMPH-10edition&Date">
 <picture>
   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=xllgreen/Diagnostic-Medicine-PMPH-10edition&type=Date&theme=dark" />
   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=xllgreen/Diagnostic-Medicine-PMPH-10edition&type=Date" />
   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=xllgreen/Diagnostic-Medicine-PMPH-10edition&type=Date" />
 </picture>

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README_RU.md (reported line 128)May include surrounding context.

md

<a href="https://www.star-history.com/#xllgreen%2FDiagnostic-Medicine-PMPH-10edition&Date">
 <picture>
   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=xllgreen/Diagnostic-Medicine-PMPH-10edition&type=Date&theme=dark" />
   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=xllgreen/Diagnostic-Medicine-PMPH-10edition&type=Date" />
   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=xllgreen/Diagnostic-Medicine-PMPH-10edition&type=Date" />
 </picture>

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README_RU.md (reported line 129)May include surrounding context.

md

<a href="https://www.star-history.com/#xllgreen%2FDiagnostic-Medicine-PMPH-10edition&Date">
 <picture>
   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=xllgreen/Diagnostic-Medicine-PMPH-10edition&type=Date&theme=dark" />
   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=xllgreen/Diagnostic-Medicine-PMPH-10edition&type=Date" />
   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=xllgreen/Diagnostic-Medicine-PMPH-10edition&type=Date" />
 </picture>

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README_RU.md (reported line 130)May include surrounding context.

md

<a href="https://www.star-history.com/#xllgreen%2FDiagnostic-Medicine-PMPH-10edition&Date">
 <picture>
   <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=xllgreen/Diagnostic-Medicine-PMPH-10edition&type=Date&theme=dark" />
   <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=xllgreen/Diagnostic-Medicine-PMPH-10edition&type=Date" />
   <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=xllgreen/Diagnostic-Medicine-PMPH-10edition&type=Date" />
 </picture>

Static analysis

No suspicious patterns detected.