ClawHub
Back to skill

Security audit

Medical Device Data Export Compliance（医械数据出海合规）

Security checks for vulnerabilities and agentic risk

Overview

The skill provides a proportionate local compliance toolkit, but its automated recommendations contain inconsistencies and need independent checking.

Use anonymized descriptions and aggregate counts; descriptions are echoed in command output. Treat recommendations as preliminary: the free-text and numeric commands can disagree for sensitive data. Verify conclusions against current official requirements and qualified advice before exporting patient information. Bundled scores and ownership claims are not independent certification.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (9)

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The supplied chunk's primary function is reporting preexisting quality scores, not evaluating export legality, choosing regulatory pathways, calculating population thresholds, or generating compliance checklists. Its medical-device compliance labels establish thematic relevance but do not implement the declared functionality. This assessment is limited to the supplied chunk; other files could provide the advertised capabilities. The observed resource access is local file reading and writing, with no network access or data export.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: file_read, file_write, shell.

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · verify/data_export_quality_test.py (reported line 57)May include surrounding context.

python
def check_tools():
    items = []
    try:
        r = subprocess.run([PYTHON, TOOL, "path", "--desc", "向海外CRO传输临床试验受试者个人信息，全年约50万人"],
                           capture_output=True, text=True, timeout=60)
        out = r.stdout or ""
        items.append({"name": "path 命令执行", "pass": r.returncode == 0 and "标准合同" in out})

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · verify/data_export_quality_test.py (reported line 61)May include surrounding context.

python
capture_output=True, text=True, timeout=60)
        out = r.stdout or ""
        items.append({"name": "path 命令执行", "pass": r.returncode == 0 and "标准合同" in out})
        r2 = subprocess.run([PYTHON, TOOL, "threshold", "--personal", "2000000", "--sensitive", "500"],
                            capture_output=True, text=True, timeout=60)
        out2 = r2.stdout or ""
        items.append({"name": "threshold 命令执行", "pass": r2.returncode == 0 and "安全评估" in out2})

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · verify/data_export_quality_test.py (reported line 65)May include surrounding context.

python
capture_output=True, text=True, timeout=60)
        out2 = r2.stdout or ""
        items.append({"name": "threshold 命令执行", "pass": r2.returncode == 0 and "安全评估" in out2})
        r3 = subprocess.run([PYTHON, TOOL, "scene", "--type", "clinical"], capture_output=True, text=True, timeout=60)
        items.append({"name": "scene 命令执行", "pass": r3.returncode == 0 and "临床试验" in (r3.stdout or "")})
        r4 = subprocess.run([PYTHON, TOOL, "market", "--region", "eu"], capture_output=True, text=True, timeout=60)
        out4 = r4.stdout or ""

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · verify/data_export_quality_test.py (reported line 67)May include surrounding context.

python
items.append({"name": "threshold 命令执行", "pass": r2.returncode == 0 and "安全评估" in out2})
        r3 = subprocess.run([PYTHON, TOOL, "scene", "--type", "clinical"], capture_output=True, text=True, timeout=60)
        items.append({"name": "scene 命令执行", "pass": r3.returncode == 0 and "临床试验" in (r3.stdout or "")})
        r4 = subprocess.run([PYTHON, TOOL, "market", "--region", "eu"], capture_output=True, text=True, timeout=60)
        out4 = r4.stdout or ""
        items.append({"name": "market 命令执行", "pass": r4.returncode == 0 and "GDPR" in out4 and "EHDS" in out4})
        r5 = subprocess.run([PYTHON, TOOL, "audit"], capture_output=True, text=True, timeout=60)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · verify/data_export_quality_test.py (reported line 70)May include surrounding context.

python
r4 = subprocess.run([PYTHON, TOOL, "market", "--region", "eu"], capture_output=True, text=True, timeout=60)
        out4 = r4.stdout or ""
        items.append({"name": "market 命令执行", "pass": r4.returncode == 0 and "GDPR" in out4 and "EHDS" in out4})
        r5 = subprocess.run([PYTHON, TOOL, "audit"], capture_output=True, text=True, timeout=60)
        items.append({"name": "audit 命令执行", "pass": r5.returncode == 0 and "审计" in (r5.stdout or "")})
    except Exception as e:
        items = [{"name": f"执行失败: {e}", "pass": False}]

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · verify/data_export_quality_test.py (reported line 85)May include surrounding context.

python
items = []
    for desc, expects in cases:
        try:
            r = subprocess.run([PYTHON, TOOL, "path", "--desc", desc], capture_output=True, text=True, timeout=60)
            ok = r.returncode == 0 and any(e in (r.stdout or "") for e in expects)
            items.append({"name": f"path「{desc[:14]}…」→{expects[0]}", "pass": ok})
        except Exception as e:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · verify/data_export_quality_test.py (reported line 95)May include surrounding context.

python
]
    for p, s, expect in thr:
        try:
            r = subprocess.run([PYTHON, TOOL, "threshold", "--personal", str(p), "--sensitive", str(s)],
                               capture_output=True, text=True, timeout=60)
            ok = r.returncode == 0 and expect in (r.stdout or "")
            items.append({"name": f"threshold({p},{s})→{expect}", "pass": ok})