Security audit
Medical Device QMS & GMP（医械质量体系文档）
Security checks for vulnerabilities and agentic risk
Overview
This skill provides medical-device document-writing guidance without executable code or requests for sensitive access, though its bundled security evidence is inconsistent.
Use de-identified inputs and have qualified personnel check generated documents against current official requirements. Both scanners reported no findings; independent inspection resolved the reported coverage gaps as metadata parsing issues. Treat the bundled security claims as unverified because the manifest hashes mismatch and the attestation is missing. Review companion skills separately and check your hosting model's privacy settings before submitting confidential material.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep