ClawHub
Back to skill

Security audit

Regulatory Dossier Writing（医械注册申报资料编写）

Security checks for vulnerabilities and agentic risk

Overview

This documentation-only skill supports medical-device dossier drafting without requesting credentials, executing code, or submitting documents.

Use redacted materials and have a qualified regulatory professional check generated dossiers against current official requirements. Restrict checklist activation to medical-device work. The bundled security scores are publisher claims, and the recorded integrity hash does not match this revision. Review companion skills separately before using them.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

A generic checklist-review phrase unconditionally activates the medical-device dossier skill.

Medium
Category
Trigger Abuse
Confidence
96% confidence
Finding

The English trigger “Go through my checklist and find what's missing” applies to everyday checklists and contains no medical-device or regulatory context. The instruction to activate on any listed phrase can therefore invoke this specialized skill for unrelated checklist reviews.

Content

No source excerpt is available for this finding.