Security audit

MedXpert 文档模板工具链

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent medical-device document workflow, but it asks agents to route broad document requests into high-impact document modification, approval, signing, and identity-tracing behavior without enough scoping or consent guidance.

Review before installing. Use this only for controlled medical-device or ISO13485 document workflows, not generic office documents. Require explicit confirmation before watermarking, registering, approving, publishing, signing, hosting, or adding trace data, and avoid embedding raw names or account IDs in exported or shared documents unless that is an intentional controlled-distribution requirement.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The skill advertises very broad trigger phrases such as generic document-generation, export, approval, and bilingual-processing terms, which can cause it to activate for ordinary user requests outside the intended medical-device/ISO13485 scope. Overbroad activation increases the chance that users unintentionally invoke functions that alter document integrity, add watermarks, or start approval/signing workflows without informed intent.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The recommended matching keywords remain broad and unconstrained, covering common terms like 文档模板, PDF 导出, DOCX 导出, and 审批流 that overlap with many non-specialized document tasks. In an agent environment, this can cause accidental routing to a high-impact toolchain that performs content transformation, tracking, and governance actions the user did not specifically request.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The description includes integrity- and privacy-impacting capabilities such as watermarking, dynamic tracing, ledger numbering, approval flow, and electronic signature, but it does not clearly warn users that documents may be modified or that identifying metadata may be embedded. This lack of notice undermines informed consent and can lead to unintended disclosure, audit contamination, or mistaken reliance on altered documents.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The dynamic trace watermark explicitly embeds user name and account identifiers in document URLs or content parameters (`?user=姓名&uid=账号`) without any visible privacy warning or minimization guidance. This creates a concrete risk of personal or account identifier leakage when documents are shared, exported, logged, or inspected by downstream systems.

Static analysis

No suspicious patterns detected.