ClawHub
Back to skill

Security audit

顶级名医中医辨证Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill does not show malware behavior, but it should be reviewed because it promotes automatic medical-style diagnosis and prescription output with dosages and limited safeguards.

Use this only as Chinese-language educational TCM reference material, not for diagnosis or treatment decisions. Avoid sharing unnecessary personal health details, and do not rely on generated herbs, dosages, pediatric guidance, pregnancy guidance, or contraindications without a licensed clinician. The publisher should add explicit opt-in, scope limits, language handling, and safety gates before prescription-like output.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The description significantly overstates the implemented behavior. The code is essentially a static rule/configuration file plus a simple startup printout. While it does include some content aligned with the description—such as nine constitutions, several syndrome templates, base prescriptions, symptom keywords, and one historical medical case—there is no executable logic that actually performs diagnosis, questioning, constitution matching, syndrome selection, prescription generation, explanatory parsing, or citation retrieval. This is a material description-behavior mismatch because the declared primary purpose is a functioning intelligent TCM diagnostic/educational skill, whereas the supplied code only stores reference data and a disclaimer.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill says it will automatically complete the full inquiry→diagnosis→prescription workflow without requiring extra input parameters, which encourages unconstrained invocation and medical-style output without explicit user confirmation or adequate context. In a healthcare-themed skill, that can lead to overcollection of sensitive health data and generation of personalized treatment guidance from incomplete information, increasing safety and compliance risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The only user-facing natural-language strings in the skill are Chinese, and the file provides no indication that language selection is optional or that the skill is intentionally limited to Chinese users. Under the policy rule, forcing a specific language without user opt-in is a locale/language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The natural-language instructions and output format are entirely specified in Chinese and do not offer a language choice or indicate that the user can select another locale. That can violate language/locale policy where user language preference should be respected unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.