I tend to agree with all that. Should the skewering spines cause pain (similar to a symbol of pain) as well as dealing a minor amount of damage?
I'd leave off the symbol of pain, since there's no mention of the spines being agonizing.
The term "poison" is a bit confusing, as it seems to be attributed to the stunning cloud and skewer lingering damage solely because they use a "save vs. poison" mechanic.
I was interpreting that "save vs. poison" as being more like a Fortitude check to expel the spines before they start working their way in.
Maybe that's the approach we should take? 1d6 damage per round until a successful Fortitude save or Heal check is made to expel the spines?
How about one of the following:
Tail-Spines (Ex) [Random Duration]: A lemon fish's tail is covered in porcupine-like spines. If the fish hits an opponent with its tail attack, the opponent must make a DC X Fortitude save or the spines work their way into their flesh, doing 1d6 piercing damage each round for 1d4 rounds (1d6 rounds for Medium-sized lemon fish and 1d8 rounds for Large-sized lemon fish). The spines can be removed with a successful DC 15 Heal check (DC 18 for Medium lemon fish, DC 20 for Large lemon fish). The save DC is Constitution-based.
Any creature that grapples a lemon fish must make a DC X Fortitude save or be impaled by its tail-spines, taking damage as above.
Tail-Spines (Ex) [Fort Save To End]: A lemon fish's tail is covered in porcupine-like spines. If the fish hits an opponent with its tail attack, the opponent must succeed at a DC X Fortitude save or take 1d6 piercing damage. The spines will work their way into the opponent's flesh, doing 1d6 piercing damage per round until the opponent succeeds at a Fortitude (DC X -1 per round after the first), which expels the spines.
The spines can be removed with a successful DC 15 Heal check (DC 18 for Medium lemon fish, DC 20 for Large lemon fish).
Any creature that grapples a lemon fish must make a DC X Fortitude save or be impaled by its tail-spines, taking damage as above.
The save DCs are Constitution-based.
Hmm, I think I'll change my mind and go for the "Random Damage" approach.
How about just lingering damage (and possibly pain) for the skewers, and treat the stun cloud as a venomous effect (like a troglodyte's stench), but not actual poison?
I was going to go for a "poisonous but not poison" approach like that, e.g.:
Stun Cloud (Ex): Once per day, an injured lemon fish can release a cloud of chemicals in a 5 ft. spread (10 ft. for a Medium-sized lemon fish, 15 ft. for a Large-sized lemon fish). All living creatures within this cloud except for other lemon fish must succeed at a DC X Fortitude save or be stunned for Y rounds. Creatures with immunity to poison are unaffected, and creatures resistant to poison receive their normal bonus on their saving throws. The save DC is Constitution-based.