Security audit

Dicom Anonymizer

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real local DICOM anonymizer, but it needs Review because it handles medical data while overstating HIPAA safety and producing sensitive linkage logs.

Install only in an isolated environment, pin pydicom to a patched version, run on copies of medical images, keep audit logs private, and do not treat the output as HIPAA-compliant without independent de-identification review for burned-in text, dates, private tags, and residual PHI.

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill documentation describes filesystem write capability through creation of anonymized DICOM outputs and optional audit logs, but no explicit permissions are declared. In a clinical data-handling skill, undeclared write access weakens reviewability and can lead to accidental overwrites, writes to unintended locations, or misuse in broader agent environments where permissions are enforced from metadata.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The module claims HIPAA Safe Harbor compliance, but the implementation does not enforce it. Users can preserve arbitrary tags via --keep-tags, some preserved defaults such as ProtocolName may contain PHI in practice, and the code only targets a fixed tag list rather than a complete de-identification policy including burned-in annotations and all identifying dates/metadata. In a medical-imaging anonymizer, overstating compliance can cause operators to release data under a false sense of safety, resulting in re-identification or regulatory exposure.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The documentation emphasizes preserving image data for research use, but the tool also generates persistent linkage metadata such as pseudonyms and original_patient_id_hash in results and optional audit logs. Those artifacts are outside the anonymized image itself and can enable cross-file correlation or support re-identification if logs are retained or combined with other data sources. In this skill's medical context, that makes the mismatch security-relevant rather than merely a documentation issue.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The audit log writes input/output paths, pseudonyms, original patient ID hashes, per-file success state, and processing statistics to disk. Even though raw patient IDs are hashed, the hashes are deterministic and the file paths themselves may contain PHI or operationally sensitive information; together these records create a durable linkage dataset that could be exposed through backups, shared storage, or misconfigured permissions. Because this tool processes medical images, such metadata materially increases privacy risk.

Unpinned Dependencies

Low

Category: Supply Chain
Content: dataclasses pydicom
Confidence: 92% confidence
Finding: The dependency list is unpinned, which makes builds non-reproducible and allows future installs to silently pull newer package versions with behavior changes or newly introduced vulnerabilities. In a security-sensitive medical-image anonymization skill, this weakens supply-chain control even if it is not an immediately exploitable flaw by itself.

Unpinned Dependencies

Low

Category: Supply Chain
Content: dataclasses pydicom
Confidence: 97% confidence
Finding: The unpinned pydicom dependency is a true supply-chain weakness because installs may resolve to different versions over time, including versions with known security issues. Given this skill processes untrusted medical imaging files, uncontrolled dependency drift is more dangerous than in a purely offline utility.

Known Vulnerable Dependency: pydicom — 1 advisory(ies): CVE-2026-32711 (pydicom has a path traversal in FileSet/DICOMDIR ReferencedFileID allows file ac)

High

Category: Supply Chain
Confidence: 98% confidence
Finding: Using pydicom with a known path traversal advisory is a real vulnerability if the skill processes attacker-controlled DICOMDIR/FileSet content. In the context of a DICOM anonymizer, input files are likely to come from external systems or datasets, so a crafted ReferencedFileID could potentially cause unauthorized file access outside the intended dataset boundary.

Static analysis

No suspicious patterns detected.