Ehr Semantic Compressor

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:03 AM UTC
• Version: 0.1.0

Overview

This skill stays local, but it is marked for Review because it handles sensitive medical records while overstating its clinical AI capability and requiring an unrelated unpinned package install.

Install only in an isolated environment after removing the root main dependency and reconciling the requirements files. Treat all inputs and outputs as sensitive medical data, review summaries manually, and do not rely on this as clinical decision support unless the capability claims are corrected or independently validated.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unnecessary Unpinned Third-Party Dependency Introduces Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1
Related Installation Instruction: SKILL.md:166-169
Vulnerability Type: Unverified and unnecessary third-party dependency
Risk Level: Medium

Vulnerable Code Snippets

requirements.txt:1:

text

main

SKILL.md:166-169:

bash

# Python dependencies
pip install -r requirements.txt

Technical Analysis

The documented installation procedure directs users to install all packages listed in the root requirements.txt. That file contains the generic, unpinned package name main.

The audited implementation in scripts/main.py imports only Python standard-library modules. Therefore, the main package is not needed to provide the implemented functionality. It also does not match the dependencies documented elsewhere in SKILL.md and references/requirements.txt.

Python package installation is a code-execution boundary: a resolved package may execute package-controlled build or installation logic and subsequently place executable modules in the environment. Using an unnecessary dependency without an exact version or integrity hash leaves package selection and package content dependent on the configured package index and its current state.

No evidence establishes that the present package named main is itself malicious. The confirmed issue is that the project instructs users to install an unrelated, unpinned package, unnecessarily exposing them to third-party supply-chain risk.

Attack Path

1. A user follows the prerequisite instructions in SKILL.md.
2. The user runs pip install -r requirements.txt.
3. Pip resolves the unpinned package name main through the user's configured package index.
4. Pip downloads and installs whatever release currently satisfies that unconstrained name.
5. Package-controlled build or installation behavior may run with the privileges of the user performing the installation.
6. A compromised, replaced, or otherwise unsafe pack ...[truncated 694 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove main from the root requirements.txt.
2. Because the current executable implementation uses only Python standard-library modules, document that no third-party installation is required.
3. Reconcile SKILL.md, the root requirements file, and references/requirements.txt so that they describe only dependencies actually imported by the implementation.
4. If third-party dependencies are added later:
   • Pin each dependency to a reviewed exact version.
   • Use hashes, such as pip's --require-hashes, to verify package integrity.
   • Install only from an approved package index.
   • Audit direct and transitive dependencies before release.
   • Perform installation in an isolated, least-privileged virtual environment.
5. Add automated checks that reject unused, unpinned, or unapproved dependencies.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The documented behavior claims Transformer-based, clinically accurate AI summarization, while the implementation reportedly uses heuristic keyword/frequency extraction instead. In a clinical context, this mismatch is dangerous because users may rely on the output for medical review under false assumptions about model capability, completeness, and section extraction quality, potentially causing omission or misinterpretation of critical patient data.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

md

See `references/requirements.txt` for complete list.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.

md

See `references/requirements.txt` for complete list.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill documents local file read/write behavior but does not declare any explicit tool scope such as permissions or allowed-tools. In a skill that processes EHR data, unclear capability boundaries increase the risk of unintended file access, weak sandboxing assumptions, and accidental exposure of sensitive patient information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill handles highly sensitive EHR content and writes summaries/files, but the documentation does not clearly warn users that outputs may still contain protected health information and must be handled securely. This omission can lead to insecure storage, sharing, or retention of summaries that users mistakenly treat as de-identified or low-risk artifacts.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This sample output includes detailed, realistic protected health information such as symptoms, diagnoses, medications, allergies, family history, and cardiovascular risk factors. Even if presented as an example artifact, exposing or normalizing unrestricted EHR output without clear de-identification guarantees, trigger scoping, or contextual limitations can lead to privacy violations, unsafe reuse in logs/docs, and accidental disclosure of sensitive medical data.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The header claims 'Transformer architecture' and AI-powered summarization, but the implementation is purely heuristic keyword extraction and sentence scoring. In an EHR context this is dangerous because users may rely on the tool as if it had clinically robust model-based semantic understanding, leading to misplaced trust, omission of important details, and unsafe downstream handling of sensitive medical information.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code markets itself as 'AI-powered' and 'semantic' while only doing keyword matching and simple scoring. In a medical-record summarization skill, that mismatch increases risk because the context encourages users to expect deeper comprehension, which can hide extraction failures and cause unsafe or incomplete summaries to be treated as authoritative.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The tool writes summarized EHR-derived content to any user-specified path with no safeguards, privacy notice, or controls for handling protected health information. In healthcare contexts, even summaries and extracted sections can contain PHI, so unrestricted file output increases the chance of sensitive data being stored in insecure locations, synced directories, shared workspaces, or logs.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency is specified with a lower-bound only, which allows future unreviewed versions of transformers to be installed. In an EHR-processing skill, this increases supply-chain risk and can unpredictably introduce vulnerable or breaking releases into a medical-data workflow.

Content

Scanner excerpt · references/requirements.txt (reported line 1)May include surrounding context.

text

transformers>=4.30.0
torch>=2.0.0
numpy>=1.24.0

Unverifiable Dependency: transformers has 16 known advisory(ies) (CVE-2023-2800 (transformers has Insecure Temporary File); CVE-2026-4372 (HuggingFace transformers vulnerable to remote code execution); CVE-2025-3933 (Transformers is vulnerable to ReDoS attack through its DonutProcessor class) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The manifest does not pin transformers, and that package has multiple known advisories across versions, making it impossible to determine whether deployed installs are exposed. This is more dangerous in an EHR context because the skill handles sensitive medical records and ML libraries may process untrusted model artifacts or inputs.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The torch dependency is not pinned to a specific version, so installs may resolve to different releases over time, including versions with security flaws. Because ML frameworks often expose deserialization and native-code attack surfaces, this is a meaningful supply-chain weakness in an EHR summarization component.

Content

Scanner excerpt · references/requirements.txt (reported line 2)May include surrounding context.

text

transformers>=4.30.0
torch>=2.0.0
numpy>=1.24.0

Unverifiable Dependency: torch has 16 known advisory(ies) (CVE-2025-2953 (PyTorch susceptible to local Denial of Service); CVE-2022-45907 (PyTorch vulnerable to arbitrary code execution); CVE-2025-32434 (PyTorch: `torch.load` with `weights_only=True` leads to remote code execution) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

Torch has known advisories and the version range here does not constrain installations to a verified safe release. Given PyTorch's history of issues around loading models and native components, leaving the version unresolved creates significant risk for compromise or denial of service.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

Using numpy with only a minimum version permits uncontrolled upgrades and non-reproducible builds. While numpy is generally lower risk here than the model frameworks, unpinned scientific dependencies can still pull in affected releases or cause instability in sensitive healthcare pipelines.

Content

Scanner excerpt · references/requirements.txt (reported line 3)May include surrounding context.

text

transformers>=4.30.0
torch>=2.0.0
numpy>=1.24.0

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 84% confidence

Finding

Because numpy is unpinned, the project may install a version affected by one of several known advisories, but the manifest provides no way to verify safety. In this skill the impact is somewhat lower than transformers or torch, yet still relevant because healthcare data processing should use reproducible, reviewed dependencies.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

This JSON manifest-like sample contains only payload fields and does not define any explicit trigger phrases, invocation boundaries, or exclusion conditions. If used as a skill reference or manifest input, the absence of trigger specificity could lead to unclear or overly broad activation behavior.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency specification is effectively unpinned and references a moving target ('main') rather than a fixed package version or immutable source. This creates a supply-chain risk because future changes to whatever 'main' resolves to could introduce malicious or incompatible code without any change to this repository.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

main

Static analysis

No suspicious patterns detected.