Ehr Semantic Compressor

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:03 AM UTC
• Version: 0.1.0

Overview

This skill stays local, but it is marked for Review because it handles sensitive medical records while overstating its clinical AI capability and requiring an unrelated unpinned package install.

Install only in an isolated environment after removing the root main dependency and reconciling the requirements files. Treat all inputs and outputs as sensitive medical data, review summaries manually, and do not rely on this as clinical decision support unless the capability claims are corrected or independently validated.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1
• Finding: Unnecessary Unpinned Third-Party Dependency Introduces Supply-Chain Risk## Vulnerability Details **File Location**: `requirements.txt:1` **Related Installation Instruction**: `SKILL.md:166-169` **Vulnerability Type**: Unverified and unnecessary third-party dependency **Risk Level**: Medium ### Vulnerable Code Snippets `requirements.txt:1`: ```text main ``` `SKILL.md:166-169`: ```bash # Python dependencies pip install -r requirements.txt ``` ### Technical Analysis The documented installation procedure directs users to install all packages listed in the root `requirements.txt`. That file contains the generic, unpinned package name `main`. The audited implementation in `scripts/main.py` imports only Python standard-library modules. Therefore, the `main` package is not needed to provide the implemented functionality. It also does not match the dependencies documented elsewhere in `SKILL.md` and `references/requirements.txt`. Python package installation is a code-execution boundary: a resolved package may execute package-controlled build or installation logic and subsequently place executable modules in the environment. Using an unnecessary dependency without an exact version or integrity hash leaves package selection and package content dependent on the configured package index and its current state. No evidence establishes that the present package named `main` is itself malicious. The confirmed issue is that the project instructs users to install an unrelated, unpinned package, unnecessarily exposing them to third-party supply-chain risk. ### Attack Path 1. A user follows the prerequisite instructions in `SKILL.md`. 2. The user runs `pip install -r requirements.txt`. 3. Pip resolves the unpinned package name `main` through the user's configured package index. 4. Pip downloads and installs whatever release currently satisfies that unconstrained name. 5. Package-controlled build or installation behavior may run with the privileges of the user performing the installation. 6. A compromised, replaced, or otherwise unsafe pack ...[truncated 694 chars]
• Remediation: ## Remediation Suggestions 1. Remove `main` from the root `requirements.txt`. 2. Because the current executable implementation uses only Python standard-library modules, document that no third-party installation is required. 3. Reconcile `SKILL.md`, the root requirements file, and `references/requirements.txt` so that they describe only dependencies actually imported by the implementation. 4. If third-party dependencies are added later: - Pin each dependency to a reviewed exact version. - Use hashes, such as pip's `--require-hashes`, to verify package integrity. - Install only from an approved package index. - Audit direct and transitive dependencies before release. - Perform installation in an isolated, least-privileged virtual environment. 5. Add automated checks that reject unused, unpinned, or unapproved dependencies.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented behavior claims Transformer-based, clinically accurate AI summarization, while the implementation reportedly uses heuristic keyword/frequency extraction instead. In a clinical context, this mismatch is dangerous because users may rely on the output for medical review under false assumptions about model capability, completeness, and section extraction quality, potentially causing omission or misinterpretation of critical patient data.

Ae1

High

• Category: analysis-evasion

Content

See `references/requirements.txt` for complete list.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

See `references/requirements.txt` for complete list.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill documents local file read/write behavior but does not declare any explicit tool scope such as permissions or allowed-tools. In a skill that processes EHR data, unclear capability boundaries increase the risk of unintended file access, weak sandboxing assumptions, and accidental exposure of sensitive patient information.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill handles highly sensitive EHR content and writes summaries/files, but the documentation does not clearly warn users that outputs may still contain protected health information and must be handled securely. This omission can lead to insecure storage, sharing, or retention of summaries that users mistakenly treat as de-identified or low-risk artifacts.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: This sample output includes detailed, realistic protected health information such as symptoms, diagnoses, medications, allergies, family history, and cardiovascular risk factors. Even if presented as an example artifact, exposing or normalizing unrestricted EHR output without clear de-identification guarantees, trigger scoping, or contextual limitations can lead to privacy violations, unsafe reuse in logs/docs, and accidental disclosure of sensitive medical data.

Description-Behavior Mismatch

Medium

• Confidence: 99% confidence
• Finding: The header claims 'Transformer architecture' and AI-powered summarization, but the implementation is purely heuristic keyword extraction and sentence scoring. In an EHR context this is dangerous because users may rely on the tool as if it had clinically robust model-based semantic understanding, leading to misplaced trust, omission of important details, and unsafe downstream handling of sensitive medical information.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The code markets itself as 'AI-powered' and 'semantic' while only doing keyword matching and simple scoring. In a medical-record summarization skill, that mismatch increases risk because the context encourages users to expect deeper comprehension, which can hide extraction failures and cause unsafe or incomplete summaries to be treated as authoritative.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The tool writes summarized EHR-derived content to any user-specified path with no safeguards, privacy notice, or controls for handling protected health information. In healthcare contexts, even summaries and extracted sections can contain PHI, so unrestricted file output increases the chance of sensitive data being stored in insecure locations, synced directories, shared workspaces, or logs.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

transformers>=4.30.0
torch>=2.0.0
numpy>=1.24.0

• Confidence: 96% confidence
• Finding: The dependency is specified with a lower-bound only, which allows future unreviewed versions of transformers to be installed. In an EHR-processing skill, this increases supply-chain risk and can unpredictably introduce vulnerable or breaking releases into a medical-data workflow.

Unverifiable Dependency: transformers has 16 known advisory(ies) (CVE-2023-2800 (transformers has Insecure Temporary File); CVE-2026-4372 (HuggingFace transformers vulnerable to remote code execution); CVE-2025-3933 (Transformers is vulnerable to ReDoS attack through its DonutProcessor class) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: The manifest does not pin transformers, and that package has multiple known advisories across versions, making it impossible to determine whether deployed installs are exposed. This is more dangerous in an EHR context because the skill handles sensitive medical records and ML libraries may process untrusted model artifacts or inputs.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

transformers>=4.30.0
torch>=2.0.0
numpy>=1.24.0

• Confidence: 96% confidence
• Finding: The torch dependency is not pinned to a specific version, so installs may resolve to different releases over time, including versions with security flaws. Because ML frameworks often expose deserialization and native-code attack surfaces, this is a meaningful supply-chain weakness in an EHR summarization component.

Unverifiable Dependency: torch has 16 known advisory(ies) (CVE-2025-2953 (PyTorch susceptible to local Denial of Service); CVE-2022-45907 (PyTorch vulnerable to arbitrary code execution); CVE-2025-32434 (PyTorch: `torch.load` with `weights_only=True` leads to remote code execution) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 93% confidence
• Finding: Torch has known advisories and the version range here does not constrain installations to a verified safe release. Given PyTorch's history of issues around loading models and native components, leaving the version unresolved creates significant risk for compromise or denial of service.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

transformers>=4.30.0
torch>=2.0.0
numpy>=1.24.0

• Confidence: 91% confidence
• Finding: Using numpy with only a minimum version permits uncontrolled upgrades and non-reproducible builds. While numpy is generally lower risk here than the model frameworks, unpinned scientific dependencies can still pull in affected releases or cause instability in sensitive healthcare pipelines.

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 84% confidence
• Finding: Because numpy is unpinned, the project may install a version affected by one of several known advisories, but the manifest provides no way to verify safety. In this skill the impact is somewhat lower than transformers or torch, yet still relevant because healthcare data processing should use reproducible, reviewed dependencies.

Vague Triggers

Low

• Confidence: 80% confidence
• Finding: This JSON manifest-like sample contains only payload fields and does not define any explicit trigger phrases, invocation boundaries, or exclusion conditions. If used as a skill reference or manifest input, the absence of trigger specificity could lead to unclear or overly broad activation behavior.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

main

• Confidence: 97% confidence
• Finding: The dependency specification is effectively unpinned and references a moving target ('main') rather than a fixed package version or immutable source. This creates a supply-chain risk because future changes to whatever 'main' resolves to could introduce malicious or incompatible code without any change to this repository.

Static analysis

No suspicious patterns detected.