ClawHub
Back to skill

Security audit

Ehr Semantic Compressor

Security checks across malware telemetry and agentic risk

Overview

This local EHR summarizer is not clearly malicious, but it overstates its clinical AI capability and has a questionable install setup for a sensitive medical-data workflow.

Review this before installing. Do not rely on the Transformer or clinical-accuracy claims unless the implementation is replaced or validated. Inspect the requirements files, avoid installing the unexpected root 'main' package without provenance checks, and run the tool only in a secure PHI-approved workspace with human review of every summary.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (10)

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill documentation describes file read/write behavior but does not declare corresponding permissions or constraints, which creates a transparency and policy-enforcement gap. In a clinical context, undocumented filesystem access increases the risk of unauthorized handling of sensitive EHR data, especially if path validation or workspace restrictions are not actually enforced in code.

Description-Behavior Mismatch

Medium
Confidence
97% confidence
Finding
The file header and skill description claim 'AI-powered' and 'Transformer architecture' summarization, but the implementation only performs regex-based sentence splitting, keyword matching, and heuristic scoring. In an EHR context this is security-relevant because users may trust the tool with sensitive medical data under the false assumption that it provides model-based semantic compression, accuracy, or safeguards it does not actually have, creating a deceptive capability mismatch.

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
This is substantively the same issue as SDI-1: the documentation markets transformer/AI summarization while the code is simple keyword extraction and frequency-style scoring. In a healthcare skill, misleading implementation claims can cause unsafe deployment decisions, overreliance on incomplete summaries, and inappropriate handling of PHI based on incorrect assumptions about system capability.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
For a clinical summarization tool, omitting a clear warning that AI-generated summaries may be incomplete, inaccurate, or clinically unsafe can lead users to overtrust the output. If a clinician or downstream workflow relies on the summary alone, critical allergies, medications, diagnoses, or contraindications could be missed, creating patient safety risk.

Unpinned Dependencies

Low
Category
Supply Chain
Content
transformers>=4.30.0
torch>=2.0.0
numpy>=1.24.0
Confidence
93% confidence
Finding
transformers>=4.30.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
transformers>=4.30.0
torch>=2.0.0
numpy>=1.24.0
Confidence
94% confidence
Finding
torch>=2.0.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
transformers>=4.30.0
torch>=2.0.0
numpy>=1.24.0
Confidence
83% confidence
Finding
numpy>=1.24.0

Known Vulnerable Dependency: transformers — 10 advisory(ies): CVE-2023-2800 (transformers has Insecure Temporary File); CVE-2025-3933 (Transformers is vulnerable to ReDoS attack through its DonutProcessor class); CVE-2024-3568 (Transformers Deserialization of Untrusted Data vulnerability) +7 more

Critical
Category
Supply Chain
Confidence
91% confidence
Finding
transformers

Known Vulnerable Dependency: torch — 10 advisory(ies): CVE-2025-2953 (PyTorch susceptible to local Denial of Service); CVE-2022-45907 (PyTorch vulnerable to arbitrary code execution); CVE-2025-32434 (PyTorch: `torch.load` with `weights_only=True` leads to remote code execution) +7 more

Critical
Category
Supply Chain
Confidence
96% confidence
Finding
torch

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical
Category
Supply Chain
Confidence
72% confidence
Finding
numpy

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.