Icd10 Cpt Coding Assistant

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 12:14 AM UTC
• Version: 0.1.0

Overview

This is a local medical-coding helper that is purpose-aligned, but users should treat its coding suggestions as review-only and avoid feeding it unauthorized patient data.

Install and run this only in an environment approved for clinical data. De-identify notes where possible, do not rely on its output for billing or chart changes without qualified review, and verify codes against current official ICD-10-CM, AMA CPT, CMS/NCCI, payer, and organizational rules. Remove or pin the unnecessary dataclasses dependency before installation if you want to reduce supply-chain exposure.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Unpinned and Unnecessary Third-Party Dependency

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1
Related Installation Instruction: SKILL.md:156-160
Vulnerability Type: Unpinned dependency and avoidable software supply-chain exposure
Risk Level: Low

Vulnerable Code

requirements.txt:1:

text

dataclasses

SKILL.md:156-160:

markdown

## Prerequisites

```bash
pip install -r requirements.txt

text

### Technical Analysis

The project declares Python 3.8 or later, where `dataclasses` is already included in the Python standard library. Nevertheless, the requirements file instructs package managers to retrieve an unversioned package named `dataclasses` from the configured package index.

This dependency is unnecessary for supported Python versions and is not pinned to a reviewed version or cryptographic hash. Consequently, installation results can vary over time and between package-index configurations. If the package, an index mirror, or dependency resolution environment is compromised, package build or installation logic could execute attacker-controlled code.

The audit found no evidence that the currently referenced package is malicious. This finding concerns avoidable exposure to a mutable third-party software supply chain.

### Attack Path

1. A user follows the documented prerequisite and runs `pip install -r requirements.txt`.
2. `pip` resolves the unversioned `dataclasses` requirement through the user's configured package index or mirror.
3. An attacker compromises the resolved release, index, mirror, or dependency-resolution configuration.
4. The malicious distribution is downloaded instead of a previously reviewed artifact.
5. Attacker-controlled package build or installation logic executes with the privileges of the user running `pip`.

### Impact Assessment

Successful exploitation could provide arbitrary code execution under the installing user's account. The attacker could access files, enviro
...[truncated 423 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove dataclasses from requirements.txt, because the documented Python 3.8+ runtime already provides it.

2. If compatibility with older Python versions is genuinely required, document the supported versions and use a reviewed conditional dependency, for example:

   text

   dataclasses==0.8; python_version < "3.7"
   

3. Pin all required third-party dependencies to reviewed versions and cryptographic hashes.

4. Generate and maintain a reproducible lock file where applicable.

5. Install only from trusted package indexes and prevent untrusted configuration from adding fallback or extra indexes.

6. Run dependency installation without administrative privileges and inside an isolated virtual environment or sandbox.

7. Add automated dependency and provenance review to the release process.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill describes file-reading behavior via a local Python script, but it does not declare an explicit tool scope such as permissions or allowed-tools. That mismatch weakens enforceable security boundaries and can allow broader-than-expected file access, which is more sensitive here because the tool processes clinical notes that may contain PHI.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger conditions are broad enough to activate on general medical-coding or clinical-note requests without tight boundaries on user role, data sensitivity, or workflow context. In a healthcare setting, over-broad invocation can increase accidental processing of sensitive records, inappropriate reliance on automated coding, or use outside intended billing-review workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This guidance provides detailed ICD-10/CPT coding rules and example codes but does not warn users to verify recommendations against current official coding sources, payer policies, and qualified professional review before using them for billing or patient records. In a healthcare billing context, users may over-rely on the document as authoritative, leading to outdated, inaccurate, or unsupported coding decisions that can cause claim denials, compliance violations, fraud exposure, or patient record inaccuracies.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This document provides detailed CPT coding and billing guidance, including code ranges, E/M selection criteria, modifiers, and compliance topics, but only ends with a weak note to 'always verify with current year AMA CPT manual.' In a healthcare billing skill that automatically recommends codes, the absence of a prominent warning to require current authoritative validation and qualified coder/compliance review can cause users to rely on outdated or incomplete guidance, leading to inaccurate billing, compliance violations, claim denials, or fraud exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The interactive mode solicits free-form clinical notes from the user without any privacy or compliance warning, which can prompt entry of sensitive patient information without informed handling expectations. Because the skill is explicitly intended for medical coding, users are likely to paste real encounter data, making silent collection of PHI materially risky.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The tool reads clinical note files directly and processes protected health information without presenting any privacy notice, consent prompt, or handling guidance to the user. In a healthcare-coding context, this increases the risk of accidental exposure or improper processing of sensitive patient data, especially if users assume the tool is safe for unrestricted PHI use.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

This markdown file contains natural-language content stating that ICD-10-CM is the standardized system used in healthcare settings in the United States. Under the policy rule, forcing a specific locale without opt-in can be a violation unless the regional constraint is clearly documented and justified for a region-specific tool; here the document presents U.S.-specific guidance but does not explicitly frame itself as a U.S.-only reference for a region-specific skill.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 60% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

dataclasses

Static analysis

No suspicious patterns detected.