medical-record-structuring

Security checks across malware telemetry and agentic risk

Overview

This skill locally structures user-provided medical notes and does not show hidden uploads, credential access, persistence, or destructive behavior.

Install only if you are comfortable processing medical records locally and managing the output files as sensitive health data. Prefer explicit input/output paths in a protected directory, avoid shared temp locations for real patient records, and review outputs before downstream use because this is extraction support, not clinical decision-making.

SkillSpector

By NVIDIA

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill documents executable commands that read user-supplied medical records and write extracted data to files, but it does not declare corresponding permissions. That mismatch is a real security issue because it reduces transparency and policy enforcement around sensitive PHI/PII handling, especially given explicit use of stdin, input paths, output paths, temp files, and batch directory processing.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal