Security audit
Security checks for vulnerabilities and agentic risk
This patient-portal reader needs review because its raw command permits account-changing requests and unfiltered access to sensitive responses despite its read-only description.
Prefer a version that restricts requests to reviewed read operations and consistently filters sensitive responses. Until then, do not rely on the read-only label: raw requests can invoke account-changing endpoints, and opening unread messages may mark them read. Pair only the intended browser and share only information needed for your question. All four bundled files were inspected; the external CLI, bridge, separate MCP server, and live portal behavior were not verified.
Despite describing the skill as read-only, the documentation exposes arbitrary authenticated endpoint calls through raw GET and POST operations. The prose requirement for confirmation does not establish an enforced restriction, creating a path to unintended patient-account changes; the additional documented profile and document reads are not independently evidence of a vulnerability.
The raw branch accepts caller-selected paths and JSON bodies and sends authenticated GET or POST requests without an endpoint allowlist or confirmation check. This defeats the script's read-only claim and bypasses output filtering, potentially enabling account changes or disclosure of sensitive fields that curated commands deliberately omit.
Without declared permissions the skill's intent is opaque and cannot be validated.
The advertised raw interface bypasses the curated command set and returns endpoint responses without projection. In this healthcare context, that can expose the password hashes and sign-in tokens explicitly identified elsewhere in the document, as well as permit calls beyond the stated read-only purpose.
The manifest lists appointments, medications, allergies, messages, pending forms, balances, and badge counts, but these commands additionally retrieve all patient document records and patient demographics. The profile projection retains every nonempty scalar except Image rather than limiting output to information needed for the advertised functions.
