Security audit

ecg-diagnosis

Security checks for vulnerabilities and agentic risk

Overview

This ECG helper processes sensitive medical images by automating an external website upload without clearly telling the user where their data goes.

Review carefully before installing. This skill may upload ECG images and patient demographics to a third-party website, uses stealth browser automation, stores browser profile data in the image folder, and requires personal details in filenames. Only use it with explicit patient consent and if that external service is approved for the medical data involved.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The skill is presented as a local ECG assistant, but it automates a browser session to upload ECG images and derived patient metadata (age and gender) to an external website for diagnosis. This creates a material confidentiality and integrity risk because sensitive medical data leaves the local environment without clear disclosure, consent, trust boundary documentation, or any assurance about the remote service's handling of the data.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The use of Playwright stealth functionality and automation-evasion flags indicates deliberate masking of browser automation while interacting with a third-party medical-analysis site. That behavior is unnecessary for a normal local assistant and increases security and compliance risk by bypassing anti-bot controls, obscuring automation from the remote party, and making the workflow harder to justify or audit.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill instructs automatic execution of a local Python script over a user-supplied folder without clearly warning about file access, external uploads, browser automation, or output generation. In context, this is more dangerous because the content concerns medical images and appears to process entire directories, increasing the risk of unintended bulk access, privacy violations, and user surprise.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The workflow uploads ECG image files and fills patient-related metadata fields on an external site without any visible user warning, confirmation step, or consent gate. In the context of a healthcare-oriented skill, this is especially dangerous because ECGs and associated demographics are sensitive personal data, and undisclosed exfiltration to a third party can cause privacy, regulatory, and trust harms.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The mandated filename format requires embedding personal identifiers and sensitive attributes—name, age, and sex—directly into filenames. This is dangerous because filenames are widely exposed in file explorers, logs, backups, command histories, cloud sync metadata, and remote upload workflows, causing unnecessary disclosure of personal and medical-context data before any substantive processing begins.

Static analysis

No suspicious patterns detected.