Security audit

CareMax Auth

Security checks across malware telemetry and agentic risk

Overview

This CareMax health-auth skill is not clearly malicious, but it bundles broad medical-data access, uploads, downloads, writes, deletion, and token exposure into an automatically invoked authentication helper.

Install only if you trust this CareMax integration with sensitive health data and are comfortable with reusable local tokens, automatic authentication, and scripts that can read, upload, write, download, OCR, and delete medical records. Prefer a version that separates auth from data actions, redacts tokens, sets strict credential-file permissions, and requires explicit confirmation before uploads, downloads, writes, and deletes.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (18)

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: An auth-only manifest is misleading when the documented behavior includes querying health records, writing indicators, uploading reports, OCR processing, and session management. In a healthcare context, this hidden expansion of scope is especially dangerous because it can expose or modify highly sensitive medical information under the guise of authentication.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The skill documents saving medical reports and deleting sessions, including files and reports atomically, despite being framed as an authentication prerequisite. Destructive and data-management actions in an auth skill materially increase risk because they may be reached through automatic invocation paths not associated with user approval for deletion or record changes.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: This script is packaged as an authentication prerequisite skill, but it also serves as a generic authenticated API client for arbitrary CareMax endpoints and request bodies. In the context of medical and health-data APIs, that broad capability can be abused by downstream prompts or tools to read or modify sensitive records well beyond a narrowly scoped auth function, increasing the blast radius of any prompt injection or misuse.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: This script performs authenticated file download and writes the result to disk, which exceeds the declared purpose of an authentication-only prerequisite skill. In this context, a prerequisite auth skill is likely to run automatically and without prompting, so bundling data access and file retrieval into it materially increases the chance of silent exfiltration or unintended local persistence of sensitive medical files.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The script accepts an arbitrary output path and writes remote content directly to that location, creating local file write capability that is not justified by an auth bootstrap component. Because the broader skill is described as something that should auto-run when no token exists, this creates a dangerous mismatch where an ostensibly safe auth helper can modify the local filesystem and persist sensitive healthcare data without an explicit user action.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The header comments explicitly describe downloading a session file locally, contradicting the manifest's authentication-only positioning. This discrepancy is security-significant because it indicates hidden or mislabeled capability inside a trusted prerequisite component, making operators and users less likely to scrutinize its access to tokens and medical data.

Description-Behavior Mismatch

High

Confidence: 93% confidence
Finding: The file implements OCR session processing and streams results to a remote API, which is materially different from the advertised purpose of an OAuth authentication prerequisite skill. In a security review, this kind of capability mismatch is dangerous because it can cause unexpected handling and transmission of sensitive medical-document data under the guise of authentication, reducing user and system scrutiny.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The skill is described as an authentication prerequisite, but this script performs a separate privileged action: uploading local files to a remote CareMax endpoint. In an agent setting, this mismatch is dangerous because users or orchestrators may grant or auto-run the skill expecting only token acquisition, while the hidden upload behavior can transmit sensitive medical or local files without informed consent.

Description-Behavior Mismatch

High

Confidence: 93% confidence
Finding: The script header and behavior indicate it creates upload sessions and handles file submission, which exceeds the stated scope of an auth-only skill. Scope deception in skill packaging is a real security issue because it can bypass user expectations, policy controls, and approval flows for handling sensitive health documents.

Vague Triggers

High

Confidence: 96% confidence
Finding: The trigger terms include broad phrases like blood test, medical record, and upload report, which are common health-related queries and not limited to authentication. This makes accidental activation likely, especially because the skill can open a browser, store credentials, and expose wider health-data functionality than its name suggests.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The skill explicitly instructs automatic authentication without asking the user, even though it opens a browser, starts polling, and persists credentials to disk. This bypasses informed consent for a sensitive account-linking action and is particularly serious in a healthcare setting where account access exposes protected medical data.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The upload workflow instructs sending local images and PDFs to CareMax without requiring an explicit warning that files leave the local machine and are transmitted to a remote service. Because these files are medical reports, silent upload creates a meaningful privacy and compliance risk.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The delete-session command removes the session, files, and reports atomically, yet no confirmation or warning is required. In a medical-data workflow, an unguarded delete path can cause irreversible loss of uploaded records and associated OCR outputs.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The script prints the access token to stdout and stores both access and refresh tokens on disk without setting restrictive file permissions or warning the caller. In an agent/automation context, stdout may be logged, captured by orchestration layers, or exposed to other tools, which can lead to credential theft and unauthorized access to sensitive health records and upload scopes.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The script emits the bearer access token in plain JSON whenever the stored token is still valid, and also emits the refresh token when the token is expired. In an agent-skill context, this creates a direct secret-exposure path to downstream logs, other tools, model context, or unauthorized consumers, especially since the skill description says auth should run automatically without asking the user.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The curl command writes server-returned content directly to a caller-controlled path with no warning, confirmation, or overwrite safeguards. In a healthcare context this can silently create or replace local files containing sensitive data, and because the skill is positioned as automatic auth plumbing, users may not realize a filesystem write is occurring at all.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The script transmits user-supplied health indicator data to a remote API endpoint immediately, and the skill metadata explicitly says to run auth automatically and not ask the user. In a health-data context, silently sending medical measurements can violate user expectations and privacy requirements, especially when the script may be invoked automatically by other caremax-* skills.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script uploads arbitrary local files over the network with no disclosure, confirmation, or constraints, which is especially sensitive given the CareMax health context and likely handling of medical records. In an agent environment, silent transmission of local files can lead to serious privacy violations and unintended exfiltration of regulated health information.

VirusTotal

VirusTotal engine telemetry is currently stale for this artifact.

View on VirusTotal

Static analysis

No suspicious patterns detected.