Security audit
DeepRead Medical Records
Security checks across malware telemetry and agentic risk
Overview
The skill is a disclosed medical-document extraction integration, but using it means sending patient records to DeepRead’s external API.
Install only if you are comfortable uploading the selected medical documents to DeepRead and have confirmed the vendor’s legal and security posture for PHI, including a HIPAA BAA if needed. Keep the API key in the declared environment variable, avoid hardcoding it in scripts, test redaction with synthetic data first, and review any fields marked for human review.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
64/64 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.