med-chronic-disease-review

• Outcome: Review
• Latest audit: Jul 16, 2026 · 6:17 AM UTC
• Version: 1.0.2

Overview

The skill performs the stated chronic-disease claim review, but it handles sensitive medical OCR data with conflicting privacy and storage claims.

Install only in an environment approved for sensitive medical data. Before use, confirm whether patient identifiers are actually redacted before the LLM request, where ../runs outputs are stored, who can access those files, and whether your policy permits sending OCR medical records to the configured maas-api.hivoice.cn endpoint with the provided app key.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Tainted flow: 'text' from pathlib.Path.read_text (line 86, file read) → pathlib.Path.write_text (file write)

Medium

• Category: Data Flow

Content

if args.output:
        out_path = Path(args.output)
        out_path.parent.mkdir(parents=True, exist_ok=True)
        out_path.write_text(text, encoding="utf-8")
    else:
        print(text)
    return 0

• Confidence: 65% confidence
• Finding: out_path.write_text(text, encoding="utf-8")

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: 描述覆盖了核心主功能：针对糖尿病/高血压慢病审核，基于 OCR 文本调用内部医疗大模型输出审核结论与原因，这与代码主流程一致。但代码还包含若干未在描述中体现的能力，尤其是 run.py 提供的多格式文档预处理入口（不仅是 OCR 数组 JSON）、自动病种推断、dry-run 占位模式，以及将结果落盘到本地文件。这些属于实际能力扩展，其中多格式输入预处理尤其超出了“输入 OCR 结果数组 JSON”的声明，因此应判定为存在描述与行为不完全一致的 mismatch。

Intent-Code Divergence

High

• Confidence: 82% confidence
• Finding: The privacy statement says identifiable information will be desensitized before any model/API call, yet the rest of the skill documentation describes taking OCR records containing free-text `ocrText`, normalizing them to `ocr_array.json`, and then calling the medical LLM for review. In this file, no concrete desensitization mechanism or preprocessing step is described, so the privacy promise actively conflicts with the stated data flow.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The safety section states the skill does not write user input or intermediate results to local persistent storage and that data exists only briefly in memory. However, later lines document saving normalized `ocr_array.json`, raw response JSON, natural-language summaries, and optionally prepared OCR JSON to filesystem paths, which directly contradicts that claim.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The manifest describes a skill that takes an OCR result array JSON as input and returns a review conclusion, implying a narrowly scoped review step. This script instead accepts pdf/doc/docx/xls/xlsx/csv/txt/json inputs and performs substantial preprocessing to derive OCR-array JSON before review, which is broader behavior than the stated manifest purpose.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The manifest says the skill outputs audit conclusions and reasons, suggesting returned data, but this code persists raw JSON, natural-language summaries, and optionally normalized OCR data to local files. Persisting medical review artifacts is a meaningful behavior beyond the described review operation.

Natural-Language Policy Violations

Low

• Confidence: 77% confidence
• Finding: The markdown explicitly requires `tesseract` with the `chi_sim+eng` language pack for OCR input handling, which imposes a language/locale constraint in the skill instructions. The file does not offer an opt-in choice of OCR language packs or explain that this is a region-specific requirement, so it may conflict with organizational language/locale choice policy.

Missing User Warnings

High

• Confidence: 93% confidence
• Finding: The code constructs a prompt from OCR document contents and posts it to an external HTTPS API, which can transmit sensitive medical data off-box. While the CLI mentions an app key and internal medical LLM, this file does not visibly warn the user that patient OCR content will be transmitted to a network service before making the request.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: Natural-language prompts, decisions, defaults, and user-facing text are fixed in Chinese, and the script does not provide an opt-in or alternative locale selection. This can violate language/locale policy when a skill forces a specific language without user choice or documented regional justification.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The docstring and generated summaries are written in Chinese, and the script emits fixed Chinese phrases such as conclusions and error messages. For a general-purpose formatting script, this forces a specific language without user opt-in, which matches the language/locale policy concern.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This code saves the model response, natural-language summary, and optionally the prepared OCR array to local files. Because the skill processes medical records and OCR text, these writes can persist sensitive personal and health data, but the file provides no user-facing warning beyond success messages and no comment/docstring disclosing that sensitive data will be stored.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The code sends OCR-derived medical document content to `review_chronic_disease(...)`, along with authentication and endpoint parameters, which indicates a network-backed review step. Although the CLI description mentions running chronic disease review, this file does not clearly warn users that potentially sensitive health data will be transmitted to a remote model service.

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: The document classification rules and disease-code handling are built around Chinese labels such as `糖尿病`, `高血压`, and Chinese document names, and there is no user opt-in or locale-selection mechanism. This can amount to a language/locale policy issue because the skill behavior is constrained to a specific language without explicitly offering alternatives.

Ssd 3

Medium

• Confidence: 82% confidence
• Finding: The prompt construction places full OCR medical-record content directly into the user message for the model to process. Because the script later stores both the model's reasoning and raw output, this creates a plain-language data exposure pattern where private user-provided medical information can be echoed, summarized, or retained in outputs without any minimization or redaction step.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

| `pdftotext`（poppler-utils） | 提取 PDF 文本 | 输入为 pdf 且未安装 pypdf 时必须 |
| `tesseract`（含 chi_sim+eng 语言包） | 图片 OCR | 输入为 png/jpg/bmp/tif 等图片时必须 |

安装（Ubuntu/Debian）：`sudo apt-get install libreoffice poppler-utils tesseract-ocr tesseract-ocr-chi-sim`

> 仅使用 JSON 输入时，无需安装任何第三方包或外部工具。

• Confidence: 70% confidence
• Finding: sudo

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.