unisound-abnormal-indicator-alert

• Outcome: Review
• Latest audit: Jul 16, 2026 · 7:58 AM UTC
• Version: 1.0.2

Overview

This health-alert skill is not clearly malicious, but it needs review because it sends sensitive medical inputs to an external model and processes broad document formats despite describing itself as rule-based.

Install only after confirming users understand that medical measurements and extracted document text may be sent to the named external LLM service. Prefer structured JSON/CSV input, avoid uploading rich medical documents unless necessary, and require human clinical review for any generated causes or recommendations.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if not office_bin:
        raise PreprocessError("libreoffice/soffice not found for office document conversion.")
    with tempfile.TemporaryDirectory(prefix="med-skill-preprocess-") as tmp_dir:
        proc = subprocess.run(
            [office_bin, "--headless", "--convert-to", "txt:Text", "--outdir", tmp_dir, str(path)],
            stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, check=False,
        )

• Confidence: 82% confidence
• Finding: proc = subprocess.run( [office_bin, "--headless", "--convert-to", "txt:Text", "--outdir", tmp_dir, str(path)], stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if not office_bin:
        raise PreprocessError("libreoffice/soffice not found for xls conversion.")
    with tempfile.TemporaryDirectory(prefix="med-skill-preprocess-") as tmp_dir:
        proc = subprocess.run(
            [office_bin, "--headless",
             "--convert-to", "csv:Text - txt - csv (StarCalc):44,34,76,1",
             "--outdir", tmp_dir, str(path)],

• Confidence: 82% confidence
• Finding: proc = subprocess.run( [office_bin, "--headless", "--convert-to", "csv:Text - txt - csv (StarCalc):44,34,76,1", "--outdir", tmp_dir, str(path)],

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

pass
    pdf_to_text = shutil_which("pdftotext")
    if pdf_to_text:
        proc = subprocess.run(
            [pdf_to_text, "-layout", str(path), "-"],
            stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, check=False,
        )

• Confidence: 71% confidence
• Finding: proc = subprocess.run( [pdf_to_text, "-layout", str(path), "-"], stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, check=False, )

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill declares no permissions while its documented behavior clearly implies file reads/writes, shelling out to external tools, network access, and likely environment/token handling. This is dangerous because it hides the true attack surface from reviewers and users, especially in a medical skill that may process sensitive health documents and transmit data externally.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose is narrow abnormal-indicator alerting, but the skill also describes broad document ingestion, OCR, office/PDF conversion, and outbound LLM calls to a remote endpoint. This mismatch is dangerous because users may provide sensitive medical files under the assumption of local rule-based alerting, while the skill actually performs much broader data extraction and external transmission.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Broad parsing of PDF, Office documents, images, and OCR introduces a much larger input-handling and tool-execution surface than is needed for simple abnormal-indicator alerts. In context, this is risky because medical users may submit rich documents containing unrelated PHI, and external converters/OCR tools have historically increased exposure to parsing bugs, data over-collection, and unintended retention.

Intent-Code Divergence

High

• Confidence: 95% confidence
• Finding: The skill claims to be only rule-based and not diagnostic, yet elsewhere states that an internal medical LLM generates reasoning, interpretation, and reminders. This contradiction is dangerous because it obscures the real decision path and may cause operators or patients to overtrust generated medical analysis without appropriate safeguards, review, or disclosure.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: Saying all thresholds are caller-supplied suggests deterministic behavior, but also stating that an internal medical LLM performs inference creates ambiguity about what actually drives alerts and recommendations. This is dangerous because downstream systems may assume fully controllable threshold-only behavior while the model may add non-deterministic interpretations or recommendations affecting patient guidance.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The file implements a generic multi-format ingestion pipeline for text, tables, PDFs, office documents, JSON, and OCR images, which materially exceeds the declared scope of patient abnormal-indicator alerting. This scope expansion is dangerous because it broadens the skill's data-handling and code-execution surface without an evident need tied to the medical function, increasing the chance of misuse, sensitive-data overcollection, and exploitation through file parsers.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: The skill invokes external office, PDF, and OCR executables, substantially increasing the trusted computing base and exposure to malicious file-based attacks. In the context of a narrowly scoped medical alerting skill, these capabilities are not obviously necessary and make the skill more dangerous because they permit arbitrary document processing pathways far outside core alert generation.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill is presented as an abnormal-indicator alerting tool, but it transmits patient measurement data to a third-party LLM service for analysis and advice generation. In a medical context, this is risky because sensitive health data leaves the local execution boundary without any visible minimization, consent flow, or disclosure, creating privacy, compliance, and trust issues.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The system prompt instructs the model to provide possible causes and medical recommendations, which exceeds a narrow abnormality-alert function and moves into clinical interpretation. In healthcare settings, generated cause analysis or care advice can be unsafe, misleading, or outside approved scope, especially if users rely on it without clinician review.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill documentation does not provide a clear user-facing warning that health data will be sent to an external API endpoint for inference. In a medical context this is especially dangerous because users may unknowingly transmit sensitive PHI outside the local environment, creating privacy, compliance, and trust risks.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The code silently performs document conversion and OCR through external tools without any visible disclosure, consent, or warning mechanism. For a healthcare-related skill, undisclosed preprocessing of uploaded files is risky because users may not expect broad content extraction from sensitive documents, and operators may underestimate the privacy and attack-surface implications.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The code sends medical data to an external API using the provided appkey, but there is no user-facing warning, consent mechanism, or privacy notice in the script. Because the transmitted content includes health measurements and related context, this creates a meaningful confidentiality and regulatory risk if users are unaware of the external processing.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: The user prompt forwards medical values, timestamps, threshold settings, and abnormality results verbatim in natural language to the external LLM. In a patient-monitoring context, this increases the sensitivity of the outbound payload and may expose personal or longitudinal health information beyond what is necessary for the stated function.

VirusTotal

61/61 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/run.py:226