Security audit

unisound-blood-pressure-monitor-record

Security checks across malware telemetry and agentic risk

Overview

The skill is a blood-pressure record tool, but it mandatorily sends sensitive health data to a remote medical model and adds analysis features that are not consistently scoped or disclosed.

Review this skill before installing if you plan to enter real patient data. It sends blood-pressure records, timestamps, heart rate, and notes to a remote API and may process PDFs, office files, spreadsheets, and images through local parsers or OCR tools. Prefer using it only with non-sensitive test data unless the publisher provides clear consent, retention, and privacy terms and you are comfortable with remote medical-model processing.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill advertises broad capabilities including file access, shelling out to external tools, network access, and writing output, yet declares no permissions or trust boundaries. In a medical-data context, this obscures the true attack surface and can lead operators or users to permit handling of sensitive files and network transmission without informed consent or review.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented behavior substantially exceeds the stated purpose of simple blood-pressure record creation: it transmits health data to a remote API, performs medical analysis, trend/risk interpretation, and parses many file types using external tools. This mismatch is dangerous because users may provide sensitive medical documents under the assumption of local record formatting, while the skill actually expands processing scope and disclosure to third parties.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The documentation shifts from a narrow recording function to AI-generated medical interpretation, analysis, and reminders. In a healthcare setting, this creates safety and privacy risk because users may rely on outputs that look clinical despite the earlier statement that the skill is only for recording and not diagnosis.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: Forcing remote LLM inference for a basic record-construction workflow introduces unnecessary external transmission of protected health information. Because the stated task can be performed locally and deterministically, mandatory remote processing increases privacy, availability, and supply-chain risk without functional necessity.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The skill claims it only records blood pressure and does not diagnose, but elsewhere promises model-generated analysis and reminders. This contradiction can mislead users and reviewers about clinical scope, increasing the chance of inappropriate reliance on AI-generated medical content and underestimating privacy risks from remote processing.

Description-Behavior Mismatch

Medium

Confidence: 79% confidence
Finding: The file implements a broad, generic ingestion pipeline for many document and image formats that materially exceeds the stated purpose of a blood-pressure record skill. Capability overreach increases attack surface by accepting and parsing risky file types such as office documents, PDFs, and images through multiple parsers and external tools without clear necessity to the medical-record function.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: OCR and office-document conversion are high-complexity features that process attacker-controlled files via external software, yet they are not justified by the narrow blood-pressure monitoring use case. In this context, unnecessary parsing of PDFs, images, DOC, and XLS expands the opportunities for denial of service, parser exploitation, and unexpected data handling beyond what the skill needs.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill describes sending blood-pressure and related health data to an internal medical model API but does not provide an explicit privacy notice, transmission warning, retention statement, or consent mechanism. For health information, undisclosed third-party or remote processing is a meaningful confidentiality issue even if the endpoint is internal to the vendor.

Missing User Warnings

Medium

Confidence: 70% confidence
Finding: The code silently sends user-supplied files through external conversion and OCR tools, which may have privacy and security implications, especially in a healthcare-related skill handling potentially sensitive patient data. Lack of disclosure and explicit consent is dangerous here because users may not expect documents or images to be processed by separate binaries with different logging, caching, and failure behaviors.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The code sends patient blood pressure records, timestamps, notes, and related health data to an external API via `_call_llm` without any consent flow, disclosure, minimization, or indication of a privacy safeguard in this file. In a medical skill, this is sensitive health information, so undisclosed third-party transmission creates material confidentiality, compliance, and trust risks even if the remote endpoint is legitimate.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/run.py:210