unisound-chief-complaint-disease-op

• Outcome: Pass
• Latest audit: Jul 16, 2026 · 7:56 AM UTC
• Version: 1.0.2

Overview

This skill is a disclosed medical-record quality-control tool that reads user-provided records, sends relevant text to a documented medical LLM endpoint, and writes results locally, with privacy cautions users must follow.

Install only if your organization approves sending de-identified outpatient record text to the documented HiVoice MaaS endpoint or a configured approved endpoint. Do not include names, IDs, or other PHI, protect the app key, review output files for sensitive content, and avoid --save-prepared unless you intentionally want plaintext prepared records written to a secure location.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill documentation describes capabilities to read input files, write output files, and send medical record text over the network, but it declares no permissions. This creates a transparency and governance gap: operators may approve or run the skill without realizing it handles filesystem access and external data transfer, which is especially risky for sensitive medical text.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared behavior understates what the skill actually does: it supports broad document ingestion, writes results locally, and transmits medical content to a remote endpoint described only as an 'internal medical model.' In a healthcare context, this mismatch can lead to unauthorized processing or disclosure of sensitive data because users may not understand the true scope of collection, transformation, persistence, and third-party transfer.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill sends raw outpatient record content, including chief complaint and present illness, to an external LLM API endpoint. In a medical context this is sensitive health data, and transmitting it off-system without explicit disclosure, consent, minimization, or a trust boundary check creates a real confidentiality and compliance risk.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: When --save-prepared is enabled, the script writes preprocessed outpatient medical record text directly to disk in plaintext. Because this skill handles EMR content, that output may contain highly sensitive personal and health data, creating confidentiality and retention risks if the file is stored in shared directories, collected by logs/backups, or accessed by unauthorized users.

Ssd 2

Medium

• Confidence: 90% confidence
• Finding: Untrusted patient text from the chief complaint is interpolated directly into an instruction-following prompt, so crafted text can semantically alter the model's behavior or output classification. Even though the current outcome is limited to QC decisions, this can cause integrity failures such as systematically returning false negatives or false positives.

Ssd 2

Medium

• Confidence: 90% confidence
• Finding: This second classifier repeats the same pattern by embedding untrusted chief-complaint content directly into a natural-language prompt. A maliciously crafted complaint can manipulate the operation-vs-disease judgment and undermine the gating logic that decides whether deeper QC runs.

Ssd 2

High

• Confidence: 96% confidence
• Finding: The final QC prompt embeds both chief complaint and present illness inside a long reasoning instruction, greatly increasing the surface for prompt injection from patient-controlled or upstream-controlled record text. Because this output is the final quality-control result, successful injection can directly corrupt medical QC decisions and potentially suppress detection of documentation defects.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.