unisound-diagnosis-review

• Outcome: Pass
• Latest audit: Jul 16, 2026 · 2:37 AM UTC
• Version: 1.0.2

Overview

This medical coding review skill has sensitive but mostly disclosed, user-invoked behavior; install only with trusted clinical data-handling controls.

Install only in an environment approved for patient data. Configure GUIDELINE_API_BASE and --base to trusted internal services, use --no-llm for local fallback when external processing is not allowed, redact identifiers before input, and avoid --save-prepared or output paths unless you intentionally want medical data written to disk.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tainted flow: 'req' from os.getenv (line 264, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers={"Content-Type": "application/json", **{key: value for key, value in headers.items() if value}},
            method="POST",
        )
        opener = request.urlopen(req) if not self._settings.timeout else request.urlopen(req, timeout=self._settings.timeout)
        with opener as response:
            response_payload = json.loads(response.read().decode("utf-8"))
        choices = response_payload.get("choices") or []

• Confidence: 97% confidence
• Finding: The LLM request sends a prompt containing medical record text and diagnosis evidence to a network endpoint whose base URL and credentials are supplied at runtime. That creates a tainted-data exfiltration path for sensitive PHI/medical data and, because the destination is configurable, can also send it to an unintended or attacker-controlled service.

Tainted flow: 'req' from os.getenv (line 264, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Authorization"] = f"Bearer {self._settings.api_key}"
        req = request.Request(url=url, headers=headers, method="GET")
        try:
            with request.urlopen(req, timeout=self._settings.timeout) as response:
                return json.loads(response.read().decode("utf-8"))
        except error.HTTPError as exc:
            if exc.code == 404:

• Confidence: 90% confidence
• Finding: Diagnosis codes are transmitted to a remote guideline API using environment-configured base URL and optional bearer token. While less sensitive than full chart contents, diagnosis codes can still be sensitive health information, and the configurable destination creates unnecessary disclosure risk if misconfigured or pointed to an untrusted host.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill declares no permissions, but the documentation clearly describes capabilities requiring environment variable access, file read/write, and outbound network access. This mismatch weakens the platform’s trust and review model: operators may grant or deny deployment based on incomplete metadata, and hidden capabilities are especially sensitive here because the skill processes medical records and can send content to external services.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill is described as diagnosis-code review over structured case data, but the implementation forwards case document contents to an external LLM for processing. In a medical context this is especially dangerous because the transmitted text may contain highly sensitive PHI, and users of the skill are not clearly told that external model processing occurs.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code accepts a user-supplied or payload-supplied base URL for model access, enabling transmission of prompts and medical records to arbitrary endpoints. This broad outbound capability exceeds what is necessary for a diagnosis-audit skill and materially increases the risk of silent data exfiltration to attacker-controlled infrastructure.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The save_prepared helper persists fully prepared medical-record text to disk, which is highly sensitive patient data. In a diagnosis-review skill, this debug artifact is not necessary for core functionality and creates an avoidable confidentiality and retention risk if the filesystem is shared, backed up, or insufficiently protected.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The main flow exposes an option to save the preprocessed case text as an additional artifact, expanding behavior beyond diagnosis review into local persistence of full case content. Because the input is medical data, this materially increases privacy exposure and data-retention surface without being essential to the stated purpose.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: Medical record contents are packaged into the prompt and sent to external HTTP chat-completion services without any user-facing disclosure, consent, or privacy guardrails in this file. Because the skill handles clinical documents, this omission increases compliance, privacy, and data-governance risk beyond an ordinary prompt-transfer issue.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The guideline lookup sends diagnosis codes to a remote API without surfacing this disclosure to the user. Even if operationally expected, diagnosis codes can reveal protected health conditions, so undisclosed remote transfer is a real privacy issue in a medical-review skill.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This code can write full prepared medical-record text to disk when --save-prepared is used, but there is no privacy notice, confirmation step, or safeguard despite handling sensitive patient information. In healthcare contexts, silent persistence of PHI is dangerous because operators may enable debugging without realizing the retention and disclosure consequences.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The code packages the medical record payload together with model endpoint settings and an app authentication key, then submits it to review_diagnosis_payload for LLM-backed processing. In a medical-diagnosis-review skill, transmitting patient records to an external or internal LLM service without explicit disclosure, minimization, or consent creates a significant confidentiality and compliance risk, especially if service boundaries and logging practices are unclear.

Static analysis

No suspicious patterns detected.