unisound-diagnosis-sufficiency-review

• Outcome: Review
• Latest audit: Jul 16, 2026 · 2:48 AM UTC
• Version: 1.0.2

Overview

This medical-record review skill is mostly coherent, but it can send sensitive case text and the supplied model credential to a caller-configurable LLM endpoint.

Install only in an environment approved for medical-record handling. Use desensitized inputs, prefer --no-llm when external model sharing is not approved, do not pass untrusted --base values, and avoid --save-prepared unless the output location has appropriate access controls and retention handling.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (6)

Tainted flow: 'req' from os.getenv (line 509, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers={"Content-Type": "application/json", **{key: value for key, value in headers.items() if value}},
            method="POST",
        )
        opener = request.urlopen(req) if not self._settings.timeout else request.urlopen(req, timeout=self._settings.timeout)
        with opener as response:
            response_payload = json.loads(response.read().decode("utf-8"))
        choices = response_payload.get("choices") or []

• Confidence: 96% confidence
• Finding: opener = request.urlopen(req) if not self._settings.timeout else request.urlopen(req, timeout=self._settings.timeout)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill declares no permissions, yet its specification explicitly relies on environment variables, local file read/write, and outbound network access to a guideline API and an LLM endpoint. This mismatch weakens platform trust boundaries and reviewability: operators or users may approve the skill believing it is self-contained when it can actually access sensitive medical records, persist prepared data, and transmit content externally.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The skill description suggests structured-record diagnosis sufficiency review, but the implementation assembles and transmits substantial free-text case documents to the LLM. In a medical context, this broadens data exposure beyond the stated scope and can leak highly sensitive patient information to an external model provider.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The payload allows callers to supply an arbitrary model base URL, and the skill then sends prompts and case evidence to that endpoint with bearer authentication. In this medical-review context, that creates an obvious exfiltration channel for protected health information and may also leak the provided model credential to an attacker-controlled service.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The implementation forwards selected medical record documents to an external HTTP API without any user-facing warning, consent mechanism, or disclosure in the workflow. Because the data includes clinical narrative and diagnosis evidence, silent transmission materially increases privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The --save-prepared path writes preprocessed medical record text to disk, and the prepared text is assembled from full document contents in record_to_prepared_text. Because this skill handles sensitive healthcare data, creating plaintext debug artifacts materially increases privacy and compliance risk if the file is left on shared storage, backed up broadly, or read by other users/processes.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.