ClawHub
Back to skill

Security audit

unisound-drg-grouping

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed medical DRG helper that sends user-provided case text to a configured model endpoint and echoes results, with privacy risks the user must manage.

Install only if you are allowed to process this medical text with the configured model endpoint. De-identify real patient data before use, avoid piping stdout into shared logs, use `--text-only` when you do not need the full JSON trace, and treat any `--output` files as sensitive records.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill documentation indicates the implementation can read files, write files, and make network requests, yet it declares no permissions. That mismatch weakens reviewability and policy enforcement: callers may invoke a skill handling local patient data and sending it to a remote model endpoint without an explicit permission contract, increasing the chance of unintended data exposure or misuse.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The tool sends full user-supplied discharge summaries and DRG questions to an external HTTPS API, but it provides no explicit consent flow, warning, redaction step, or data-minimization control. In a medical context this can expose highly sensitive health information and identifiers to a remote service and may violate privacy, compliance, or internal data-handling requirements even if the endpoint is described as internal.

Ssd 3

Medium
Confidence
98% confidence
Finding
The code copies the full user prompt into the output object under the "question" field for every run, including file, stdin, and batch modes. Because the input may contain discharge documentation or medical summaries, this creates an unnecessary secondary disclosure path to stdout, logs, pipes, and output files, increasing the chance of plaintext PHI leakage.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.