Security audit

unisound-followup-mgmt

Security checks across malware telemetry and agentic risk

Overview

The skill mostly matches its stated medical follow-up purpose, but it sends sensitive health report text to a remote model while promising de-identification that the code does not actually perform.

Review this carefully before installing. Use it only if you are comfortable sending health report contents to the configured LLM endpoint, and remove names, IDs, phone numbers, addresses, and other identifiers yourself because the script does not enforce the de-identification promised in the documentation.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The file states that the follow-up notification must begin with the fixed Chinese phrase "【随访通知】" and be written in friendly language to the examinee. This imposes a specific language/locale behavior without documenting user choice, opt-in, or a region-specific justification, which matches the language-policy violation criterion.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The code inserts the full体检报告内容 into the LLM prompt and sends it via `_http_post` to a remote service. Although the module docstring mentions use of an internal medical model, there is no explicit user-facing warning in the CLI help or runtime output that personal health information will be transmitted over the network.

Natural-Language Policy Violations

Low

Confidence: 90% confidence
Finding: The system prompt requires a natural-language follow-up notice in Chinese-oriented formatting and the entire interaction is fixed to Chinese, with no opt-in or locale selection mechanism. This can violate language/locale policy where user choice is required.

Ssd 1

Medium

Confidence: 86% confidence
Finding: The code embeds raw `report_text` verbatim into a user prompt without any delimiting instruction that the embedded text is data only and must not be followed as instructions. If a report contains natural-language directives disguised as report content, the model may interpret them as higher-priority task guidance and deviate from the intended follow-up-plan generation.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.