unisound-followup-record

• Outcome: Review
• Latest audit: Jul 16, 2026 · 6:43 AM UTC
• Version: 1.0.2

Overview

This medical-record skill performs its stated extraction task, but it sends sensitive record text to a remote model without implementing the promised de-identification and can optionally save sensitive data locally.

Review before installing or using with real patient data. Only use this skill if sending medical record text to the configured remote model service is approved for your environment, and treat output/save-prepared files as sensitive records. Prefer test or de-identified inputs unless the publisher adds actual de-identification and clearer persistence controls.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill documents capabilities for file reads, file writes, and network access but does not declare corresponding permissions. This weakens policy enforcement and review because a consumer may assume the skill is purely local text structuring while it can access files and transmit medical content over the network. In a healthcare context, undeclared capabilities increase the risk of unauthorized handling of sensitive patient data.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documented purpose says the skill structures follow-up records into JSON, but the file also describes broad document ingestion, external network submission to a model service, optional local persistence, and line-based text output. This mismatch is dangerous because operators may provide sensitive records under false assumptions about processing boundaries, storage, and output format, leading to privacy and compliance failures.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The privacy section promises strict de-identification and no local persistence, yet later options allow saving prepared text and output JSON/files to disk. For medical records, this contradiction can cause protected health information to be retained locally despite assurances to the contrary, increasing exposure, audit, and regulatory risk.

Missing User Warnings

High

• Confidence: 94% confidence
• Finding: The code sends raw medical-record content to a remote LLM API, which involves highly sensitive personal health information. In a medical-record processing skill, undisclosed external transmission materially increases privacy, compliance, and data-governance risk, especially if users assume local-only processing.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: Accepting the authentication key via a CLI argument exposes it to shell history, process listings, job logs, and orchestration metadata. Because this key authorizes access to a sensitive medical LLM service, accidental disclosure can enable unauthorized API use and further exposure of patient data.

Ssd 1

Medium

• Confidence: 96% confidence
• Finding: Untrusted medical-record text is interpolated directly into the LLM prompt with no clear delimitering or instruction/data separation, so adversarial text embedded in the record can steer the model's behavior. In this skill, that can corrupt extraction results, cause omission or fabrication of fields, and weaken reliability of structured clinical outputs.

Ssd 1

Medium

• Confidence: 97% confidence
• Finding: The second-stage prompts reuse model-produced chunk text as trusted context, which compounds prompt-injection risk: malicious instructions from the original record can survive stage one and gain amplified authority in stage two. In a medical setting this is more dangerous because it can systematically distort diagnoses/history/treatment extraction across multiple fields while appearing trustworthy.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.