Security audit

unisound-followup-reminder

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed medical follow-up reminder, but it sends sensitive patient details to a remote model and includes broad document/OCR ingestion without strong privacy or user-control safeguards.

Review before installing. Use this only if users understand that patient follow-up details and free-text notes are sent to the documented remote medical model endpoint. Prefer structured JSON inputs with minimal fields, avoid uploading full medical records unless necessary, and do not rely on the generated text as clinical advice.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill advertises and requires capabilities including file read/write, shell, network, and environment access, but does not declare permissions or constrain their use. In a medical reminder context, these capabilities expand the attack surface substantially because they can process sensitive patient files, invoke external tools, and transmit data off-host without transparent permission boundaries.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The documented behavior goes far beyond a simple follow-up reminder: it accepts many document types, performs OCR/document extraction, saves prepared data, and sends patient information to a remote LLM endpoint for generated output. This mismatch is dangerous because users may provide sensitive medical data expecting local reminder logic, while the skill actually performs broader ingestion and external transmission that materially changes privacy and security risk.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The documentation broadens a narrow reminder workflow into a generic document-ingestion pipeline with OCR and model-generated medical text. In a healthcare setting this increases exposure to sensitive data handling, parsing of untrusted files, and overcollection beyond what is necessary for scheduling reminders.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The skill states it only provides reminder support and does not replace clinician judgment, yet the output contract later says it returns model-generated medical interpretation/analysis. That inconsistency can mislead users into relying on generated medical guidance, creating safety risk and undermining informed consent about what the model is doing.

Description-Behavior Mismatch

High

Confidence: 86% confidence
Finding: This file implements a broad document-ingestion and conversion utility that is materially unrelated to a patient follow-up reminder skill. Such capability mismatch increases risk because it introduces unnecessary parsing of untrusted files and external-tool execution, expanding the attack surface beyond the declared healthcare reminder function.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The code invokes local office, OCR, and PDF-processing binaries on potentially untrusted inputs, which adds substantial attack surface and could expose the host to vulnerabilities in those third-party tools. In the context of a patient follow-up reminder skill, these capabilities are hard to justify and make the mismatch more dangerous because healthcare-related deployments often handle sensitive data.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The fallback handler claims to only retry preprocessing, but it changes the core invocation from build(data, today_date, args.appkey) to build(data, args.appkey). That passes the appkey into the today parameter and omits the required credential argument, causing incorrect behavior and potentially surfacing secrets in exception messages or logs during failure handling. In a medical reminder skill, broken fallback paths reduce reliability for patient-facing workflows and can mishandle sensitive operational inputs.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly sends medical input data to a remote API but does not provide a clear user-facing warning about privacy, data sharing, retention, or handling of protected health information. In a patient follow-up context, this is particularly sensitive because uploaded files and extracted text may contain personal and medical details that users would not expect to leave the local environment.

Missing User Warnings

Medium

Confidence: 80% confidence
Finding: The module performs document conversion and OCR through external binaries without any visible disclosure, consent, or warning path, which creates a transparency and privacy problem. In a medical context, users may unknowingly submit sensitive records for processing by local third-party tools, increasing compliance and trust risk even if no direct exploit is present.

Missing User Warnings

High

Confidence: 94% confidence
Finding: The code sends patient-specific medical data, including disease type, visit dates, and notes, to an external LLM API without any user-facing notice, consent flow, minimization, or policy enforcement visible in this file. Because the skill handles healthcare follow-up information, this creates elevated privacy and compliance risk if users or operators are unaware that protected or sensitive data leaves the local environment.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/run.py:232