unisound-function-self-assessment

• Outcome: Review
• Latest audit: Jul 16, 2026 · 8:23 AM UTC
• Version: 1.0.2

Overview

This skill is a disclosed medical self-assessment CLI that processes user-provided assessment files and sends results to a documented medical model API, with no evidence of hidden persistence, credential theft, or destructive behavior.

Install only if you are comfortable sending patient self-assessment content to the documented hivoice.cn medical model endpoint with the provided appkey. Prefer JSON input when possible; using Office, PDF, or image inputs may run local conversion/OCR tools on those files.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

cmd = [tesseract_bin, str(path), "stdout"]
    if lang_arg:
        cmd.extend(["-l", lang_arg])
    proc = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, check=False)
    if proc.returncode != 0 or not proc.stdout.strip():
        raise PreprocessError(f"Image OCR failed: {proc.stderr.strip() or 'no text returned'}")
    return proc.stdout

• Confidence: 70% confidence
• Finding: proc = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, check=False)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def detect_tesseract_langs(tesseract_bin: str) -> Sequence[str]:
    proc = subprocess.run(
        [tesseract_bin, "--list-langs"],
        stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, check=False,
    )

• Confidence: 70% confidence
• Finding: proc = subprocess.run( [tesseract_bin, "--list-langs"], stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, check=False, )

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if not office_bin:
        raise PreprocessError("libreoffice/soffice not found for office document conversion.")
    with tempfile.TemporaryDirectory(prefix="med-skill-preprocess-") as tmp_dir:
        proc = subprocess.run(
            [office_bin, "--headless", "--convert-to", "txt:Text", "--outdir", tmp_dir, str(path)],
            stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, check=False,
        )

• Confidence: 70% confidence
• Finding: proc = subprocess.run( [office_bin, "--headless", "--convert-to", "txt:Text", "--outdir", tmp_dir, str(path)], stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if not office_bin:
        raise PreprocessError("libreoffice/soffice not found for xls conversion.")
    with tempfile.TemporaryDirectory(prefix="med-skill-preprocess-") as tmp_dir:
        proc = subprocess.run(
            [office_bin, "--headless",
             "--convert-to", "csv:Text - txt - csv (StarCalc):44,34,76,1",
             "--outdir", tmp_dir, str(path)],

• Confidence: 70% confidence
• Finding: proc = subprocess.run( [office_bin, "--headless", "--convert-to", "csv:Text - txt - csv (StarCalc):44,34,76,1", "--outdir", tmp_dir, str(path)],

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

pass
    pdf_to_text = shutil_which("pdftotext")
    if pdf_to_text:
        proc = subprocess.run(
            [pdf_to_text, "-layout", str(path), "-"],
            stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, check=False,
        )

• Confidence: 70% confidence
• Finding: proc = subprocess.run( [pdf_to_text, "-layout", str(path), "-"], stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, check=False, )

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: 声明描述强调的是“病人端术后康复功能自测评估”以及“构建自评量表能力”，这通常意味着提供问卷/量表定义、交互收集答案、类似 ResearchKit 的 survey/questionnaire 能力。实际代码并没有实现问卷构建或病人端交互流程，而是读取已有评估结果数据（来自 JSON、文本、表格、Office、PDF、图片等文件），做简单总分计算，并把结果发送给外部 LLM 生成解释。多格式文档预处理、OCR、Office/PDF 解析以及外部 API 调用都属于描述中未体现的重要能力，因此描述不能准确代表代码实际行为。

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The manifest describes a patient-side postoperative rehabilitation self-assessment capability modeled on ResearchKit questionnaires, which suggests survey/form handling. This file instead implements a broad document-ingestion utility for PDFs, Office files, spreadsheets, JSON, text, and image OCR, far beyond questionnaire construction or scoring.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The code executes LibreOffice/soffice, pdftotext, and tesseract subprocesses to convert documents and OCR images. Spawning external tools for arbitrary file parsing is not an obvious requirement for a postoperative self-assessment questionnaire skill and materially expands capability.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: This markdown file states that the skill sends data to an internal medical large-model endpoint and requires an app key, but it does not explicitly warn users that patient self-assessment content may be transmitted off-box to a remote service. Because the skill handles medical self-assessment data, a clear disclosure about remote processing and privacy impact is warranted.

Natural-Language Policy Violations

Low

• Confidence: 72% confidence
• Finding: The description, examples, field labels, and user-facing content are entirely in Chinese, and there is no indication that users may select another language or that the skill is intentionally restricted to a Chinese-speaking region or workflow. This can constitute a language/locale policy issue when no opt-in or justification is provided.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This code invokes external binaries via subprocess for office conversion, PDF extraction fallback, and OCR, which are safety-relevant operations for a preprocessing tool handling user files. Although the module docstring describes file preprocessing generally, there is no user-facing prompt, logging, or explicit warning in these code paths that external tools will be executed on the supplied documents.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The code automatically selects "chi_sim+eng" when those Tesseract language packs are available, imposing a specific language/locale behavior without offering the user a choice. This is a natural-language policy issue because the skill biases output language handling based on available OCR models rather than explicit user preference or documented regional scope.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The function sends assessment data, including question text, answers, scores, assessment ID, and assessment time, to an external HTTPS endpoint. The file contains no confirmation prompt, no user-facing print/log disclosure, and no comment or docstring warning that user data will be transmitted off-device.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: The script requires an appkey and uses it as a Bearer token in an outbound request, but provides no warning or explanatory comment about credential use beyond stating it is required. For code-file warning review, access and transmission of credentials should have some visible disclosure when not otherwise documented in this file.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The system prompt is entirely in Chinese and directs the model to respond in that language/tone, with no opt-in or language selection mechanism. This is a natural-language locale policy issue because the skill imposes a specific language rather than offering the user a choice.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/run.py:208