unisound-glucose-monitor-record

• Outcome: Review
• Latest audit: Jul 16, 2026 · 8:23 AM UTC
• Version: 1.0.2

Overview

This skill is related to blood glucose tracking, but it sends sensitive health records to a remote medical AI service and goes beyond simple logging into analysis and advice.

Review before installing if you plan to enter real patient data. The skill sends blood glucose records, and possibly text extracted from documents or images, to a remote medical AI endpoint using your appkey. Use it only if that data sharing is acceptable, and avoid submitting documents that contain unrelated medical or personal information.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (21)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

cmd = [tesseract_bin, str(path), "stdout"]
    if lang_arg:
        cmd.extend(["-l", lang_arg])
    proc = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, check=False)
    if proc.returncode != 0 or not proc.stdout.strip():
        raise PreprocessError(f"Image OCR failed: {proc.stderr.strip() or 'no text returned'}")
    return proc.stdout

• Confidence: 70% confidence
• Finding: proc = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, check=False)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def detect_tesseract_langs(tesseract_bin: str) -> Sequence[str]:
    proc = subprocess.run(
        [tesseract_bin, "--list-langs"],
        stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, check=False,
    )

• Confidence: 70% confidence
• Finding: proc = subprocess.run( [tesseract_bin, "--list-langs"], stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, check=False, )

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if not office_bin:
        raise PreprocessError("libreoffice/soffice not found for office document conversion.")
    with tempfile.TemporaryDirectory(prefix="med-skill-preprocess-") as tmp_dir:
        proc = subprocess.run(
            [office_bin, "--headless", "--convert-to", "txt:Text", "--outdir", tmp_dir, str(path)],
            stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, check=False,
        )

• Confidence: 70% confidence
• Finding: proc = subprocess.run( [office_bin, "--headless", "--convert-to", "txt:Text", "--outdir", tmp_dir, str(path)], stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if not office_bin:
        raise PreprocessError("libreoffice/soffice not found for xls conversion.")
    with tempfile.TemporaryDirectory(prefix="med-skill-preprocess-") as tmp_dir:
        proc = subprocess.run(
            [office_bin, "--headless",
             "--convert-to", "csv:Text - txt - csv (StarCalc):44,34,76,1",
             "--outdir", tmp_dir, str(path)],

• Confidence: 70% confidence
• Finding: proc = subprocess.run( [office_bin, "--headless", "--convert-to", "csv:Text - txt - csv (StarCalc):44,34,76,1", "--outdir", tmp_dir, str(path)],

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

pass
    pdf_to_text = shutil_which("pdftotext")
    if pdf_to_text:
        proc = subprocess.run(
            [pdf_to_text, "-layout", str(path), "-"],
            stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, check=False,
        )

• Confidence: 70% confidence
• Finding: proc = subprocess.run( [pdf_to_text, "-layout", str(path), "-"], stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, check=False, )

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: 声明强调的是“慢病管理基础记录能力”，类似血糖日志记录；但代码的核心行为明显超出单纯记录：它会预处理多种文档格式，结构化提取血糖数据，并把数据上传到外部医疗大模型进行分析和生成建议。这属于额外的分析与外部服务访问能力，描述中未体现。虽然这些功能与血糖管理相关，但已超出“基础记录”范畴，因此应判定为描述与实际行为不一致。

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: L072 明确声明“本 skill 只做血糖记录，不做诊断”，而 L103-L108 又将输出定义为由内部医疗大模型生成的“自然语言解读/分析/提醒”。这超出了单纯记录与结构化输出的范围，属于额外的分析性能力，与前述受限描述不一致。

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: 该 skill 的核心目标是输入血糖记录并输出标准 JSON，这在文档中也被描述为基础记录能力；但 L167-L174 规定执行时“强制走 API 推理，无本地透传模式”。对一个记录型技能而言，远程推理并非显而易见的必要条件，属于与场景不完全相称的能力扩张。

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The skill manifest describes a patient-side chronic disease blood glucose recording capability, but this file is documented and implemented as a generic file preprocessing utility for many formats including PDF, Office documents, JSON, spreadsheets, and images. That broad ingestion/extraction behavior exceeds the manifest's stated glucose-monitor record scope rather than serving an obvious, narrowly scoped logging function.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The script executes LibreOffice/soffice, pdftotext, and tesseract to convert and OCR arbitrary documents and images. For a skill whose stated purpose is blood glucose monitoring record management, these broad document-processing and OCR capabilities are not obviously required and materially expand what the skill can do.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest describes a basic patient-side blood glucose monitoring/recording capability, which implies capturing and structuring glucose records. However, the code goes beyond record management by analyzing normal ranges, detecting trends and abnormalities, generating risk prompts, and producing lifestyle suggestions through an external AI API.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: For a skill described as foundational blood glucose record management, transmitting health data to a third-party remote model endpoint is not an obvious or necessary requirement. This introduces an external data-sharing capability that materially exceeds what a user would expect from a local record-logging skill.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The top-level docstring explicitly states the skill is self-contained and independent of _shared. In practice, the exception handler imports and executes a preprocess module from _shared/doc-preprocess as a fallback, which directly contradicts that documentation.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The markdown states that the skill uses an internal medical model endpoint and requires an appkey, but it does not clearly warn users that submitted blood glucose records and parsed document contents may be transmitted off the local system. Because the skill accepts sensitive medical data and multiple document formats, an explicit privacy/data-transmission warning is warranted.

Natural-Language Policy Violations

Low

• Confidence: 83% confidence
• Finding: The documentation specifies OCR tooling with Chinese language data (`chi_sim+eng`) and presents the skill entirely as Chinese-oriented, but does not indicate any user-selectable language or locale behavior. This may constitute a language/locale policy issue if the skill implicitly restricts operation or output to a specific language without opt-in.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: This code invokes external binaries to process user-supplied files, which is a safety-relevant operation under the subprocess-execution criterion. While the function names imply conversion, there is no confirmation prompt, user-facing log/print, or inline warning/comment disclosing that external tools will be executed on the user's documents.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The code runs Tesseract against user-provided image files, which is a subprocess operation on potentially sensitive user data. There is no visible confirmation, user-facing notice, or explanatory comment/docstring warning that OCR will invoke an external binary and process the file contents.

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: The natural-language description is written entirely in Chinese, indicating a language-specific presentation without any visible opt-in or alternative locale handling. Under the policy, forcing a specific language without user choice can be a locale/language policy issue.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script packages blood glucose records into `user_prompt` and sends them via `_call_llm` to a remote HTTPS endpoint. While the code comments describe the API call, there is no user-facing disclosure, confirmation, or warning that medical data will be transmitted off-box to an external service.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The system prompt mandates Chinese output aimed at patients and does not provide any option for user language or locale preference. This is a natural-language policy concern because the skill enforces a specific language without opt-in or documented region-specific justification.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/run.py:318