Security audit

unisound-health-risk-assessment

Security checks for vulnerabilities and agentic risk

Overview

The skill appears legitimate, but it can send sensitive medical reports and an API key to a configurable remote LLM without enforcing de-identification or endpoint limits.

Review this skill carefully before installing or running it with real patient data. Use only de-identified reports, avoid putting the API key directly in shell history or logs, keep the default trusted HTTPS endpoint unless you can verify an alternate endpoint, and treat all output as advisory medical information requiring qualified review.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/run.py:47
Finding: Unrestricted LLM Endpoint Can Expose Medical Reports and Bearer Credentials
Content: View full analysis
str: payload = {"model": model, "messages": messages, "temperature": 0} resp = _http_post(url, payload, headers, timeout=timeout) ``` The endpoint is exposed as an unrestricted command-line argument: ```python parser.add_argument("--base", default=DEFAULT_LLM_BASE, help=f"内部大模型 base URL（默认：{DEFAULT_LLM_BASE}）。") parser.add_argument("--model", default=DEFAULT_LLM_MODEL, help="模型名称（默认：{DEFAULT_LLM_MODEL}）。") parser.add_argument("--timeout", type=int, default=0, help="HTTP 超时秒数；0 表示一直等待（默认：0）。") ``` It is then used without validation: ```python llm = make_llm_caller(args.appkey, args.base, args.model, args.timeout) ``` ### Technical Analysis The `--base` option accepts an arbitrary URL. The code does not require HTTPS, verify that the hostname belongs to the intended medical service, or apply an endpoint allowlist. The resulting endpoint receives both: 1. The API key in an `Authorization: Bearer` header. 2. The complete health report in the LLM request body. A malicious or mistakenly configured endpoint can therefore collect both the credential and sensitive medical information. If an HTTP URL is supplied, network intermediaries may also intercept or modify the request. The documentation claims that input should be strictly de-identified, but the implementation performs no redaction or validation before transmitting the report. The default endpoint is consistent ...[truncated 1058 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/run.py:219
Finding: API Credential Is Required as a Command-Line Argument
Content: View full analysis
`. 2. The full command is retained in shell history, automation logs, or process metadata. 3. A local user or log reader with access to that source obtains the key. 4. The exposed credential is used to call the LLM service until it expires or is revoked. ### Impact Assessment An attacker can obtain the API credential and exercise the remote permissions assigned to it, potentially consuming service quotas or submitting unauthorized requests. This issue does not itself provide local privilege escalation. The practical scope depends on local process visibility, log access, and the privileges associated with the credential. ]]>
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: scripts/run.py:160
Finding: Untrusted Health Report Content Can Inject Instructions into the LLM Prompt
Content: View full analysis
int: prompt = f"""请对以下体检报告进行多维度健康风险评估，并生成个性化健康管理方案。【体检报告】 {report_text.strip()} 请严格按照要求输出 JSON + 健康风险报告。""" ``` ### Technical Analysis The report is arbitrary file content and is interpolated directly into an LLM user message. There is no explicit trust-boundary instruction telling the model to treat report contents exclusively as medical data and never as instructions. A crafted report can include directions to ignore the requested assessment policy, fabricate findings, change risk levels, omit warnings, or produce attacker-selected narrative content. The subsequent processing only attempts `json.loads()` and does not validate the response against the expected schema, allowed risk values, medical evidence, or safe-output constraints. The LLM caller has no local execution tools in this implementation, so the direct effect is limited to compromising generated output rather than executing commands on the host. ### Attack Path 1. An attacker creates or modifies a health-report file. 2. The file includes instruction-like text directing the model to ignore its prior requirements or generate a selected diagnosis or recommendation. 3. The Skill embeds that text verbatim in the LLM prompt. 4. The model follows the injected instructions instead of, or in addition to, the intended medical-assessment policy. 5. The manipulated response is printed to standard output or saved as an apparently legitimate health-risk report. 6. A recipient may rely on the altered medical guidance. ### Impact Assessment The attacker can compromise the integrity of the generated risk assessment, referrals, monitoring schedule, and health advice. This could cause misleading medical recommendations or inapp ...[truncated 179 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill documentation indicates capabilities to read local files, write output files, and send medical report data to a remote API, but it does not declare any explicit tool scope or permission boundaries. In a health-data context, this increases the risk of unintended data exfiltration, overbroad file access, or misuse by an execution environment that grants more access than necessary.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The natural-language content of the skill, including the description, usage instructions, and output expectations, is written in Chinese only. This may impose a specific language/locale on users without explicitly offering a language choice or documenting that the skill is intended only for a Chinese-speaking context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill sends full physical exam / medical report content to a remote LLM endpoint, which is highly sensitive health data. There is no explicit consent flow, privacy notice, minimization, redaction, or guarantee that the endpoint is strictly local to the user's trust boundary, so the design can expose protected medical information to external processing or logging.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The natural-language description and all user-facing prompts, help text, and output requirements are hardcoded in Chinese, which effectively forces a specific language/locale. There is no indication that the user can choose another language or that the Chinese-only behavior is an intentional opt-in or region-scoped constraint.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.