Security audit

unisound-hypertension-missing-bp

Security checks across malware telemetry and agentic risk

Overview

The skill is a disclosed medical-record quality-control tool that reads user-selected records, sends relevant clinical text to a stated LLM endpoint, and writes results, but users must handle de-identification and storage carefully.

Install only in an environment authorized to process medical-record text. De-identify records before use, confirm the configured HiVoice MaaS or --base endpoint is approved for the data, protect the appkey, and avoid --save-prepared unless the output directory is secured and retention is managed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill documentation indicates capabilities to read local files, write output files, and send medical record content to an external network API, but it does not declare any permissions. This creates a transparency and governance gap: operators may approve or run the skill without understanding that sensitive clinical text can be exfiltrated to a remote service and written to disk, increasing privacy and compliance risk.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The code sends patient medical-record content from 现病史 and 既往史 to an external LLM endpoint over the network, but the skill provides no disclosure, consent flow, minimization, or local-only option. In a medical context this is sensitive health data, so undisclosed third-party transmission can create privacy, compliance, and data-governance risk even if the transport is HTTPS.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The main QC step transmits the full clinical fields relevant to the rule, including history and physical-exam content, to a remote LLM service without any explicit notice that sensitive patient data leaves the local environment. Because this is outpatient EMR quality-control processing, the context makes the data especially sensitive and raises regulatory and confidentiality concerns.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: When --save-prepared is used, the script writes preprocessed outpatient medical record text directly to disk, which can include protected health information. In a medical QC skill, debug outputs materially increase privacy and compliance risk because the file may be stored in an insecure location, retained too long, or accessed by unauthorized users.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The script transmits extracted medical record text to a model endpoint via configurable base/model parameters, but the CLI does not present a clear user-facing disclosure that sensitive medical data is being sent for remote processing. In this healthcare context, undisclosed transmission of patient data can create serious privacy, legal, and compliance exposure, especially if the endpoint is misconfigured or not strictly internal.

Ssd 1

Medium

Confidence: 94% confidence
Finding: Untrusted EMR text is interpolated directly into the LLM prompt as natural-language context, with no delimiting or instruction that the embedded record must be treated strictly as data. A crafted patient note could inject adversarial instructions that bias the model's '有/无' classification, causing incorrect QC outcomes and weakening trust in downstream medical review.

Ssd 1

Medium

Confidence: 96% confidence
Finding: The full QC prompt mixes detailed instructions, examples, and raw patient-note fields in the same instruction-following channel, creating a semantic prompt-injection surface. In this medical QC setting, manipulated note content could cause false '无缺陷' or misleading rationale, reducing quality-control effectiveness and potentially letting documentation defects pass undetected.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.