unisound-literature-analysis

• Outcome: Review
• Latest audit: Jul 16, 2026 · 8:40 PM UTC
• Version: 1.0.2

Overview

The skill does what it says: analyzes user-provided medical literature through a disclosed remote medical model, with some privacy and local document-parsing risks users should understand.

Install only if you are comfortable sending selected literature fields to the disclosed remote model endpoint. Do not use confidential, unpublished, patient-identifiable, or regulated documents unless your organization permits that endpoint, and prefer running document conversion on trusted files or in a constrained environment. Protect the API key because the current CLI argument style can expose it locally.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if not office_bin:
        raise PreprocessError("libreoffice/soffice not found for office document conversion.")
    with tempfile.TemporaryDirectory(prefix="med-skill-preprocess-") as tmp_dir:
        proc = subprocess.run(
            [office_bin, "--headless", "--convert-to", "txt:Text", "--outdir", tmp_dir, str(path)],
            stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, check=False,
        )

• Confidence: 73% confidence
• Finding: proc = subprocess.run( [office_bin, "--headless", "--convert-to", "txt:Text", "--outdir", tmp_dir, str(path)], stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if not office_bin:
        raise PreprocessError("libreoffice/soffice not found for xls conversion.")
    with tempfile.TemporaryDirectory(prefix="med-skill-preprocess-") as tmp_dir:
        proc = subprocess.run(
            [office_bin, "--headless",
             "--convert-to", "csv:Text - txt - csv (StarCalc):44,34,76,1",
             "--outdir", tmp_dir, str(path)],

• Confidence: 74% confidence
• Finding: proc = subprocess.run( [office_bin, "--headless", "--convert-to", "csv:Text - txt - csv (StarCalc):44,34,76,1", "--outdir", tmp_dir, str(path)],

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

pass
    pdf_to_text = shutil_which("pdftotext")
    if pdf_to_text:
        proc = subprocess.run(
            [pdf_to_text, "-layout", str(path), "-"],
            stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, check=False,
        )

• Confidence: 68% confidence
• Finding: proc = subprocess.run( [pdf_to_text, "-layout", str(path), "-"], stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, check=False, )

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill declares broad operational capabilities in practice—reading files, writing output, invoking shell tools, accessing environment data, and making network requests—without an explicit permissions declaration. This creates a transparency and governance gap: users and platforms may not realize the skill can exfiltrate document contents to an external API or invoke local converters/OCR tools on untrusted files.

Context-Inappropriate Capability

Medium

• Confidence: 82% confidence
• Finding: The code invokes local executables for document conversion and OCR across multiple untrusted file types, materially increasing attack surface beyond simple text processing. In the context of a literature-analysis skill, this is more dangerous because users may upload externally sourced PDFs, office documents, and images that are attacker-controlled, making parser exploitation and denial of service realistic concerns.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill sends user-supplied literature content to a remote third-party API for analysis, but the code does not provide any explicit notice, consent flow, or privacy warning before transmission. In a medical/pharma literature workflow, inputs may include proprietary research summaries, unpublished findings, or sensitive internal documents, so silent exfiltration to an external service creates material confidentiality and compliance risk.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: Accepting the API key via a command-line argument exposes the credential through shell history, process listings, job logs, and orchestration metadata on shared systems. This can allow other local users or monitoring systems to capture the bearer token and use the external API under the victim's account.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: The skill embeds literature title, abstract, conclusions, and URLs verbatim into the prompt and then asks the model to produce a synthesized report. Because the generated output is directly based on those embedded texts, the model may reproduce or over-disclose user-provided document contents, including proprietary or copyrighted excerpts, beyond what the user expected.

Ssd 1

Medium

• Confidence: 96% confidence
• Finding: The skill forwards untrusted literature text into the model context without labeling it as untrusted data or instructing the model to ignore any embedded instructions contained in abstracts, conclusions, or titles. This creates a prompt-injection surface where malicious or malformed document text can steer the model to ignore the intended task, manipulate outputs, or reveal more input content than necessary.

VirusTotal

57/57 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/run.py:255