T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/run.py:99- Finding
Unrestricted API Endpoint Can Receive Bearer Credentials and Sensitive Medical Data
- Content
View full analysis
- Remediation
View remediation
Security audit
unisound-med-health-consult
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent medical Q&A tool, but it can send sensitive health questions and a bearer API key to any configured API endpoint without strong guardrails.
Review this carefully before installing for real patient or regulated health data. Use only de-identified questions, avoid passing secrets through shell history when possible, and do not set --api-url to an untrusted or plaintext endpoint because it will receive both the prompt and bearer credential.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill declares no explicit tool scope or permissions even though its documented behavior and associated code capabilities include file read, file write, and network access. In a medical-consultation context, unrestricted file and network access increases the risk of unintended exposure of sensitive health data, misuse of credentials, or execution outside the intended task boundaries.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The natural-language content of the skill forces a single language/locale experience for users, and the document does not indicate that this is optional or limited to a Chinese-language deployment context. Under the policy, language constraints should be opt-in or explicitly justified when region-specific.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The base system prompt is written to direct the model entirely in Chinese, and the surrounding interface/help text is also Chinese-only. There is no opt-in, language selection mechanism, or documented justification that this skill is restricted to a Chinese-speaking or region-specific context.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script sends user-supplied medical questions directly to a remote API endpoint using an authorization key, but its CLI interface does not clearly warn that potentially sensitive health data will leave the local environment. In a medical-consultation skill, this is especially risky because prompts may contain personal health information, symptoms, medications, or test results, creating privacy, compliance, and data-handling exposure if users assume processing is local.
- Content