ClawHub
Back to skill

Security audit

unisound-med-health-consult

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed medical-question CLI that sends user-provided prompts to a documented medical model endpoint, with no hidden persistence or unrelated behavior found.

Install only if you intend to send health consultation text to the documented or configured medical-model API. Do not include identifiable patient information unless your organization has approved that data flow, and use the dry-run mode to inspect parsed inputs before calling the model.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill documentation describes capabilities that require reading input files/stdin, writing output files, and making outbound network requests to a remote medical-model API, but no permissions are declared. This creates a transparency and policy-enforcement gap: integrators may deploy the skill without understanding that it can access local data and transmit health-related content externally, increasing the risk of unintended data exposure.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill sends raw user health questions and related metadata to a remote third-party API endpoint, but the CLI interface provides no explicit disclosure, consent flow, redaction step, or privacy warning. In a medical-consultation context, prompts may contain symptoms, diagnoses, medications, identifiers, or other sensitive health data, so silent transmission materially increases privacy and compliance risk.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.