unisound-med-mental-health

• Outcome: Pass
• Latest audit: Jul 16, 2026 · 6:43 AM UTC
• Version: 1.0.2

Overview

This skill is a disclosed command-line wrapper that sends mental-health questions to a configured medical LLM API; users should only use it with data they are allowed to share there.

Before installing, confirm that users and operators understand that questions may be sent to the configured LLM API, avoid entering identifiable patient or crisis information unless approved by your process, and restrict --api-url and --output to trusted destinations.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill documentation describes file I/O and outbound network use, but no corresponding permissions are declared. This can cause the skill to be deployed with capabilities that operators and policy systems cannot accurately review, increasing the chance of unintended data access or exfiltration, especially because the skill handles potentially sensitive mental-health prompts.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The skill is presented as a mental-health consultation/Q&A capability, but the documentation omits or downplays that actual processing depends on sending user questions to an external API using an appkey. In this context, prompts may contain highly sensitive personal or health information, so undisclosed third-party transmission materially changes the security and privacy risk profile.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill presents itself as a standalone mental-health consultation/education tool, but it actually transmits sensitive user questions to a remote LLM service. In this context, questions may contain highly sensitive mental-health disclosures or crisis information, so undisclosed remote processing creates a real privacy and trust risk even if the network call is functionally expected by the implementation.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: Allowing callers to override --api-url turns the skill into a generic exfiltration/forwarding client for sensitive mental-health content. Because the skill handles especially private medical-style conversations, sending prompts to arbitrary endpoints materially increases the risk of credential misuse, unauthorized data collection, and redirection to untrusted infrastructure.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The code sends user-provided questions to a remote API with no user-facing notice, consent prompt, or privacy disclosure in the execution path. In a mental-health skill, users may reveal diagnoses, trauma, self-harm ideation, or other sensitive personal data, so silent transmission meaningfully increases privacy and compliance risk.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.