Security audit

unisound-med-record-qc

Security checks for vulnerabilities and agentic risk

Overview

This medical quality-control skill is coherent, but needs review because it can send medical text and an API key to any configured model endpoint without enforced privacy or destination controls.

Install only in an environment where operators understand that submitted medical records may leave the local machine. Use a trusted HTTPS endpoint, avoid overriding --api-url unless the endpoint and credential scope are approved, de-identify real patient data first, and treat the app key as sensitive.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/run.py:102
Finding: Unrestricted API Endpoint Can Exfiltrate Credentials and Sensitive Medical Data
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill documents capabilities that imply file read, file write, and network access, but it does not declare any tool scope or permission boundaries in the manifest. That creates an avoidable least-privilege gap: integrators and reviewers cannot easily tell what the skill is expected to access, increasing the risk of overbroad execution in environments where tools are granted implicitly.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The natural-language content of the skill, including the description, usage, parameters, and compliance notes, is exclusively in Chinese. Under the policy, forcing a specific language without user opt-in or a documented justified locale constraint is a language/locale policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The system prompt is written as a fixed Chinese-language instruction set and does not indicate that users may choose another language or locale. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script sends raw question content to an external HTTPS API, and the skill is explicitly designed for medical records and imaging-report quality control, so inputs are likely to contain protected health information or other sensitive clinical data. There is no built-in notice, consent gate, redaction step, or locality control before transmission, which makes unintended privacy, compliance, and data-governance violations materially likely in this context.
Content: No source excerpt is available for this finding.