Security audit

unisound-medication-record-management

Security checks across malware telemetry and agentic risk

Overview

The skill appears intended for medication record management, but it needs review because it sends sensitive medication data to a remote model and performs broader document parsing and medical-risk prompting than its framing fully discloses.

Review before installing. Use this only if users understand that medication records and notes may be sent to the listed remote API, avoid uploading full medical documents unless necessary, prefer minimal JSON/CSV inputs, and do not rely on the model output for medication changes or drug-interaction decisions.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill advertises only metadata and usage instructions, but the documented execution path clearly requires file reading, file writing, shell-accessed external tools, environment/appkey handling, and outbound network access. In a medical-records context, undeclared capabilities are dangerous because they expand the trust boundary without explicit user consent and enable sensitive health data exfiltration or unsafe document processing.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The stated purpose is medication record management, but the documented behavior includes broad document ingestion, OCR/text extraction, and transmission of medication data to a remote model for generated analysis/reminders. This mismatch is risky because users may provide highly sensitive medical files believing the skill only performs local record management, while the skill actually performs much broader processing and remote disclosure.

Context-Inappropriate Capability

Medium

Confidence: 80% confidence
Finding: The skill executes external document-conversion binaries on potentially untrusted inputs, which materially increases attack surface beyond the stated medication-record function. Even without shell injection, office/PDF/OCR tools have a long history of parser vulnerabilities, so this can expose the host to denial of service or code execution if run in a privileged or unsandboxed environment.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The code searches PATH and executes the first matching binary, making runtime behavior depend on the host environment. In compromised or weakly controlled environments, an attacker who can influence PATH or place a rogue executable earlier in PATH could cause arbitrary code execution under the skill's privileges.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The code serializes full medication records, including drug names, doses, dates, status, and notes, into a prompt and sends them to an external LLM API. In a patient-medication management skill, this is sensitive health data, so transmitting it off-device without clear minimization, consent, or privacy controls creates a real confidentiality and compliance risk.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The skill declares a remote chat-completions endpoint and model for functionality that is primarily record organization and summarization, which could largely be handled locally. Introducing network exfiltration capability into a health-record management tool expands the attack surface and creates unnecessary exposure of patient data to an external service.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill states that it must call a remote medical model API and requires an appkey, but it does not warn users that medication records and possibly associated health details will be transmitted off-device/off-platform. In a healthcare context this is especially sensitive, as medication histories can reveal diagnoses, chronic conditions, and other protected personal information.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill supports parsing PDFs, Office files, spreadsheets, text files, and images with OCR, but it does not warn that uploaded documents may contain additional sensitive content beyond medication data. This creates privacy and security risk because users may unknowingly expose full medical records, identifiers, or unrelated personal data during extraction and subsequent processing.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: Sensitive medication data is sent to an external API, but the code contains no user-facing disclosure, warning, or consent step before transmission. For health data, silent transfer to a third party is especially dangerous because users may reasonably expect local-only record management and may not understand where their data is processed.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/run.py:217