Security audit

unisound-missing-tumor-name

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed medical-record quality check tool, but users should handle it as sensitive because it sends record fields to an external LLM endpoint.

Use this only with records that have already been de-identified, confirm the configured LLM endpoint is acceptable for your privacy and compliance requirements, keep the appkey out of repositories and logs, and avoid --save-prepared unless you are prepared to store sensitive preprocessed record text locally.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: This is a mismatch because, although the primary QC rule matches the declared description, the code does more than the description states. It is not limited to a supplied text string; via run.py it can ingest and preprocess multiple document formats before QC. More importantly, the description says it calls an 'internal medical LLM', but the implementation uses a configurable OpenAI-compatible HTTP endpoint with a default URL of https://maas-api.hivoice.cn/v1, which is an external network service rather than something clearly internal. These are material undeclared behaviors/resources under the evaluation criteria.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: The markdown specifies input as outpatient records with Chinese field labels and defines output terms only as Chinese strings such as `无缺陷` and `有缺陷`. This imposes a language/locale requirement, but the file does not offer an opt-in choice or explain why the restriction is required for a region-specific workflow.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: User-facing descriptions and help text are entirely in Chinese, with no indication that another language is supported or that the user can choose their preferred language. This is a natural-language policy concern because the skill effectively imposes a locale on all users without opt-in or documented justification in this file.

Missing User Warnings

High

Confidence: 97% confidence
Finding: This code sends the patient's 现病史 and 既往史 fields to a remote HTTPS endpoint via the LLM caller, which is a privacy-sensitive network operation involving medical data. While the module docstring names the service endpoint, there is no explicit warning, consent, or disclosure to the user at the point where sensitive record data is transmitted.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The function accepts an appkey and uses it as a Bearer token for outbound API calls, which is sensitive credential handling. There is no comment, prompt, or user-facing disclosure explaining that the skill requires and will use an API credential to contact a third-party service.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: When --save-prepared is used, the script saves preprocessed record_text to a local .prepared.txt file, which likely contains sensitive medical content. Although the flag name suggests saving, there is no explicit warning in the user-facing help or runtime message that this action writes potentially sensitive patient data to disk.

Missing User Warnings

High

Confidence: 93% confidence
Finding: The CLI description says the tool preprocesses records and calls a medical large model, and run_qc is invoked with the full record_text and network-related parameters such as appkey, base, model, and timeout. However, there is no explicit disclosure in argument help or runtime output that potentially sensitive patient data will be transmitted to a remote service.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.