ClawHub
Back to skill

Security audit

unisound-operation-record

Security checks across malware telemetry and agentic risk

Overview

This skill appears purpose-built for surgical-record generation, but it handles highly sensitive medical text with a remote model and has inconsistent local-storage disclosures.

Install only if you are authorized to send the relevant clinical text to the configured Hivoice medical model endpoint. De-identify records before use, avoid `--save-prepared` unless you intentionally want a local copy of prepared clinical text, and treat `--output` files as sensitive medical records.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill advertises and operationalizes file reads, optional file writes, and outbound network access to an internal medical model API, yet declares no explicit permissions. This creates a transparency and policy-enforcement gap: operators may approve or run the skill without understanding that it can exfiltrate sensitive medical text over the network and persist derived data to disk.

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The documentation promises no local persistence and destruction after the call, but elsewhere exposes --output-json, --output, and --save-prepared options that can write input-derived medical content to disk. In a healthcare context, this inconsistency is dangerous because users may rely on the privacy claim while unintentionally storing highly sensitive patient data or de-identified-but-still-sensitive surgical records locally.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The script sends raw medical-record-derived prompt content to a remote HTTPS API endpoint, but provides no explicit consent flow, warning, redaction step, or policy gate before transmitting likely sensitive health data. In a medical context, this is especially dangerous because the input can contain highly sensitive PHI/PII, and users may reasonably assume local processing from the skill description unless disclosure is made clear.

Ssd 1

Medium
Confidence
93% confidence
Finding
If the input JSON includes a raw prompt field, the code returns it directly and skips the fixed medical-record instruction scaffold entirely. That allows untrusted input to override task constraints, enabling prompt injection against the downstream model and potentially causing disclosure, unsafe transformations, or generation outside the intended medical-record-only workflow.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.