Security audit

unisound-pe-hpi-inconsistent

Security checks across malware telemetry and agentic risk

Overview

This medical-record QC skill has sensitive but mostly disclosed behavior: it reads user-provided records, calls a named LLM endpoint, and writes results locally.

Install only if you are allowed to process these medical records with the configured HiVoice MaaS endpoint. De-identify records before use, protect the appkey, avoid --save-prepared unless needed, and store or delete output files according to your medical-data retention rules.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill documentation describes capabilities to read local files, write output files, and send medical record content to a remote API, but it does not declare permissions accordingly. This creates a transparency and governance gap: operators may approve or deploy the skill without understanding that it can access local data and exfiltrate processed content over the network, which is especially sensitive in a medical-record context.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The documentation claims 'no local persistence' and that data is destroyed after the call, yet elsewhere defines a default output path and an option to save preprocessed text to disk. In a healthcare workflow, this contradiction can cause users to handle protected medical data under false assumptions, leading to unintended retention of sensitive records on local storage.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The script reads outpatient medical records and passes them to run_qc along with a configurable base URL and model, which means sensitive health data is transmitted to an LLM service. In a medical context this is privacy-sensitive data, and this file provides no visible consent notice, minimization, destination validation, or guardrails against misconfiguration, increasing the risk of unauthorized disclosure or regulatory noncompliance.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The code sends raw outpatient medical record content, including HPI and physical exam details, to an external LLM endpoint by default. Because this is sensitive health data, transmitting it off-box without explicit notice, consent, minimization, or documented safeguards creates a real confidentiality and compliance risk, especially if the service is third-party hosted.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: When --save-prepared is used, the script writes the fully extracted medical record text to disk in plaintext. Because this skill processes outpatient EMR content, the prepared text is highly likely to contain sensitive personal and health information, so accidental retention, broad filesystem permissions, backup propagation, or collection by other tooling can cause a privacy breach.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.