unisound-pe-missing-positive

• Outcome: Pass
• Latest audit: Jul 16, 2026 · 7:57 AM UTC
• Version: 1.0.2

Overview

This skill is a disclosed medical-record quality-control tool that sends selected record fields to a configured medical LLM and writes results locally, with privacy caveats users should manage.

Install only if you are allowed to send de-identified clinical text to the configured HiVoice MaaS or approved compatible endpoint. Do not pass raw identifiable patient records, treat the appkey as a secret, review any custom --base URL, and avoid --save-prepared unless local plaintext clinical text is acceptable and retained securely.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill advertises no declared permissions, yet its documented behavior includes reading local files, writing output files, and sending medical-record content over the network to a remote API. This creates a real capability-transparency and data-governance issue: users or platforms may authorize the skill under false assumptions, which is especially dangerous because the processed data is clinical text and may contain sensitive health information.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence
• Finding: The documented purpose suggests a narrowly scoped internal medical QC tool, but the skill behavior is broader and materially different: it preprocesses many file types, sends data to a configurable remote endpoint, and only covers limited diagnosis scenarios rather than the implied general rule. This mismatch can mislead operators about where data goes, what inputs are accepted, and how complete the QC logic is, resulting in privacy exposure and unsafe reliance on incomplete outputs.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The code sends outpatient medical record content, including physical exam and diagnosis fields, to a third-party LLM endpoint over the network without any explicit consent flow, warning, or data-minimization safeguard. Because this is clinical data and likely contains sensitive personal health information, undisclosed external transmission creates a real confidentiality and compliance risk even if the transport is HTTPS.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: This code constructs an authenticated external LLM client using an appkey and sends data to a remote API, but there is no disclosure in the execution path that credentials are being used to access a third-party service or that record content will leave the local environment. In a medical-record quality-control skill, hidden outbound use of credentials and patient data increases operational and privacy risk, especially in regulated environments.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: When --save-prepared is used, the script writes preprocessed medical-record text to disk in plaintext, which can expose sensitive patient data to local users, backups, logs, or other processes. In an EMR quality-control skill, this is especially risky because the content is likely to contain regulated health information and the save path is not accompanied by a clear privacy warning or protective controls.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The script transmits extracted medical-record text to an LLM service via run_qc without any explicit disclosure, confirmation step, or visible minimization of sensitive data. Because the input is outpatient medical documentation, this can expose highly sensitive health information to a remote service, creating privacy, compliance, and data-governance risk if the endpoint, logging, or retention settings are misconfigured.

VirusTotal

62/62 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.