unisound-pmh-missing-bp-glucose

• Outcome: Pass
• Latest audit: Jul 16, 2026 · 7:56 AM UTC
• Version: 1.0.2

Overview

This skill performs a disclosed medical-record quality check by reading a user-selected record file, sending the relevant history text to a configured medical LLM endpoint, and saving the result locally.

Install only if you are authorized to process these records with the configured LLM service. De-identify patient data before use, keep the app key out of repositories, restrict --base to an approved endpoint, choose a secure output path, and avoid --save-prepared unless you intentionally want sensitive preprocessed text written to disk.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill documentation describes capabilities to read local files, optionally write output/preprocessed text, and send medical record content to an external MaaS endpoint, yet no explicit permissions are declared. This creates a real security and governance gap because operators may execute the skill without clear visibility into data access and network exfiltration behavior, which is especially sensitive in a medical-record processing context.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The fallback file-reading behavior allows the skill to ingest data from the local filesystem even though the advertised interface is text-based EMR analysis. In an agent setting, this broadens data access beyond user-provided input and could unintentionally expose local files containing sensitive medical data or other information if a path is supplied or influenced by upstream components.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill sends the '既往史' portion of outpatient medical records to an external LLM endpoint, which constitutes transmission of sensitive health information to a third party. In a medical context, this is especially dangerous because protected health data may leave the local trust boundary without explicit disclosure, minimization, consent handling, or visible safeguards in the implementation.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: When --save-prepared is used, the script writes the preprocessed medical record text directly to disk, which can expose sensitive PHI if the filesystem is shared, backed up, or accessed by unauthorized users. In a medical-record quality-control skill, even debug artifacts are highly sensitive, so optional plaintext persistence is a real confidentiality risk despite requiring an explicit flag.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script sends patient record text to an LLM service via run_qc using user-supplied or default base/model settings, but the interface does not present an explicit warning or consent flow about transmitting medical data off-process. In this healthcare context, silent transmission of PHI to an internal or potentially reconfigurable endpoint materially increases privacy, compliance, and data-governance risk.

Static analysis

No suspicious patterns detected.