ClawHub
Back to skill

Security audit

unisound-primary-diagnosis-surgery-selection

Security checks across malware telemetry and agentic risk

Overview

This medical skill is purpose-aligned, but it can send patient-record text to a remote LLM and optionally write prepared record text locally, so it needs review before use.

Install only in an approved medical-data environment. De-identify patient records before use, confirm the --base endpoint is trusted and HTTPS, protect the appkey, and avoid --save-prepared or output files unless local storage permissions, retention, and access controls are appropriate.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Tainted flow: 'req' from pathlib.Path.read_text (line 201, file read) → urllib.request.urlopen (network output)

High
Category
Data Flow
Content
headers={"Content-Type": "application/json", **{key: value for key, value in headers.items() if value}},
    )
    try:
        opener = urllib.request.urlopen(req) if not timeout else urllib.request.urlopen(req, timeout=timeout)
        with opener as resp:
            body = resp.read().decode("utf-8", errors="replace")
            return json.loads(body)
Confidence
96% confidence
Finding
opener = urllib.request.urlopen(req) if not timeout else urllib.request.urlopen(req, timeout=timeout)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill declares no permissions, yet the specification explicitly describes capabilities to read local files, optionally write prepared text/output files, and make authenticated network requests to an internal medical model API. This mismatch can mislead operators and policy engines about the skill's real access, increasing the chance that sensitive medical data is processed or exfiltrated without appropriate review or least-privilege controls.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The code transmits patient record content to an LLM service but does not clearly warn the operator at runtime that protected health information may leave the local environment. In the healthcare context, lack of explicit disclosure and consent controls materially increases the chance of noncompliant handling of PHI and accidental privacy violations.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The --save-prepared option writes preprocessed patient text to disk, potentially including sensitive medical details, without a strong sensitivity warning or secure storage handling. In a healthcare workflow, this can leave PHI in local run directories, backups, or shared filesystems where retention and access controls may be inadequate.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.