ClawHub
Back to skill

Security audit

unisound-recheck-reminder

Security checks across malware telemetry and agentic risk

Overview

This skill has a clear medical reminder purpose, but it sends potentially identifiable health exam reports to a remote LLM while claiming de-identification that the code does not perform.

Review before installing if reports may contain names, IDs, phone numbers, dates, or other health information. Use only with reports that have already been de-identified, confirm the LLM endpoint and app key provider are approved for medical data, and avoid relying on the stated de-identification claim unless the code is changed to enforce it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The description specifies outputs such as '面向受检者的复查提醒' in Chinese, and the document consistently defines the skill's interaction/output language as Chinese without any opt-in or alternative language option. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the locale constraint is clearly justified.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The code sends the full exam report text to an HTTP-based LLM via `llm([sys_msg(...), user_msg(prompt)])`, which includes potentially sensitive medical data. Although the module docstring mentions use of an internal medical model, the runtime flow provides no explicit user disclosure or confirmation before transmitting personal health information.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.