ClawHub
Back to skill

Security audit

unisound-referral-guidance

Security checks across malware telemetry and agentic risk

Overview

This medical referral skill is purpose-aligned, but needs Review because it sends patient summaries to a remote LLM while promising de-identification that the code does not perform.

Review before installing. Use only with patient summaries that have already been de-identified, verify that the remote LLM endpoint and app key handling meet your privacy and medical compliance requirements, and be aware that optional output files may contain sensitive medical content.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The manifest says the skill takes a patient condition summary and returns referral guidance, which suggests decision-support logic but does not mention sending the case data to a remote API. In code, the case summary is embedded in the prompt and posted to an external HTTPS endpoint, which is a materially broader operational behavior for a medical-guidance skill handling potentially sensitive patient information.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The description and the rest of the markdown specify the skill entirely in Chinese and require output as 'JSON + 自然语言摘要', with no indication that users may choose another language. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The code sends the full patient case summary to an HTTP-based external service via the LLM caller, which may include sensitive medical data. Although the module docstring mentions use of an internal medical model, the CLI/user-facing flow does not clearly warn the operator that patient information will be transmitted off the local machine.

Natural-Language Policy Violations

Low
Confidence
86% confidence
Finding
Natural-language instructions, prompts, CLI descriptions, and expected outputs are entirely Chinese, and the skill does not provide any user opt-in or alternative language handling. This can violate language/locale policy where skills must not force a specific language without user choice unless the restriction is explicitly justified.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.