unisound-rehab-plan-view

• Outcome: Review
• Latest audit: Jul 16, 2026 · 9:46 PM UTC
• Version: 1.0.2

Overview

This skill should be reviewed because it sends potentially sensitive rehabilitation-plan data to a remote medical model and accepts broad document inputs that invoke native converters.

Install only if you are comfortable sending rehabilitation-plan content to the listed remote medical-model API and your organization has approved that endpoint for medical data. Prefer JSON input when possible, avoid untrusted office/PDF/image files unless conversion is sandboxed, and treat command-line appkeys as sensitive.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if not office_bin:
        raise PreprocessError("libreoffice/soffice not found for office document conversion.")
    with tempfile.TemporaryDirectory(prefix="med-skill-preprocess-") as tmp_dir:
        proc = subprocess.run(
            [office_bin, "--headless", "--convert-to", "txt:Text", "--outdir", tmp_dir, str(path)],
            stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, check=False,
        )

• Confidence: 81% confidence
• Finding: proc = subprocess.run( [office_bin, "--headless", "--convert-to", "txt:Text", "--outdir", tmp_dir, str(path)], stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if not office_bin:
        raise PreprocessError("libreoffice/soffice not found for xls conversion.")
    with tempfile.TemporaryDirectory(prefix="med-skill-preprocess-") as tmp_dir:
        proc = subprocess.run(
            [office_bin, "--headless",
             "--convert-to", "csv:Text - txt - csv (StarCalc):44,34,76,1",
             "--outdir", tmp_dir, str(path)],

• Confidence: 82% confidence
• Finding: proc = subprocess.run( [office_bin, "--headless", "--convert-to", "csv:Text - txt - csv (StarCalc):44,34,76,1", "--outdir", tmp_dir, str(path)],

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

pass
    pdf_to_text = shutil_which("pdftotext")
    if pdf_to_text:
        proc = subprocess.run(
            [pdf_to_text, "-layout", str(path), "-"],
            stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, check=False,
        )

• Confidence: 74% confidence
• Finding: proc = subprocess.run( [pdf_to_text, "-layout", str(path), "-"], stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, check=False, )

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill declares itself as a simple rehabilitation-plan viewer, but the documentation indicates capabilities that imply file read/write, shell/tool invocation, environment use, and network access without any explicit permission declaration or scoping. In a medical context, these hidden capabilities increase the chance of over-broad access to sensitive patient data and make security review and runtime enforcement harder.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared purpose is a viewing-only rehab-plan skill, but the spec expands into broad document ingestion, OCR, file conversion, and remote LLM submission. That mismatch is dangerous because users and reviewers may trust it with sensitive medical data under a narrow description, while the actual behavior sends data off-device and exercises a much larger attack surface through parsers and external tools.

Description-Behavior Mismatch

High

• Confidence: 88% confidence
• Finding: The file implements a broad multi-format ingestion and conversion pipeline that does not align with a patient rehab-plan viewing skill. This scope mismatch increases attack surface substantially by introducing parsers, OCR, and office/PDF converters unrelated to the stated capability, which is risky in a medical context handling potentially sensitive data.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill invokes OCR and office/PDF conversion executables without clear justification from the stated rehab-plan viewer purpose. Unnecessary native-tool invocation broadens the attack surface and can expose patient documents to risky parsing behavior and unexpected processing paths.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: This skill processes postoperative rehabilitation plan data, which may contain sensitive medical information, and sends it to an external LLM API for interpretation. For a patient-facing 'viewer' skill, this is a material data-flow expansion beyond local display, and the code provides no minimization, consent gate, redaction, or assurance that the external endpoint is approved for handling health data.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill requires an external API key and makes outbound network calls even though its stated purpose is simply to let patients view a rehab plan. That mismatch increases attack surface and privacy risk, especially in a medical context where users may not expect remote processing of their care data.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The markdown states that rehabilitation-plan content is sent to a remote medical model API, but it does not present a clear user-facing warning about data transfer, privacy handling, retention, or consent. Because the data can include protected health information, silent transmission to a remote endpoint creates privacy, compliance, and trust risks even if the endpoint is internal.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code transmits rehab-plan fields to an external API without any visible user-facing disclosure, consent flow, or warning in the execution path. In a healthcare setting, silent export of plan contents can violate user expectations and organizational privacy requirements, even if the transfer is over HTTPS.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/run.py:193