unisound-rehab-progress-tracking

• Outcome: Review
• Latest audit: Jul 16, 2026 · 8:30 AM UTC
• Version: 1.0.2

Overview

The skill is mostly coherent for rehab progress tracking, but it sends sensitive patient rehabilitation data to a remote medical model and provides patient-facing medical-style analysis without enough consent, privacy, or clinical-scope controls.

Review before installing in any patient-facing or clinical setting. Use it only where users are clearly told that rehabilitation data is sent to the hivoice medical model API, appropriate consent and data-processing terms are in place, and document conversion runs in a controlled environment.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill documentation describes capabilities that imply file access, shell/tool execution, environment use, and outbound network access, but it does not declare permissions or present any least-privilege boundary. In a medical skill that may process patient rehabilitation records, this increases the risk of overbroad execution and unnoticed data handling, especially when external tools and a remote API are involved.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The skill is framed as rehabilitation progress visualization, but the output contract expands into LLM-generated medical interpretation, analysis, and reminders rendered directly to the patient. That scope creep can cause users to rely on generated clinical-like guidance despite the stated boundary, creating safety and compliance risk in a healthcare context.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The documentation says the skill does not judge treatment effect or replace clinician assessment, but elsewhere it promises generated analysis and interpretation. This contradiction is dangerous because it weakens safety boundaries and can mislead implementers or patients into treating the model output as medical judgment.

Description-Behavior Mismatch

High

• Confidence: 92% confidence
• Finding: The file implements a broad document-ingestion pipeline unrelated to the stated rehab-progress visualization purpose, creating unnecessary capability to parse many file types and invoke external tooling. This mismatch increases the attack surface of the skill and may enable processing of sensitive or malicious documents without a clear business need.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill invokes LibreOffice, pdftotext, and Tesseract on user-supplied files, which materially expands the trusted computing base and exposes the system to parser/OCR vulnerabilities in external binaries. In the context of a patient rehab skill, this capability is not clearly justified and is more dangerous because it processes potentially untrusted medical uploads while increasing the chance of compromise or data exposure.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The code sends rehabilitation task details, pain scores, functional assessments, and phase progress to a remote API for analysis. In a patient-facing medical context, this is sensitive health data disclosure to a third party, and the skill gives no indication of minimization, consent flow, de-identification, or data processing safeguards.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The imported network client functionality enables outbound transmission to an external inference service even though the skill is described primarily as progress tracking and visualization. That mismatch increases the risk of unexpected data exfiltration, especially because users may reasonably assume purely local processing for such a feature.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly sends rehabilitation data to a remote medical model API but does not provide a clear user-facing warning, consent flow, or data-handling notice for potentially sensitive health information. Because the inputs may include patient progress, pain scores, and functional assessments, silent transmission to an external endpoint creates material privacy, compliance, and trust risks.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The request body includes medically sensitive patient progress data and transmits it to an external API without any user-facing warning, consent mechanism, or disclosure in the script. In a rehabilitation setting, this can expose health information and create compliance, privacy, and trust risks if users are unaware their data leaves the local environment.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/run.py:228