unisound-surgery-review

• Outcome: Review
• Latest audit: Jul 16, 2026 · 2:45 AM UTC
• Version: 1.0.2

Overview

The skill is a disclosed medical coding reviewer, but it can send sensitive medical record text to configurable external services and optionally save prepared records locally.

Review this skill carefully before installing in any healthcare or production environment. Use it only with approved rule and LLM endpoints, disable LLM mode when external processing is not allowed, de-identify records before input, avoid --save-prepared for real patient data, and prefer secret-manager or environment-based credential handling over passing appkeys on the command line.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Tainted flow: 'req' from os.getenv (line 270, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers={"Content-Type": "application/json", **{key: value for key, value in headers.items() if value}},
            method="POST",
        )
        opener = request.urlopen(req) if not self._settings.timeout else request.urlopen(req, timeout=self._settings.timeout)
        with opener as response:
            response_payload = json.loads(response.read().decode("utf-8"))
        choices = response_payload.get("choices") or []

• Confidence: 95% confidence
• Finding: opener = request.urlopen(req) if not self._settings.timeout else request.urlopen(req, timeout=self._settings.timeout)

Tainted flow: 'req' from os.getenv (line 270, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Authorization"] = f"Bearer {self._settings.api_key}"
        req = request.Request(url=url, headers=headers, method="GET")
        try:
            with request.urlopen(req, timeout=self._settings.timeout) as response:
                return json.loads(response.read().decode("utf-8"))
        except error.HTTPError as exc:
            if exc.code == 404:

• Confidence: 89% confidence
• Finding: with request.urlopen(req, timeout=self._settings.timeout) as response:

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill advertises and relies on capabilities including environment-variable access, file read/write, and outbound network access, but does not declare permissions. This creates a trust and review gap: operators may approve or run the skill without understanding that it can access sensitive inputs, persist prepared records, and send medical data plus credentials to external services.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The skill description suggests structured local review, but the implementation performs external HTTP calls for guideline retrieval and later sends case content to an LLM. In the context of surgical coding review, the transmitted data can contain highly sensitive medical records, making undisclosed off-box processing especially dangerous.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The payload/CLI allows a caller to specify an arbitrary LLM base URL, and the code then sends prompts built from medical record documents to that endpoint. This is a direct SSRF/exfiltration-style capability in a PHI-processing skill and materially increases risk because an untrusted caller can route sensitive content to any server they control.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The optional --save-prepared path writes preprocessed medical record text to disk, and this prepared text is assembled from full case documents that may contain highly sensitive PHI. In a medical coding review skill, this materially increases privacy risk because debug artifacts can persist on shared hosts, backups, or developer machines without access controls or retention limits.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Passing the bearer appkey on the command line exposes the credential to process listings, shell history, job logs, and orchestration metadata on multi-user systems. In this skill, the key grants access to an internal medical LLM service, so leakage could enable unauthorized access to sensitive workloads or downstream medical data.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The code performs external HTTP requests in a medical processing workflow without any visible disclosure, consent, or indication to the caller that data may leave the local environment. In healthcare contexts this can violate privacy expectations and operational policy even when the destination is legitimate.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The prompt builder embeds evidence document contents directly into the LLM request, including excerpts from surgical records, discharge summaries, and other medical documents. Sending this raw content to an external endpoint without explicit warning or minimization exposes PHI and clinical narrative data, which is especially severe in a medical-review skill.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.