unisound-surgery-sufficiency-review

• Outcome: Review
• Latest audit: Jul 16, 2026 · 6:12 AM UTC
• Version: 1.0.2

Overview

This medical-record review skill is coherent, but it needs careful review because it sends sensitive case evidence to configured network services and can save prepared record text locally.

Install only in an environment authorized to process medical records with the configured guideline API and LLM endpoint. Prefer de-identified inputs, avoid overriding --base except to an approved endpoint, and do not use --save-prepared or output paths for PHI unless retention and file access are controlled.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Tainted flow: 'req' from os.getenv (line 525, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers={"Content-Type": "application/json", **{key: value for key, value in headers.items() if value}},
            method="POST",
        )
        opener = request.urlopen(req) if not self._settings.timeout else request.urlopen(req, timeout=self._settings.timeout)
        with opener as response:
            response_payload = json.loads(response.read().decode("utf-8"))
        choices = response_payload.get("choices") or []

• Confidence: 98% confidence
• Finding: The LLM HTTP request uses caller-controlled configuration (`base`, `appkey`, `model`, and prompt content built from medical record documents) and sends case evidence to a remote endpoint with `urlopen`. In this skill context, that means sensitive patient record content can be exfiltrated to arbitrary external infrastructure, especially because `base` is accepted from input and no allowlist, consent gate, or redaction is enforced.

Tainted flow: 'req' from os.getenv (line 525, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Authorization"] = f"Bearer {self._settings.api_key}"
        req = request.Request(url=url, headers=headers, method="GET")
        try:
            with request.urlopen(req, timeout=self._settings.timeout) as response:
                return json.loads(response.read().decode("utf-8"))
        except error.HTTPError as exc:
            if exc.code == 404:

• Confidence: 79% confidence
• Finding: This code performs a network GET to a guideline API endpoint derived from environment configuration. While the request itself does not appear to send full patient documents, it still relies on externally supplied endpoint settings and can disclose queried surgery codes/scope or route data to an untrusted service if the environment is misconfigured.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill documentation describes capabilities to read environment variables, read and write local files, and access external network services, yet it declares no permissions. This creates a permission-transparency gap: operators may approve or run the skill without understanding that it can access sensitive medical records, API keys, or write prepared records to disk, increasing the risk of data leakage or policy bypass.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The skill constructs a prompt containing medical record evidence text and sends it to an external LLM chat completion endpoint. For a medical-review skill, this materially expands data exposure beyond local structured review and creates significant privacy/compliance risk because highly sensitive clinical text is transmitted off-box without visible user disclosure or technical minimization.

Context-Inappropriate Capability

High

• Confidence: 100% confidence
• Finding: The skill accepts a caller-supplied `base` URL for the LLM service and then uses it to send prompts containing case evidence. This creates a straightforward exfiltration primitive: any caller can direct sensitive medical content to attacker-controlled infrastructure under the guise of normal review processing.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script can persist fully prepared medical-record text to disk via `--save-prepared`, and the output includes highly sensitive clinical content. In a healthcare review skill, writing normalized records to local files increases the risk of PHI leakage through shared workspaces, backups, logs, weak filesystem permissions, or accidental retention, especially because the flag is framed as a debugging convenience rather than a strong sensitivity warning.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: At this entry point the skill enables LLM use by default and passes record-derived evidence into downstream review logic, yet there is no user-facing warning, consent, or disclosure that patient record content may be transmitted to external services. In a healthcare context, silent transmission of medical text is especially dangerous due to privacy, contractual, and regulatory obligations.

Static analysis

No suspicious patterns detected.