unisound-target-screening

• Outcome: Review
• Latest audit: Jul 16, 2026 · 8:40 PM UTC
• Version: 1.0.2

Overview

The skill is a disclosed drug-target screening helper, but it sends user-provided screening data to a remote medical model and can optionally parse documents with local converter tools.

Install only if sending the disease, target list, evidence notes, and related references to the disclosed remote medical-model endpoint is acceptable for your data. Prefer JSON or trusted structured files when possible; avoid processing untrusted Office, PDF, or image files unless the runtime is appropriately isolated and converter tools are patched.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if not office_bin:
        raise PreprocessError("libreoffice/soffice not found for office document conversion.")
    with tempfile.TemporaryDirectory(prefix="med-skill-preprocess-") as tmp_dir:
        proc = subprocess.run(
            [office_bin, "--headless", "--convert-to", "txt:Text", "--outdir", tmp_dir, str(path)],
            stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, check=False,
        )

• Confidence: 72% confidence
• Finding: proc = subprocess.run( [office_bin, "--headless", "--convert-to", "txt:Text", "--outdir", tmp_dir, str(path)], stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if not office_bin:
        raise PreprocessError("libreoffice/soffice not found for xls conversion.")
    with tempfile.TemporaryDirectory(prefix="med-skill-preprocess-") as tmp_dir:
        proc = subprocess.run(
            [office_bin, "--headless",
             "--convert-to", "csv:Text - txt - csv (StarCalc):44,34,76,1",
             "--outdir", tmp_dir, str(path)],

• Confidence: 72% confidence
• Finding: proc = subprocess.run( [office_bin, "--headless", "--convert-to", "csv:Text - txt - csv (StarCalc):44,34,76,1", "--outdir", tmp_dir, str(path)],

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

pass
    pdf_to_text = shutil_which("pdftotext")
    if pdf_to_text:
        proc = subprocess.run(
            [pdf_to_text, "-layout", str(path), "-"],
            stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, check=False,
        )

• Confidence: 64% confidence
• Finding: proc = subprocess.run( [pdf_to_text, "-layout", str(path), "-"], stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, check=False, )

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill advertises capabilities that include file I/O, shelling out to external tools, environment access, and network access, but it does not declare permissions or narrowly constrain those operations. In a security review context, this weakens sandboxing and informed consent: users may supply sensitive biomedical documents believing they are only doing target screening, while the implementation path can read local files, invoke converters/OCR, and transmit content externally.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose is narrow drug-target screening referencing Open Targets concepts, but the described behavior expands into broad document ingestion, OCR/Office/PDF conversion, and mandatory transmission to an external chat-completions endpoint. This mismatch is dangerous because it can cause users to expose proprietary R&D datasets, internal reports, or regulated medical content to a third-party model service under misleading expectations about what the skill actually does and what evidence source it uses.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The file implements broad multi-format ingestion and extraction capabilities far beyond a narrowly scoped target-screening assistant. That scope expansion increases attack surface and creates unnecessary opportunities to process adversarial documents, images, and archives without a clear functional justification from the skill description.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill invokes local executables for office conversion, PDF extraction, and OCR, which materially increases capability and attack surface compared with the stated analytical purpose. If adversaries can supply files, these external parsers become an avenue for exploitation, environment probing, or resource abuse on the host running the skill.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code sends disease indications and candidate target data to a remote third-party LLM API via `_call_llm`, and the file itself provides no user-facing notice, consent flow, minimization, or confidentiality guardrails. In a pharmaceutical R&D context, these inputs may contain sensitive research strategy, proprietary target lists, or regulated health-related information, so undisclosed external transmission creates material confidentiality and compliance risk.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/run.py:271