unisound-today-rehab-task

• Outcome: Review
• Latest audit: Jul 16, 2026 · 8:39 PM UTC
• Version: 1.0.2

Overview

The skill is not clearly malicious, but it handles medical rehab data, forces remote model processing, and supports broad document parsing without enough user control or privacy scoping.

Review before installing in any real patient or regulated healthcare setting. Use only if users understand that rehab task details may be sent to the configured remote medical-model API, and avoid untrusted PDFs, Office files, or images unless document parsing is sandboxed and approved.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if not office_bin:
        raise PreprocessError("libreoffice/soffice not found for office document conversion.")
    with tempfile.TemporaryDirectory(prefix="med-skill-preprocess-") as tmp_dir:
        proc = subprocess.run(
            [office_bin, "--headless", "--convert-to", "txt:Text", "--outdir", tmp_dir, str(path)],
            stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, check=False,
        )

• Confidence: 80% confidence
• Finding: proc = subprocess.run( [office_bin, "--headless", "--convert-to", "txt:Text", "--outdir", tmp_dir, str(path)], stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if not office_bin:
        raise PreprocessError("libreoffice/soffice not found for xls conversion.")
    with tempfile.TemporaryDirectory(prefix="med-skill-preprocess-") as tmp_dir:
        proc = subprocess.run(
            [office_bin, "--headless",
             "--convert-to", "csv:Text - txt - csv (StarCalc):44,34,76,1",
             "--outdir", tmp_dir, str(path)],

• Confidence: 81% confidence
• Finding: proc = subprocess.run( [office_bin, "--headless", "--convert-to", "csv:Text - txt - csv (StarCalc):44,34,76,1", "--outdir", tmp_dir, str(path)],

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

pass
    pdf_to_text = shutil_which("pdftotext")
    if pdf_to_text:
        proc = subprocess.run(
            [pdf_to_text, "-layout", str(path), "-"],
            stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, check=False,
        )

• Confidence: 71% confidence
• Finding: proc = subprocess.run( [pdf_to_text, "-layout", str(path), "-"], stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, check=False, )

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill advertises no declared permissions, yet its documented behavior includes file read/write, shelling out to external tools, environment/app key usage, and network access. This creates a transparency and policy-enforcement gap: reviewers and users may approve the skill as low-privilege while it actually handles sensitive medical inputs and can transmit or transform them using higher-risk capabilities.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared purpose is a narrow rehab-task skill, but the documented behavior expands into generic document ingestion, OCR, spreadsheet parsing, and remote model submission. In a medical context, this mismatch is dangerous because users may supply protected health information believing the skill only performs local scheduling, while it actually parses broad document types and sends content to an external service.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The file implements broad document ingestion, OCR, office conversion, and table extraction that does not align with a rehab daily-task skill. This capability mismatch is dangerous because it unnecessarily broadens the skill's attack surface and may enable unintended handling of sensitive patient documents far beyond the declared feature scope.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: Document conversion, OCR, and multiple subprocess-backed parsers are unjustified for a rehab daily-task feature and introduce avoidable risk. In this skill context, these capabilities make the code more dangerous because they handle arbitrary complex file formats unrelated to scheduling or task tracking.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The skill transmits rehab plan identifiers and detailed patient task/status data to an external LLM endpoint for formatting, which creates a real privacy and data-governance risk. In a medical context, even seemingly routine task/status data can reveal treatment, recovery progress, and other health-related information, making external disclosure especially sensitive.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill states that it 'forces API inference' against an internal medical model endpoint but does not present a clear upfront warning that user input may be transmitted off-box for processing. Because this skill handles rehabilitation and potentially patient data, the lack of prominent disclosure undermines informed consent and can lead to unintended exposure of sensitive medical information.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The code sends sensitive medical task and plan data to an external API without any user-facing notice, consent flow, or visible privacy safeguard. In a patient rehabilitation skill, undisclosed off-platform transmission can violate confidentiality expectations and may breach healthcare compliance obligations if deployed in regulated environments.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/run.py:209