medical-qa

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:24 PM UTC
• Version:
  1.0.2

Overview

This medical Q&A skill is coherent and disclosed, but users should avoid sending unnecessary personal health identifiers to its external API.

Use this skill for general medical information only. Do not include names, ID numbers, contact details, full records, or other unnecessary identifiers in questions, and seek qualified medical care for diagnosis, prescriptions, severe symptoms, emergencies, or treatment decisions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The trigger description is broad enough to capture many ordinary health-related questions, causing the skill to activate in ambiguous situations without clear boundaries. In a medical context, over-triggering is riskier because users may receive authoritative-seeming guidance in place of safer general routing or escalation, especially for urgent symptoms.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill sends user-supplied medical questions to a third-party remote service, which may include highly sensitive health information. There is no visible consent, disclosure, minimization, or anonymization in the code, so users may unknowingly transmit protected or private medical data off-platform.

VirusTotal

65/65 vendors flagged this skill as clean.