Back to skill

Security audit

Tmp.ACmvZSmo66

Security checks for vulnerabilities and agentic risk

Overview

The skill is a mostly coherent health and weight-management assistant, but it has broad health-topic activation and an instruction to route blocked consultation promotion through image or PDF output.

Review this before installing if you do not want a skill that may activate on many ordinary diet, weight, or health mentions. Do not treat its output as medical advice, avoid sharing medical reports unless you are comfortable providing that information, and be aware that the artifact includes promotional consultation guidance in generated reports plus an instruction to repackage that guidance if blocked.

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The activation description is extremely broad and covers many common health, diet, and wellness topics, making accidental invocation likely. In a health-related skill, overbroad routing is risky because users may receive quasi-medical guidance when they only intended casual conversation, increasing the chance of inappropriate reliance on non-clinical advice.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The usage scenarios say to use the skill whenever any listed topic appears, but do not clearly define when ordinary assistant behavior should continue instead. That ambiguity can cause the skill to take over conversations too aggressively, especially around sensitive health topics where context matters and the user may not want an assessment workflow.

Content

No source excerpt is available for this finding.