Security audit

sleep-optimizer

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent sleep-planning helper, but it has broad automatic activation and under-scoped local file read/write behavior.

Install only if you are comfortable with a sleep-advice skill that can run a local Node.js script and handle sleep-related personal data. Prefer explicit invocation, avoid passing @file paths except to a known drowsiness JSON file, and use report export only to a deliberate destination.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: When `--output` is provided, the script writes both a markdown report and a derived SVG file to an arbitrary filesystem path. In an agent/skill context triggered by user sleep questions, this exceeds the expected behavior of generating a response and creates an unnecessary file-write primitive that could overwrite local files or persist sensitive health-related data on disk.

Description-Behavior Mismatch

Medium

Confidence: 98% confidence
Finding: In no-argument mode, the script automatically generates example output and silently writes `sleep_report.md` to disk without user consent. In a skill environment, unexpected persistence is risky because it creates artifacts outside the conversational scope and may clobber existing files or violate user expectations around privacy and side effects.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The `@file` support for `--drowsiness` allows the script to read arbitrary local files and parse their contents, even though the skill's purpose is only to collect sleep data and generate recommendations. In an agent setting, this becomes a local file read capability that could expose secrets or sensitive host data if an attacker can influence arguments.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The skill is configured to auto-trigger on essentially any sleep-related query, which is a broad class of normal conversation. In a health-adjacent skill that can invoke read/write/edit/exec behavior and launch a local script, this increases the chance of unintended activation, surprise tool use, and collection/processing of sensitive health information without sufficiently explicit user intent.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The help-oriented trigger list is open-ended and lacks boundaries distinguishing advisory conversation from consent to run the skill. Because the skill then immediately starts structured data collection and may execute a Node.js script, ambiguous triggers can cause over-collection of personal wellness data and unnecessary tool execution in contexts where the user did not intend to invoke the agent skill.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The script writes output files in default/example mode without warning, confirmation, or an explicit save option. Silent side effects are dangerous in agentic workflows because they can create persistent files unexpectedly, interfere with local state, and make a benign health-planning skill behave like a file-writing utility.

Static analysis

No suspicious patterns detected.