Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/sleep_calculator.js \
Security audit
sleep-optimizer
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent sleep-report generator, but it uses broad local execution and file read/write powers around sensitive health data without tight scoping.
Review before installing if you do not want a sleep skill to auto-activate on general sleep questions, run a local Node.js script, or save reports containing personal sleep and health details. Prefer using it only on explicit request, avoid @file inputs unless you chose the file, and save outputs only to non-sensitive locations.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (14)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/sleep_calculator.js \
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The description and examples are written to operate in Chinese and specify Chinese trigger phrases and question flow, but do not mention offering another language or obtaining user preference first. This can be a language/locale policy issue if the organization requires user choice rather than silently forcing a specific language.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill explicitly requests the
execcapability and instructs the agent to run a local Node.js script to process user-provided sleep data. For a health-advice/reporting skill, shell execution is broader than necessary and increases the attack surface if script contents, arguments, or surrounding files are modified or if unsafe argument handling exists elsewhere in the skill package.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill is configured to auto-trigger on very broad sleep-related conversation, including generic mentions of sleep quality, fatigue, schedule adjustment, or exam periods. This can cause the agent to invoke file-writing or execution behavior in contexts where the user did not explicitly request the skill, expanding the chance of surprising actions and unintended collection/processing of sensitive health information.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill states that using
--outputwill create a Markdown report and a same-named SVG chart file, but the user-facing behavior does not prominently warn that files may be written to disk. Silent or poorly disclosed file creation can surprise users, leak sensitive sleep/health data into persistent storage, and create artifacts in shared environments.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script's user-facing strings, report content, and CLI errors are all in Chinese, which effectively forces a specific language for all users. There is no opt-in, language selection mechanism, or documented justification that this is a China-specific or Chinese-only tool.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The @file syntax allows the caller to make the script read arbitrary local files and feed their contents into JSON.parse. In an agent setting, this creates a local file disclosure primitive unrelated to sleep planning, and even parse failures may leak file existence or partial content through downstream handling or logs.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
When --output is supplied, the script writes both a Markdown report and a sibling SVG file to an arbitrary user-provided path. In an agent or skill context, undocumented filesystem writes expand the tool's side effects and can overwrite existing files or place attacker-influenced content in sensitive locations if path inputs are not constrained.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
In no-argument example mode, the script unconditionally creates sleep_report.md on disk without user request. In an automated agent environment this creates hidden side effects, can overwrite local files, and violates least surprise for a skill whose purpose is report generation rather than persistent filesystem modification.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The template explicitly prompts users to record sensitive health-related information, including medication use, stressors, and other factors affecting sleep, but provides no privacy notice, retention guidance, or warning about handling this data safely. In a sleep-optimization skill, users are likely to disclose regulated or highly personal information, increasing the risk of oversharing, insecure storage, or unintended downstream exposure.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown file is entirely written in Chinese, including headings, summaries, and notes, with no indication that the user can choose another language or that the skill is intended only for a Chinese-language audience. Under the stated policy, imposing a specific language without opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This markdown file contains natural-language content exclusively in Chinese from the title through the body. Under the language/locale policy rule, forcing a specific language without user opt-in can be a policy violation unless the locale constraint is clearly documented and justified, which is not present here.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
In the no-argument execution path, the script unconditionally writes a markdown report to "sleep_report.md". Although the comment notes the save operation, there is no user-facing disclosure such as a console message or confirmation before modifying the filesystem.
- Content