T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:43- Finding
Automatic Indefinite Storage of Sensitive Dietary and Health-Related Information
- Content
View full analysis
- Remediation
View remediation
Security audit
diet-record
Security checks for vulnerabilities and agentic risk
Overview
This diet logger is not malicious, but it should go to Review because it automatically stores sensitive diet and health-related details over time without clear user control.
Install only if you are comfortable with a local diet history and preferences file being built over time. Before use, add clear consent and controls for reviewing, correcting, exporting, and deleting stored preferences, and store the files in a protected per-user data location rather than the skill package directory.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The activation description includes generic phrases such as "帮我记一下", "拍了张照片", and "what did I eat today", which can occur in ordinary conversation outside the diet-logging context. The file does not provide exclusion conditions or negative examples to narrow when the skill should activate, increasing the risk of unintended invocation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill persistently stores sensitive health-adjacent data such as allergies, dietary restrictions, goals, and notes, but does not require a user-facing disclosure or consent flow for retention. Because these records accumulate over time, users may unknowingly expose personal health and lifestyle information beyond the immediate interaction.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill directs the agent to continuously infer and save sensitive dietary and health-related details from ordinary conversation over time. This creates a profiling risk: the system may collect special-category personal data without explicit, contextual consent, increasing privacy harm if the data is later exposed or misused.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill explicitly instructs the agent to execute a shell/Python one-liner to generate a daily summary. Even though the code is simple, embedding command execution in a diet-recording skill expands the capability surface from data handling to code execution, which is unnecessary and can become dangerous if later adapted with user-influenced inputs or reused in less controlled contexts.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This JSON schema uses English for top-level descriptions and enumerations, but switches to Chinese for multiple item-property descriptions. Because the file provides no user opt-in, language-selection mechanism, or justification for a Chinese-only subsection, it creates a natural-language locale inconsistency that may violate language-choice policy.
- Content
Static analysis
No suspicious patterns detected.