Security audit

Keep 健康记录

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real Keep health-recording skill, but it has broad automatic activation, persistent local account tokens, install-time side effects, and loosely scoped file upload behavior that users should review carefully.

Install only if you want an agent to save health records into Keep and you trust this package with local account credentials. Use it on a trusted device, expect a Keep token to be stored at ~/.keepai/.env, consider requiring confirmation before each save, and only provide images you intend to upload. Review the postinstall behavior and use the documented revoke/clear flow when you no longer want local Keep access.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill uses environment-backed secrets and local credential persistence paths, but does not declare permissions or clearly bound its access. In an agent runtime, undeclared access to env and auth material weakens isolation and can enable accidental secret exposure or broader filesystem/token use than operators expect.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared purpose is simple health logging, but the skill instructions include materially broader capabilities: persisting auth tokens locally, polling login state, bridging tool calls through CLI wrappers, uploading local files to remote URLs, and managing configuration/credentials. This mismatch is dangerous because users and policy engines may grant trust based on the benign description while the skill can handle credentials and exfiltrate local files through upload flows.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The README explicitly states that the postinstall script performs telemetry and copies the full package into runner skill directories, including nested dependencies. For a health-record logging skill, this is unnecessary privileged installation behavior that expands persistence and data collection beyond the stated function, increasing supply-chain and privacy risk if the package or dependencies are ever compromised.

Context-Inappropriate Capability

Low

Confidence: 83% confidence
Finding: The README documents uninstall-time cleanup that recursively deletes runner skill directories with rm -rf. Even though it is framed as cleanup, recursive deletion is a destructive capability unrelated to recording health data and can become dangerous if paths are miscomputed, user-controlled, or reused across environments.

Description-Behavior Mismatch

Medium

Confidence: 82% confidence
Finding: The file defines a full authentication and credential-persistence workflow for a skill whose stated purpose is only to record health data. While login may be functionally necessary to access a user's Keep account, the capability expansion increases access to sensitive account data and actions beyond what the manifest communicates, creating a scope/consent mismatch. In a health-related skill, that mismatch is more concerning because the authenticated account may expose highly sensitive personal data.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The skill instructs persistent storage of authentication tokens in ~/.keepai/.env, which creates a durable local secret that may be readable by other local processes, backups, shell tooling, or misconfigured permissions. Because this skill handles personal health data, compromise of the token could enable unauthorized access to sensitive user records and account actions well beyond a single session.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: The fallback behavior instructs the agent to search multiple local temporary directories for a file by name if the provided path no longer exists. In an agent setting, this can cause unintended access to unrelated local files from prior sessions or other processes, and may result in uploading the wrong image or exfiltrating sensitive data beyond the user's intent.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The postinstall script silently sends installation telemetry during package installation, which is unrelated to the skill's stated purpose of recording health data. Running network-reporting logic implicitly at install time creates an undisclosed data flow and expands the trust boundary, especially for a health-context skill where users may reasonably expect stronger privacy minimization.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The script writes configuration into ~/.keepai/.env and later deploys files into runner skill directories, behavior that exceeds the manifest's described health-record logging scope and occurs automatically during global install. Although this may be intended for product setup, modifying user config and copying package contents into execution directories at install time creates persistence and trust risks if the package or its dependencies are compromised.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: Implicit telemetry in a health-recording skill is context-inappropriate because users interacting with health-related tooling have elevated privacy expectations, even if the reported data is limited to installation metadata. The danger is less about direct code execution and more about undisclosed collection, compliance risk, and normalization of hidden network activity in a sensitive domain.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: This script can stage any readable local file and upload it to a remote endpoint, which is unrelated to the stated health-recording purpose of the skill. In the context of a health app, this creates a serious exfiltration primitive that could leak sensitive local files or health data if invoked with attacker-controlled arguments or workflow inputs.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The upload destination is fully controlled by the --upload-url argument, allowing the script to send file contents to arbitrary remote hosts over HTTP or HTTPS. That makes the code an exfiltration mechanism and also enables insecure transmission over plain HTTP, which is especially dangerous given the skill handles personal health information.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The README says authentication tokens are written to ~/.keepai/.env and shared with another CLI, but does not provide a prominent warning about local credential storage, sensitivity, or operational risks. Because this skill handles personal health data, unclear token persistence materially raises privacy and account-compromise concerns on shared or insecure systems.

Vague Triggers

High

Confidence: 94% confidence
Finding: The description explicitly says to activate even when users do not mention Keep and includes very broad logging-style examples such as common meal, sleep, and weight statements. That can cause unintended invocation during ordinary conversation, leading the assistant to capture or transmit sensitive health data without clear user consent.

Vague Triggers

High

Confidence: 91% confidence
Finding: The tag list includes vague phrases like 帮我记, 记一下, 登记, and 打卡 without constraints tying them specifically to health logging. These generic triggers can overlap with many unrelated user requests, increasing the chance of accidental activation and inappropriate handling of personal data.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: Many meal and activity tags, such as 早餐, 午餐, 晚饭, 吃了, 喝了, 运动, and 跑了, are common everyday expressions rather than clear logging commands. In a health-recording skill, this makes accidental capture of highly sensitive wellness data more likely, though the surrounding health context somewhat narrows the misuse compared with fully generic skills.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The instructions direct the agent to persist a JWT locally but do not require a user-facing warning or consent flow explaining that credentials will be stored on disk. Silent credential persistence is risky because users may assume a one-time login while the system retains reusable access for future operations, increasing the blast radius if the host is shared or compromised.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: Copying source images into a persistent temp directory can retain sensitive health photos locally after the task completes, creating unnecessary data at rest. Because this skill handles personal health information, undocumented retention materially increases privacy risk if the host is shared, backed up, or later inspected.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: This skill handles highly sensitive personal health data and optionally user-provided images, yet the documentation instructs the agent to upload and submit that data without any privacy warning, consent checkpoint, retention notice, or guidance on minimizing sensitive content. In a health-recording context, this omission is more dangerous than in ordinary note-taking because users may unknowingly transmit regulated or intimate data such as menstrual cycle details, body measurements, or identifiable photos.

Static analysis

No suspicious patterns detected.