Security audit

Nutrition Tracker

Security checks for vulnerabilities and agentic risk

Overview

This nutrition tracker is purpose-aligned, but its scripts contain input-handling flaws that could execute local code or write outside the intended Obsidian folder.

Review before installing. Use only with trusted inputs and a controlled Obsidian vault until the scripts quote heredocs, validate language/date/numeric fields, and ensure output paths stay inside the intended vault. Be aware that profile and meal data are stored persistently and may sync if your Obsidian vault syncs.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/nutrition_init.sh:42
Finding: Arbitrary Python Code Injection Through Profile Arguments
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/nutrition_check_today.sh:20
Finding: Python Code Injection Through the Language Argument
Content: View full analysis
Remediation: View remediation
&2; exit 2 ;; esac ``` - Add tests using quotes, newlines, parentheses, and Python expressions in `--lang`. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/nutrition_log.sh:39
Finding: Path Traversal Through an Unvalidated Date Value
Content: View full analysis
Remediation: View remediation
&2 exit 2 fi if ! date -d "$DATE" +%F >/dev/null 2>&1; then echo "Invalid calendar date" >&2 exit 2 fi ``` - Prefer parsing the date with a strict date library rather than relying only on substring extraction. - Resolve the vault root and destination to canonical absolute paths before writing, then verify that the destination remains under the expected `health/eat` directory. - Reject any date containing `/`, `\`, control characters, or traversal components. - Apply equivalent strict date validation in `nutrition_check_today.sh`, which constructs a read path from the same kind of input. - Add tests for `../`, absolute-path fragments, malformed dates, embedded newlines, and invalid calendar dates. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The documented behavior claims profile initialization, persistence, and goal-based target computation, but the detected implementation appears narrower and inconsistent. Security-relevant mismatches like this can mislead users and agent orchestrators about what data is stored and what actions occur, undermining informed consent and safe tool invocation.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill advertises shell scripts that read environment state and write persistent files in an Obsidian vault, but it declares no explicit tool scope or permissions. This increases the chance that an agent invokes file/system-capable actions without clear user visibility or policy boundaries, especially because the writes involve persistent health data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill handles sensitive health-related information and persists it to a local vault and profile file, but the description does not clearly warn users about this storage behavior. Because health data is sensitive and persistent local writes can surprise users, inadequate disclosure materially increases privacy and consent risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This file defines all user-facing messages exclusively in Simplified Chinese, which can constitute a language/locale policy violation when there is no indication that the user selected this locale or that the skill is region-specific. The policy allows locale constraints only when they are explicitly optional or justified, neither of which is visible in this file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code defaults NUTRITION_LANG to zh-CN when no language is provided and also falls back to zh-CN.json if the requested locale file does not exist. This enforces a specific language choice without explicit user opt-in or a documented justification, which is a natural-language locale policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: LANG_OPT is initialized to "zh-CN", which makes the skill use a specific language by default unless the user explicitly overrides it. This is a natural-language policy concern because the skill does not first offer a language choice or document a justified region-specific constraint.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script persists sensitive health-related profile data, including sex, height, weight, activity, goal, and calorie/macro targets, to a predictable file path on disk without any explicit notice, consent flow, retention policy, or permission hardening. In the context of an Obsidian vault, this may sync to cloud services or be exposed to other local users/processes, creating a real privacy and data-handling risk even though it is not code-execution related.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script sets LANG_OPT to zh-CN by default, which forces a specific language unless the caller explicitly overrides it. This is a natural-language locale policy concern because the default behavior imposes a language choice without prior opt-in or negotiation.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The description says to use the skill when the user 'logs meals, asks if targets are met, or wants to set/remember nutrition profile,' but it does not define explicit trigger phrases, scope limits, or exclusion cases. This can create ambiguity about when the skill should activate versus when a general nutrition conversation should remain informational only.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.