Back to skill

Security audit

Adhd Daily Planner Repo

Security checks for vulnerabilities and agentic risk

Overview

This is a markdown-only ADHD planning skill with coherent self-help content, but users should treat its medication and mental-health sections as non-clinical guidance.

Install only if you want ADHD-oriented planning templates and coaching-style self-help prompts. Treat medication, therapy, dopamine, and crisis-management content as organizational support, not diagnosis or treatment guidance; discuss medication changes, severe symptoms, or functional impairment with a qualified clinician.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
85% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 226)May include surrounding context.

md
- Low-stakes tasks only
- No major decisions

**The key**: Don't judge bad days. They're part of the pattern.

## Tools That Actually Help

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The phrase 'designed BY and FOR ADHD brains' presents the skill as intended for a specific neurotype in a way that can function as a restrictive audience policy. Under the natural-language policy rule, language constraints or audience restrictions should be clearly justified or offer user choice; here the file does not clarify whether non-ADHD users may opt in or benefit from the skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

This document provides mental-health and quasi-medical guidance aimed at ADHD management, including advice about dopamine regulation, medication management, therapy, productivity during depletion, and behavior change, but it does not warn users that it is not professional medical or mental-health advice. Users may rely on it as authoritative self-management guidance, which is risky because ADHD symptoms can overlap with other conditions and individualized treatment decisions should involve qualified clinicians.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The medication section includes tracking and 'Tomorrow adjustment needed?' language plus reminder systems, but it does not clearly instruct users to consult a licensed clinician before changing dose, timing, or regimen. In a self-help skill for ADHD, that omission can encourage self-directed medication changes or experimentation, which may lead to adverse effects, reduced efficacy, withdrawal, or dangerous interactions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.