个人智能健康管理

• Outcome: Review
• Latest audit: May 28, 2026 · 7:05 AM UTC
• Version: 1.0.0

Overview

This health-management skill is mostly aligned with its stated purpose, but it needs Review because it handles sensitive health data while bundling broad auto-activation, persistent scheduled reminders, hardcoded Feishu credentials, and inconsistent privacy disclosure.

Review carefully before installing. Use it only if you are comfortable with local health-data storage, Feishu/Tencent cloud document or message flows, and recurring scheduled execution. The Feishu secret should be removed and rotated, embedded user and document IDs should be replaced with per-user configuration, triggers should be narrowed, and cron or outbound health-related messages should require explicit confirmation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (34)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

else:
    # 添加 cron
    new_cron = current_cron.strip() + "\n" + cron_line
    subprocess.run(f"echo '{new_cron}' | crontab -", shell=True)
    print("✅ 已添加定时任务：每天 9:00 自动推送")

print()

• Confidence: 96% confidence
• Finding: The script rewrites the user's crontab by building a shell command string and executing it with shell=True. Even though the immediate inputs are mostly local paths, this creates unnecessary command-injection risk if paths or cron content contain shell-metacharacters, and it also performs a persistent host-level change from an activation script.

os.system() or os exec-family call

High

• Category: Dangerous Code Execution

Content

if test_choice == "y":
    if feishu_user_id:
        print("发送测试消息...")
        os.system(f'"{script_path}"')
    else:
        print("⚠️ 未配置用户 ID，无法发送测试消息")
else:

• Confidence: 84% confidence
• Finding: The script launches an external shell script via os.system, which delegates execution to the shell and inherits shell parsing behavior. This is dangerous because any unexpected characters in the resolved path or environment can change execution semantics, and it expands the skill from health configuration into host command execution.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 检查当前 cron
try:
    current_cron = subprocess.check_output("crontab -l 2>/dev/null", shell=True).decode("utf-8")
except:
    current_cron = ""

• Confidence: 78% confidence
• Finding: Using subprocess.check_output with shell=True to run 'crontab -l 2>/dev/null' is unnecessary and introduces shell execution where a direct process invocation would suffice. While the command string is static, this pattern weakens safety boundaries and is part of a broader persistence workflow that modifies user cron.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if "daily_health_reminder" not in current_cron:
                new_cron = current_cron.strip() + "\n" + cron_line
                subprocess.run(f"echo '{new_cron}' | crontab -", shell=True)
                print("✅ 定时任务已配置：每天 9:00 自动推送")
            else:
                print("✅ 定时任务已存在")

• Confidence: 95% confidence
• Finding: The script builds a shell command with untrusted content from the existing crontab and executes it with shell=True: echo '{new_cron}' | crontab -. If any existing cron entry contains a single quote or shell metacharacters, the quoting can break and lead to command injection under the current user. In this skill, automatic cron modification also creates persistence beyond the immediate health-management function, increasing the danger.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run_mcporter(service, tool, args):
    """执行mcporter命令"""
    cmd = f'mcporter call {service} {tool} --args \'{json.dumps(args)}\''
    result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
    return result.stdout, result.stderr

• Confidence: 98% confidence
• Finding: The script builds a shell command with f-string interpolation and executes it with shell=True. Because service, tool, and especially JSON-encoded args may contain shell metacharacters or quotes, an attacker who can influence title/content/file_id could break out of the quoted argument and execute arbitrary commands on the host.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run_mcporter(service, tool, args):
    """执行mcporter命令"""
    cmd = f'mcporter call {service} {tool} --args \'{json.dumps(args)}\''
    result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
    return result.stdout, result.stderr

• Confidence: 95% confidence
• Finding: The script builds a shell command with f-string interpolation and executes it with shell=True. Although the current call path passes constant service/tool values, the JSON-serialized args include user-controlled content such as file_id and content, so shell metacharacters or quote breaking can lead to command injection or malformed invocation if input is not strictly controlled.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The documented dependencies include browser automation/search, OCR, Feishu document access, and message-reading capabilities that are broader than what a basic health check-in or health analysis skill appears to require. In a health-management context, these capabilities could expose sensitive health data, ingest unrelated private content, or enable data movement across services without a clear justification in this file.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The Feishu permissions include docs:write and im:message:send_as_user, which enable modification of documents and sending messages as the user; combined with health-related processing, this creates a meaningful risk of unauthorized disclosure, tampering, or social engineering using sensitive medical information. These permissions are broader than a typical reminder/check-in feature would imply, making the skill context more dangerous because health data is especially sensitive.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: This activation script creates persistent scheduled execution by editing the user's crontab, which is a system-level behavior beyond simple one-time configuration. In the context of a health-management skill, persistence is especially sensitive because users may not expect host-level scheduling changes from an activation flow.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The script inspects and rewrites crontab through shell commands, combining shell execution with persistent system modification. This increases risk because shell-based cron management is fragile, can be injection-prone, and gives the skill ongoing execution capability unrelated to immediate health analysis.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: A health-management binding script is expected to store user preferences or identifiers, but this code also modifies the user's crontab to establish recurring execution. That capability exceeds the minimum required for binding and creates persistence on the host, which is especially sensitive in an agent skill because activation phrases may trigger it with limited user awareness.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The script hardcodes Feishu application credentials and uses them to obtain a tenant access token, giving the skill authenticated outbound messaging capability beyond a simple local reminder helper. Embedded secrets can be extracted by anyone with access to the skill files, reused outside the intended context, and abused to send messages or access other Feishu APIs permitted to the app.

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: The file header describes the script as a health exercise reminder, but the implementation sends data to an external Feishu service. This mismatch reduces transparency and can mislead users or reviewers about networked behavior and data sharing, especially in a health-related skill where message contents may be sensitive.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The heartbeat logic explicitly updates SESSION-STATE.md to record reminder delivery, but there is no user-facing disclosure that the skill persistently stores behavioral state. Silent persistence can enable covert tracking of user activity patterns and creates privacy risk, especially in a health-related skill handling sensitive wellness context.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill describes automatically sending IM messages on heartbeat based on time windows, without explicit user warning or opt-in at the point of use. Unannounced outbound messaging is risky because it can surprise users, create spam-like behavior, and in a health-management context may expose sensitive routines or inferred health interests through notifications on shared devices or channels.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The documented trigger phrases include very generic terms such as "打卡", "健康数据", and "运动计划", which are likely to appear in ordinary user conversation and can cause accidental activation of the skill. In a health-management skill, unintended invocation is more dangerous because users may upload or discuss sensitive medical information, increasing privacy and consent risks.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README encourages syncing health data, creating online documents, and sharing them via Tencent Docs/WeChat, but it does not warn users that health data is sensitive personal information that may be exposed through cloud storage, link sharing, weak permissions, or token misuse. In a health-management skill, this omission is more dangerous because the data includes medical indicators and daily health records, which can create meaningful privacy and compliance risks if disclosed.

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The activation model is overly broad and likely to trigger on ordinary health-related conversation, causing unintended processing of sensitive medical information. In this context, accidental activation is more dangerous because the skill claims it will bind user IDs and create recurring reminders automatically, turning a casual mention into persistent data collection and automation.

Vague Triggers

High

• Confidence: 98% confidence
• Finding: Using disease names and general wellness terms as triggers makes accidental invocation highly probable, especially in normal conversation about symptoms or test results. Because the skill handles special-category health data and associates it with user IDs, unintended activation can expose users to privacy loss, profiling, and unwanted persistent tracking.

Vague Triggers

High

• Confidence: 98% confidence
• Finding: The statement that any health-related content will automatically activate the skill creates an ambiguous and effectively unbounded trigger condition. In a health-management context, this is particularly risky because it can capture highly sensitive data from ordinary user messages without meaningful consent or intent to enroll.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill describes automatically obtaining a user ID and configuring recurring tasks without a clear user-facing warning about persistence, frequency, and system-side effects. This is dangerous because users may not realize they are being enrolled into ongoing monitoring and notifications, especially when activation can happen from broad conversational triggers.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The file-storage section shows health records and check-in history are stored locally by user ID, but the skill does not present a strong, upfront warning to users that sensitive health data will persist on disk. Given the nature of medical indicators and longitudinal records, silent local retention increases privacy, confidentiality, and misuse risks if the host is shared or compromised.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script modifies the user's crontab without an explicit confirmation prompt immediately before the persistent change. That is risky because persistence affects future system behavior and users may not realize activation includes scheduled background execution.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script automatically installs a recurring cron job without an interactive confirmation prompt or explicit pre-action disclosure. In a health-related skill, silently creating persistence is more dangerous because users may reasonably expect wellness reminders, not host-level scheduler changes, making unauthorized or surprising system modification more likely.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The script embeds Feishu APP_ID and APP_SECRET directly in source code, exposing long-lived credentials to anyone with code access and making accidental leakage through repositories, logs, or backups much more likely. In a health-management skill that handles user identifiers and reminder messages, compromised credentials could enable unauthorized API access, token issuance, and abuse of the associated Feishu application.

Static analysis

No suspicious patterns detected.