Security audit

aiheal cli

Security checks across malware telemetry and agentic risk

Overview

This skill appears to do what it claims, but it gives an agent broad power over real AIHealingMe account, billing, raw API, and sensitive emotional-health workflows without enough safety guidance.

Install only if you trust the `aihealingmecli` npm package and intend to let an agent operate AIHealingMe. Use test accounts where possible, avoid passing real passwords or bearer tokens on the command line, verify `whoami`, region, and API base before any mutation, and require explicit human approval before account, billing, delete, notification, raw API, chat, emotion, memory, or behavior actions.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The reference expands the skill from normal CLI troubleshooting into raw API access and advanced service operations, which materially broadens what an agent could be induced to do. That scope creep is dangerous because it enables actions not justified by the manifest description, reducing guardrail clarity and making privilege misuse or unsafe requests more likely.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: A generic arbitrary API request primitive allows the agent to hit essentially any endpoint and choose method, path, query, and body, bypassing the safety implied by curated workflow commands. In an agent setting, this creates a powerful exfiltration and unauthorized-action surface because prompt-injected instructions can steer the tool toward undocumented, destructive, or sensitive endpoints.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: The healing commands accept arbitrary base URLs and support pipeline, plan, voice preview, and remote file download operations outside the main product workflow scope. This is dangerous because it can let an agent interact with unintended services or attacker-controlled endpoints, increasing risks such as SSRF-like access patterns, data leakage, and unsafe file retrieval.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill instructs use of auth/config/token-based CLI operations against a live remote API without warning that credentials and supplied data may be transmitted to an external service or appear in shell history/process lists if passed on the command line. In a skill specifically centered on account and healing workflows, that increases the chance of exposing sensitive user, health-adjacent, or account data during routine use.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill encourages live API operations across account, subscription, notification, feedback, memory, behavior, chat, and emotion workflows with no privacy or side-effect warning. Because this context involves personal and potentially sensitive emotional-health-related data, using production endpoints without guardrails can expose private information, mutate account state, trigger notifications, or perform unintended actions on real user accounts.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The command map documents destructive account/session operations such as token clearing and logout without clear warnings about impact, reversibility, or when user confirmation is required. In an agent context, missing friction around sensitive commands makes accidental disruption or adversarially induced account state changes more likely.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.