Security audit

月嫂助手

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent maternal/newborn care dashboard, but it combines sensitive health records with overbroad agent permissions and an undisclosed third-party script load.

Review this before installing if you will store real family or health data. Use it only on a trusted device/browser profile, avoid shared computers, treat exported JSON files as sensitive medical records, and prefer a version that removes unnecessary Bash permission and bundles Chart.js locally or uses integrity protections.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The manifest grants Bash even though the skill is described as a pure front-end, localStorage-based HTML tool that should not require shell execution. Unnecessary command-execution capability violates least privilege and increases the blast radius if the skill is later extended, compromised, or induced to handle untrusted input through shell operations.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The page executes Chart.js directly from a public CDN at runtime, which introduces third-party code execution into an app handling sensitive maternal and infant health records. If the CDN, dependency version, or delivery path is compromised, attacker-controlled JavaScript could access localStorage, exported records, clipboard interactions, and all on-page medical data.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger set includes broad phrases such as '母婴护理', '新生儿护理', and '产后恢复', which are common general-topic terms and may cause the skill to activate in ordinary conversations unrelated to this specific tool. Because the skill handles health-related workflows and writes data, overbroad invocation increases the chance of unintended activation, mistaken data collection, or inappropriate quasi-medical guidance in the wrong context.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill explicitly stores maternal and infant health information, medication records, and family reports, yet the description lacks a clear warning about the sensitivity of this data or guidance on safe handling. In a maternal/newborn context, these records are highly sensitive; users may underestimate privacy risks of local browser storage, shared devices, exports, or screenshots, leading to exposure of personal health data.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The export function allows one-click extraction of highly sensitive postpartum and newborn records without any privacy notice, confirmation about the data sensitivity, or guidance on safe handling. In this skill context, the exported JSON may contain names, health observations, medication schedules, and recovery details, increasing the risk of accidental disclosure.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The import flow loads JSON directly into the application's live dataset and persists it immediately, without first warning that it can overwrite or merge sensitive existing records. This can cause accidental loss, corruption, or unintended replacement of maternal and infant health history, which is especially risky for caregiving continuity.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill stores maternal and infant health information in localStorage without notifying the user, even though localStorage is accessible to any script running in the page origin and persists beyond the current session. In a browser context, this increases exposure to shared-device access, browser profile compromise, and theft through any XSS or third-party script compromise.

Static analysis

No suspicious patterns detected.