Security audit

Bmi

Security checks for vulnerabilities and agentic risk

Overview

This skill is an offline health log manager, but it is advertised as a BMI calculator and stores sensitive health-adjacent notes persistently without strong privacy controls.

Review this before installing if you expect real BMI calculations or charts, because it mainly saves free-form notes. Avoid entering sensitive health details unless you are comfortable with plaintext files being kept under ~/.local/share/bmi, and consider hardening or deleting those files manually if used on a shared system.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/script.sh:6
Finding: Sensitive health records are created without restrictive permissions
Content: View full analysis
> "$DATA_DIR/history.log"; } ``` A representative health-data write is: ```bash log) shift if [ $# -eq 0 ]; then echo "Recent log entries:" tail -20 "$DATA_DIR/log.log" 2>/dev/null || echo " No entries yet. Use: bmi log " else local input="$*" local ts=$(date '+%Y-%m-%d %H:%M') echo "$ts|$input" >> "$DATA_DIR/log.log" local total=$(wc -l < "$DATA_DIR/log.log") echo " [Bmi] log: $input" echo " Saved. Total log entries: $total" _log "log" "$input" fi ``` The same unrestricted append pattern is used for the other health-related log files. ### Technical Analysis The program stores potentially sensitive health information, including weight tracking, goals, reminders, trends, and milestones, under `~/.local/share/bmi`. It neither establishes a restrictive process `umask` nor explicitly assigns secure permissions to the data directory and files. Consequently, the effective permissions depend on the environment from which the program is launched. With a permissive `umask`, the directory may be created as mode `0755` and files as mode `0644`, allowing other local users to traverse the directory and read the records. Existing directories and files are also not checked or hardened. This issue is conditional on the caller's `umask`, home-directory permissions, and local filesystem access controls. It does not independently bypass an otherwise non-traversable home directory. ### Attack Path 1. A user runs the BMI tool in an environment with a permissive `umask`, such as `0022`. 2. The scrip ...[truncated 706 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/script.sh:105
Finding: User-controlled search terms can be interpreted as grep options
Content: View full analysis
}" echo "Searching for: $term" for f in "$DATA_DIR"/*.log; do [ -f "$f" ] || continue local m=$(grep -i "$term" "$f" 2>/dev/null || true) if [ -n "$m" ]; then echo " --- $(basename "$f" .log) ---" echo "$m" | sed 's/^/ /' fi done } ``` ### Technical Analysis The search term is quoted, which prevents shell word splitting and shell metacharacter execution, but quoting does not prevent `grep` from interpreting an argument beginning with `-` as an option. For example, a term such as `--file=/path/to/file` may cause `grep` to read patterns from another local file rather than treating the supplied value as the literal search term. Other accepted `grep` options can alter matching behavior, output volume, resource use, or error handling. This is not shell command injection because the value is not evaluated by a shell and cannot directly execute arbitrary commands. It is command-line option injection into `grep`. ### Attack Path 1. An attacker controls or influences the value passed to `bmi search`. 2. The supplied term begins with a valid `grep` option, such as `--file=/path`. 3. The script invokes `grep -i "$term" "$f"` without an end-of-options delimiter. 4. `grep` processes the attacker-controlled value as an option rather than as a search pattern. 5. Search behavior is altered, potentially causing local files to be opened as pattern sources, sensitive information to be inferred through matching results, excessive output, or resource consumption. ### Impact Assessment The injected option is processed with the privileges of the user running the skill. It does not provide direct command execution or privilege escalation. The practical scope incl ...[truncated 209 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description suggests a health-specific utility for BMI calculation, weight logging, and charting body composition trends. The code instead implements a local shell-based note/log manager that appends arbitrary user input to category-specific log files under ~/.local/share/bmi. While some command names like track, chart, goal, trend, weekly, and monthly loosely align with fitness tracking, the implementation does not compute BMI, process weight/height data, or create charts. It also exposes additional undeclared capabilities such as search, statistics, recent activity, status reporting, and exporting stored logs. Therefore the description materially overstates and mischaracterizes the actual primary behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill explicitly stores timestamped health-related entries under a local path and emphasizes automatic history/activity logging, but it does not clearly warn users about retention, sensitivity, or local access risks. Because weight, body composition, and goal data are sensitive health-adjacent records, undisclosed persistent logging can expose private information to other local users, backups, or shared-device forensics.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The header comments and help banner describe a BMI-focused health tool, creating an expectation of BMI-specific behavior. In practice, the script only appends arbitrary text inputs to named log files and displays them later, which contradicts the stated functional intent rather than merely omitting minor details.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest describes a fitness tool for BMI calculation, weight logging, and trend charting, but the implemented commands are generic text-entry buckets such as log, track, goal, weekly, and compare. There is no code performing BMI computation from height/weight, no body composition logic, and no actual chart generation beyond writing user input to .log files.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The help output advertises commands like remind, weekly, monthly, compare, streak, milestone, search, recent, and status, which are broader than the manifest's narrower promise of BMI calculation, weight logging, and body composition trend review. These commands operate as generic local activity logging rather than obvious implementation details of BMI tracking.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script stores potentially sensitive health-related information in plaintext log files under the user's home directory without explicit privacy notice, consent, retention policy, or permission hardening. In the context of a health-tracking skill, this increases the sensitivity of the data at rest and can expose personal health information to other local users, backups, or malware that reads user files.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.