Mental Health

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:32 PM UTC
• Version: 2.0.0

Overview

This mental-health skill appears locally scoped and not malicious, but it under-discloses sensitive plaintext journaling storage and has confusing, inconsistent command behavior for a high-trust health context.

Review this carefully before installing. It does not appear to exfiltrate data or install persistence, but anything logged through the tracker may be saved locally in plaintext and the reset command does not actually clear records. Users outside the listed Chinese crisis-resource context should not rely on its emergency guidance and should use local emergency or crisis services.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/script.sh:5

Finding

Potentially Sensitive Mental-Health Data Stored in Plaintext with Inherited Permissions

Content

View full analysis

Vulnerability Details

File Location: scripts/script.sh, lines 5-34
Vulnerability Type: Insecure local storage of potentially sensitive data
Risk Level: Medium

Vulnerable Code

bash

DATA_DIR="${MENTAL_HEALTH_DIR:-${XDG_DATA_HOME:-$HOME/.local/share}/mental-health}"
DB="$DATA_DIR/data.log"
mkdir -p "$DATA_DIR"

show_help() {
    cat << EOF
mental-health v$VERSION

Health and wellness tracker

Usage: mental-health <command> [args]

Commands:
  log                  Log entry
  today                Today summary
  streak               Current streak
  stats                Statistics
  reminder             Set reminder
  tips                 Health tips
  goal                 Set goal
  history              View history
  export               Export data
  reset                Reset tracker
  help                 Show this help
  version              Show version

Data: \$DATA_DIR
EOF
}

_log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; }

cmd_log() {
    echo "$(date +%Y-%m-%d) $*" >> "$DB"; echo "  Logged: $*"
    _log "log" "${1:-}"
}

Technical Analysis

The log command writes arbitrary user-provided wellness or mental-health entries directly to data.log. It also records activity information in history.log. These records are stored as unencrypted plaintext.

The script creates the storage directory with mkdir -p and creates the log files through shell redirection, but it does not establish a restrictive umask or explicitly apply secure filesystem permissions. Consequently, directory and file permissions are inherited from the invoking process's umask and the permissions of parent directories. Under a permissive configuration, the files may be created with modes such as 0644, allowing other local users to read their contents.

Because users may place private emotional, medical, or wellness informati ...[truncated 1631 chars]

Remediation

View remediation

Remediation Suggestions

1. Establish a restrictive umask before creating any data:

   bash

   umask 077
   

2. Create the storage directory with owner-only permissions and verify its final mode:

   bash

   mkdir -p -- "$DATA_DIR"
   chmod 700 -- "$DATA_DIR"
   

3. Secure both files after creation:

   bash

   touch -- "$DB" "$DATA_DIR/history.log"
   chmod 600 -- "$DB" "$DATA_DIR/history.log"
   

4. Reject unsafe storage locations or symlinked files where practical. Resolve and validate a user-supplied MENTAL_HEALTH_DIR before writing, and avoid following pre-existing symbolic links when opening sensitive files.

5. Clearly disclose that log entries are persisted locally in plaintext, including the exact location and retention behavior.

6. Implement the documented reset operation so users can securely remove their records. The current reset command only prints instructions and does not delete data.

7. If the threat model includes privileged administrators, device theft, or offline disk access, use operating-system credential storage or authenticated encryption rather than relying only on file permissions.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill claims to provide mental-health-specific support such as mood checks, breathing exercises, journaling, stress management, gratitude practice, and psychological resources, but the documented behavior does not substantiate those capabilities. In a mental health context, this mismatch is dangerous because users may rely on the tool for support it does not actually provide, leading to delayed help-seeking or misplaced trust during distress.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill presents crisis resources only for China-specific locales without indicating that the list is geographically limited or offering alternatives for users in other regions. In a mental health assistant, this can cause real harm because users outside China may receive unusable emergency guidance during a crisis, creating delay or confusion when immediate help is needed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script's help text, guidance, crisis messaging, and command output are written in Chinese throughout, with no option for users to select another language or indication that the skill is intentionally limited to a Chinese-speaking context. The policy forbids forcing a specific language or locale without user opt-in or clear justification.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest describes a psychological support tool focused on mood self-checks, breathing exercises, emotion journaling, mental-health resources, stress management, and gratitude practice. In contrast, the script presents itself as a generic 'Health and wellness tracker' and only provides generic logging, summaries, reminders, tips, goals, history, export, and reset behavior, with no code implementing the described mental-health-specific features.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script stores user-provided wellness entries in plaintext under a predictable local path without any privacy notice, consent flow, retention policy, or file permission hardening. In the context of a mental-health or wellness tool, these entries may contain highly sensitive personal information, increasing the risk of unintended disclosure to other local users, backups, logs, or synced storage.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The entire skill content, including safety-critical crisis guidance, is presented only in Chinese. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified, which is not documented here.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The inline documentation and help output identify the tool as a general wellness tracker rather than a mental-health assistant. This is not merely incomplete documentation: it actively frames the tool's intent differently from the declared skill purpose, suggesting a divergence between stated intent and shipped behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.