Vitamin

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 2:34 AM UTC
• Version: 2.0.1

Overview

This is an offline vitamin-tracking CLI that keeps data local, but it stores health entries as plaintext logs and has a broken export command.

Install only if you are comfortable keeping supplement or wellness notes in plaintext under ~/.local/share/vitamin. Avoid entering sensitive medical details, and consider manually restricting that directory's permissions or clearing it when no longer needed. Treat the export command as unreliable until the duplicate command bug is fixed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/script.sh:6

Finding

Sensitive Health Records Stored Without Restrictive Permissions

Content

View full analysis

Vulnerability Details

File Location: scripts/script.sh, lines 6–9 and representative record creation at lines 130–136
Vulnerability Type: Insecure permissions and plaintext storage of sensitive health information
Risk Level: Medium

Vulnerable Code

bash

DATA_DIR="${HOME}/.local/share/vitamin"
mkdir -p "$DATA_DIR"

_log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; }

Representative record creation:

bash

local input="$*"
local ts=$(date '+%Y-%m-%d %H:%M')
echo "$ts|$input" >> "$DATA_DIR/log.log"
local total=$(wc -l < "$DATA_DIR/log.log")
echo "  [Vitamin] log: $input"
echo "  Saved. Total log entries: $total"
_log "log" "$input"

The same insecure file-creation pattern is repeated for the other record types and exports.

Technical Analysis

The Skill stores supplement intake, goals, reminders, tracking records, and activity history as plaintext files under ~/.local/share/vitamin/. It creates the directory with mkdir -p and creates files through shell redirection, but it does not establish a restrictive umask or explicitly enforce directory and file modes.

Consequently, permissions depend on the invoking process's environment. With a common 022 umask, newly created files can receive mode 0644, making sensitive health records readable by other local users where parent-directory traversal permissions allow it. The code also does not repair pre-existing permissive permissions.

This issue does not grant elevated privileges or remote access. Exploitation requires an attacker who already has local filesystem access under another account or through a compromised local process.

Attack Path

1. A user invokes the Skill to record supplement intake or other health-related information.
2. The script creates ~/.local/share/vitamin/ and appends records without setting secure permissions.
3. The resulting files inherit the process's default ` ...[truncated 822 chars]

Remediation

View remediation

Remediation Suggestions

1. Set a restrictive process mask before creating any data:

   bash

   umask 077
   

2. Create and enforce a private data directory:

   bash

   install -d -m 700 "$DATA_DIR"
   chmod 700 "$DATA_DIR"
   

3. Create files with mode 0600, and correct permissions on existing records:

   bash

   touch "$DATA_DIR/history.log"
   chmod 600 "$DATA_DIR/history.log"
   find "$DATA_DIR" -maxdepth 1 -type f -exec chmod 600 {} +
   

4. Apply the same restrictions to JSON, CSV, and text exports because they may contain the complete health-record history.

5. Consider optional encryption at rest for environments where other privileged local processes may access user files.

6. Document that the records contain potentially sensitive health information and provide users with secure deletion and retention controls.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill’s declared purpose is narrowly health-related, but the documented behavior exposes broader free-form logging, local storage inspection, search, and export functionality that are not clearly scoped to vitamin tracking. This mismatch can cause an agent or user to invoke the skill in inappropriate contexts, leading to unintended collection, persistence, and disclosure of sensitive personal health or arbitrary user data.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script defines two identical export) branches in the case statement, so the first one captures all export invocations and merely logs arbitrary user input instead of performing an export. This mismatch can cause users to believe they are exporting or managing health records when they are actually appending sensitive data to a plaintext log, undermining user expectations and increasing privacy risk in a health-related tool.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The invocation guidance is broad enough that an agent may route many loosely related health or self-care requests into this skill without strong boundaries. In a health-data context, overbroad triggering increases the chance of collecting irrelevant sensitive information and storing it locally under a misleadingly narrow tool description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The tool persistently stores user-provided vitamin and supplement information in plaintext under ~/.local/share/vitamin without any privacy notice, consent flow, retention policy, or permission hardening. Because this is health-related data, silent local persistence increases the chance of accidental disclosure to other local users, backups, support tooling, or malware scanning user directories.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest describes a tool for tracking vitamin and supplement intake, goals, reminders, and reviewing dose history. However, the command set includes broad, domain-agnostic operations like chart, weekly, monthly, compare, streak, milestone, and trend, and each simply records arbitrary free-form input to separate log files rather than implementing vitamin-specific tracking behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The export routine aggregates all recorded health logs into additional plaintext files (export.json, export.csv, export.txt) in the same user-accessible directory without warning the user that new copies of sensitive records are being created. Creating extra unprotected copies expands the exposure surface and makes later deletion, sharing mistakes, and leakage through backups or sync tools more likely.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.