Security audit
Security checks for vulnerabilities and agentic risk
This is a simple first-aid reference skill with no network access, credential use, hidden execution, or privileged behavior, though its medical guidance should not be treated as authoritative emergency advice.
Install only as a lightweight reference aid. Do not rely on it during a real emergency without contacting local emergency services, and be aware it creates ~/.local/share/first-aid when run.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
DATA_DIR="$HOME/.local/share/first-aid"
mkdir -p "$DATA_DIR"
#
#
#
#
The script presents multiple hard-coded emergency numbers as authoritative guidance without determining the user's locale or clearly warning that the correct number depends on country and service availability. In a first-aid skill, inaccurate emergency-contact guidance can delay contacting responders during an actual emergency, creating real-world safety risk.
This markdown file documents that the skill stores data in ~/.local/share/first-aid/, which affects user data on disk. Under the markdown criteria for missing user warnings, the description should clearly disclose what is stored and whether users can clear or avoid that storage, but it currently provides only a bare location.
No suspicious patterns detected.