HealthFit-cn

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:35 AM UTC
• Version: 4.0.0

Overview

This health-tracking skill is mostly coherent, but it needs review because it collects very sensitive health and sexual-health information and stores it locally without real encryption.

Install only if you are comfortable with a local health assistant storing sensitive health and sexual-health records in plaintext files. Avoid entering sexual-health, medication, menstrual, or diagnostic details unless you understand where the files are stored and how to delete them. Prefer a pinned or manually inspected release over the unpinned npx command, and treat the medical, supplement, and TCM guidance as informational rather than professional care.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: README_EN.md:145

Finding

Unpinned npx installation executes mutable third-party supply-chain code

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: config.json:71

Finding

Highly sensitive health and sexual-health records are stored in plaintext

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: references/storage_schema.md:76

Finding

Storage guidance presents Base64 and unauthenticated repeating-key XOR as encryption

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (148)

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · AGENTS.md (reported line 95)May include surrounding context.

Gemini CLI

配置方式（~/.gemini/config.yaml）：

yaml

system_instructions:
  - |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · HealthFit_Skill_构建报告.md (reported line 1084)May include surrounding context.

md

| 编号 | 术语 | 简短解释 | 知识库链接 |
|------|------|------|------|
| #005 | **渐进超负荷** | 每次训练逐渐增加重量/次数，是肌肉生长的核心原则 | → 术语库 #005 |
| #006 | **RM / 1RM** | Repetition Maximum，某个重量下最多能做几次。1RM = 只能做1次的最大重量 | → 术语库 #006 |
| #007 | **PR**（个人最佳） | Personal Record，你在某项运动上的历史最好成绩 | → 术语库 #007 |
| #008 | **HIIT** | 高强度间歇训练，短时间高强度与休息交替，燃脂效率高 | → 术语库 #008 |
| #009 | **EPOC 效应** | 运动后超额氧耗，俗称"后燃效应"，高强度训练后身体持续燃烧热量 | → 术语库 #009 |

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger scope is so broad that ordinary health-related conversation can activate the skill unexpectedly, causing unnecessary collection or handling of sensitive health and sexual-health context. In this skill, that is more dangerous because the skill is designed to solicit and store highly sensitive medical, TCM, and sexual data once activated.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill claims many specialized coaching and TCM features, but the analysis indicates those functions may not actually be implemented while database and backup behavior is present. Overstated capabilities combined with real data collection/storage can create a privacy and trust vulnerability, because users may disclose more sensitive information than the system legitimately needs or can safely process.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill claims many specialized coaching and TCM features, but the analysis indicates those functions may not actually be implemented while database and backup behavior is present. Overstated capabilities combined with real data collection/storage can create a privacy and trust vulnerability, because users may disclose more sensitive information than the system legitimately needs or can safely process.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill claims many specialized coaching and TCM features, but the analysis indicates those functions may not actually be implemented while database and backup behavior is present. Overstated capabilities combined with real data collection/storage can create a privacy and trust vulnerability, because users may disclose more sensitive information than the system legitimately needs or can safely process.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The skill claims many specialized coaching and TCM features, but the analysis indicates those functions may not actually be implemented while database and backup behavior is present. Overstated capabilities combined with real data collection/storage can create a privacy and trust vulnerability, because users may disclose more sensitive information than the system legitimately needs or can safely process.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The '不可越界' section establishes a narrow analytical role, but other sections normalize prescriptive recommendations. This contradiction is dangerous because downstream agent behavior often follows examples and templates more strongly than abstract policy, increasing the chance that the skill will produce health advice outside its authorized competence.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file sets explicit safety boundaries that Analyst Ray must not provide training, nutrition, or TCM advice, then later includes examples and recommendations that do exactly that. In a health-management skill, this role-confusion can cause the agent to bypass intended safeguards, deliver unqualified medical or fitness guidance, and make unsafe recommendations under the authority of a data analyst persona.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The document says sexual-health data is stored under an independent encrypted key, but later specifies a plain JSON file path, creating a direct contradiction about protection level. For sensitive sexual-health records, this mismatch can result in storage without encryption while users believe stronger safeguards are in place.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The supplement template gives prioritized recommendations, dosage, and timing without any safety warning about contraindications, medication interactions, pregnancy, chronic disease, or age-related risks. Because users are likely to treat this as actionable health advice, the template can directly facilitate unsafe self-medication or excessive supplementation.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The acupressure, moxibustion, cupping, and scraping sections give actionable instructions but omit robust contraindication warnings for pregnancy, bleeding disorders, anticoagulant use, skin disease, neuropathy, fever, allergy, cardiopulmonary disease, or improper technique. This omission materially raises the risk of burns, skin injury, bruising, fainting, asthma exacerbation, and harm from unsupervised use.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The document includes step-by-step instructions for moxibustion, cupping, gua sha, acupressure, and herbal preparation with timing, frequency, and target points, which are semi-clinical interventions carrying burn, bruising, allergy, infection, symptom-worsening, and delayed-care risks. In a consumer health skill without medical supervision, these procedural instructions can directly enable unsafe self-treatment.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file presents a simplified self-classification rule ('符合3项以上即可初步判定') and extensive treatment guidance without a prominent warning that symptoms may overlap with real medical conditions requiring professional evaluation. Users may self-diagnose based on vague traits and delay evidence-based care for conditions such as hypertension, asthma, infection, depression, or endocrine disease.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This confirmation flow protects backup of highly sensitive sexual-health data, but the warnings and consent prompt are only in Chinese. In a safety-critical consent path, operators who cannot read Chinese may confirm without understanding that private data will be included, increasing the risk of unintended disclosure through backup files or cloud sync.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The activation guidance uses broad topic categories like health, fitness, nutrition, and TCM without strong scope limits or confirmation gates. In shared AI environments, this can cause over-triggering on ordinary conversations, unnecessarily loading the skill and increasing the chance of collecting sensitive health data or steering the assistant into domain-specific behavior when the user did not intend it.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The example phrases shown for Claude.ai are everyday requests such as building a profile or discussing running and constitution, but they lack boundaries on when the skill should activate automatically. This can normalize implicit activation from casual user messages and lead to unwanted handling of medical or wellness topics as structured profile data, creating privacy and consent risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The report proposes photo upload and social sharing without any privacy or data-handling warning, despite the skill processing sensitive health, body, and possibly sexual-health information. Photo comparison features can expose identifiable biometric/body data, and sharing features can amplify disclosure risk through accidental publication or overcollection.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file is framed throughout as a concrete skill architecture and behavior specification, including storage operations, triggers, and module loading instructions. However, L1887-L1891 explicitly says the next step is to start writing the actual SKILL.md and module code, meaning the earlier material is aspirational design documentation rather than code-backed behavior. That is an intent/documentation contradiction within the same file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The document is entirely structured around Chinese-language prompts and Chinese-specific terminology and workflows, including mandatory examples and interaction text in Chinese, without offering a language choice. For a general health skill, this can violate language/locale policy expectations because users are not given an explicit opt-in or alternative locale.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document specifies collection and storage of highly sensitive health and sexual data, but the warning/consent language is deferred and not prominent where the feature is introduced. In a health-management skill, this is dangerous because users may disclose intimate data before receiving clear notice about storage, access boundaries, retention, and consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Using common everyday phrases like '今天吃什么' or '怎么祛湿' as direct functional triggers risks intercepting normal conversation without clear user intent to use the skill. Because the skill can route users into profiling, advice, and long-term storage flows, over-triggering increases privacy risk and the chance of unsafe or unwanted medical-style guidance.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The document advertises long-term local persistence and privacy features, but it does not prominently warn users at the point of use that sensitive health information will be written to disk. Because the skill handles especially sensitive categories like health and sexual-health records, insufficient upfront disclosure can lead to unintentional retention, exposure through backups, shared machines, or local compromise.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The README instructs users to run npx skills add ChenChen913/healthfit without pinning a specific package version. Because npx fetches and executes the latest available package, a compromised or maliciously updated package could run arbitrary code during installation, creating a supply-chain execution risk on the user's machine.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The phrase 帮我建立健康档案 is a natural-language request that users may make casually, yet it appears to initiate profile creation for a system that stores health data locally. Without explicit confirmation or warning, the skill may begin sensitive data collection unexpectedly, which is risky given the medical and personal nature of the information involved.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.