HealthFit-cn

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:35 AM UTC
• Version: 4.0.0

Overview

This health-tracking skill is mostly coherent, but it needs review because it collects very sensitive health and sexual-health information and stores it locally without real encryption.

Install only if you are comfortable with a local health assistant storing sensitive health and sexual-health records in plaintext files. Avoid entering sexual-health, medication, menstrual, or diagnostic details unless you understand where the files are stored and how to delete them. Prefer a pinned or manually inspected release over the unpinned npx command, and treat the medical, supplement, and TCM guidance as informational rather than professional care.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: README_EN.md:145
• Finding: Unpinned npx installation executes mutable third-party supply-chain code<![CDATA[ ## Vulnerability Details **File Location**: `README_EN.md:145-160` **Additional Location**: `README.md:145-160` **Vulnerability Type**: Unpinned third-party installer execution **Risk Level**: Medium ### Vulnerable Code Snippet ```bash # Recommended npx skills add ChenChen913/healthfit # Install specifically for Claude Code npx skills add ChenChen913/healthfit -a claude-code # Global install npx skills add ChenChen913/healthfit -g ``` The accompanying documentation states: ```text Requires Node.js v18+. npx always fetches the latest version automatically. ``` ### Technical Analysis The recommended installation mechanism invokes an npm-distributed command without pinning the command package to a reviewed version or verifying its integrity. The code resolved and executed by `npx` can therefore change after this Skill has been audited. No lockfile, exact installer version, package integrity hash, signed release artifact, or reproducible verification procedure is supplied. This creates a supply-chain trust boundary in which control of the resolved npm package or its dependencies can translate into local code execution. This finding concerns the documented installation path. The audited Skill scripts themselves do not contain remote-fetch or payload-execution logic. ### Attack Path 1. An attacker compromises the npm package resolved by the `npx skills` invocation, one of its dependencies, or the relevant publishing account. 2. The attacker publishes a malicious version while retaining the expected package name. 3. A user follows the recommended command after the malicious version becomes current. 4. `npx` retrieves the mutable package from the external registry. 5. The package's CLI or lifecycle code executes under the invoking user's account. 6. The malicious package can access files and resources available to that account. ### Impact Assessment Successful exploitation can provide arbitrary code execution with the privileges of the user ru ...[truncated 489 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the installer to an exact, reviewed version rather than automatically resolving the latest release. 2. Document the exact npm package that `npx` executes, including its publisher and expected registry. 3. Publish and verify cryptographic integrity hashes or signatures for release artifacts. 4. Prefer a signed release archive or another reproducible installation procedure whose content matches the audited source. 5. Add a lockfile and dependency-review process for any installer maintained by the project. 6. Remove language encouraging automatic retrieval of the latest version. 7. Warn users that installation executes third-party code with their account privileges. 8. For higher-assurance environments, recommend downloading, inspecting, verifying, and then installing a specific tagged release. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: config.json:71
• Finding: Highly sensitive health and sexual-health records are stored in plaintext<![CDATA[ ## Vulnerability Details **File Location**: `config.json:71-77` **Additional Locations**: `references/storage_schema.md:45-55,72-73,133-136`; `references/onboarding_sexual_health.md:172-204` **Vulnerability Type**: Plaintext storage of highly sensitive personal data **Risk Level**: Medium ### Vulnerable Code Snippet ```json "privacy": { "sensitive_files": [ "private_sexual_health.json" ], "require_double_confirm": true, "encrypt_sensitive": false, "security_log": "security_log.txt" } ``` The documented sensitive record includes fields such as: ```json { "common_data": { "frequency_weekly": "B", "post_sex_fatigue_level": "B", "affects_next_day_training": "A" }, "male_data": { "erectile_function_score": 7, "morning_erection_frequency": "B", "symptoms": [], "prostate_symptoms": false, "medications": [] } } ``` ### Technical Analysis The project deliberately collects medical, physiological, menstrual, medication, and sexual-health information but disables encryption for the sensitive file. The storage documentation explicitly confirms that the current implementation relies on plaintext storage, filename-based isolation, and exclusion from ordinary backups. Backup exclusion and interactive export confirmation only reduce two intentional copying paths. They do not protect data at rest from: - Other processes running as the same user. - Broad filesystem permissions. - Accidental source-control inclusion. - Desktop indexing, malware, or local synchronization software. - Manual copying or unguarded access by another account. - Storage-device loss where full-disk encryption is unavailable. The reviewed scripts do not apply owner-only permissions to sensitive directories or files. Naming a file `private_sexual_health.json` is not an access-control boundary. ### Attack Path 1. A user opts into the sensitive onboarding workflow. 2. HealthFit writes the collected information to `data/json/private_se ...[truncated 1064 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Encrypt sensitive records at rest using a vetted authenticated-encryption construction such as AES-GCM or a correctly configured high-level library. 2. Store encryption keys in an operating-system credential facility rather than beside the encrypted data. 3. Derive password-based keys using a strong, reviewed KDF with a unique random salt and an appropriate work factor. 4. Create the sensitive data directory and files with owner-only permissions, such as mode `0700` for directories and `0600` for files where supported. 5. Use atomic writes and ensure temporary files receive the same restrictive permissions and encryption. 6. Minimize collection to fields strictly necessary for a user-requested feature. 7. Establish configurable retention periods and secure deletion controls. 8. Prevent sensitive paths through a repository ignore rule and add a pre-commit secret/privacy check. 9. Clearly disclose that local storage is readable by software running with the user's account privileges. 10. Continue excluding the file from backups and exports by default, but treat that as defense in depth rather than encryption. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: references/storage_schema.md:76
• Finding: Storage guidance presents Base64 and unauthenticated repeating-key XOR as encryption<![CDATA[ ## Vulnerability Details **File Location**: `references/storage_schema.md:76-95` **Additional Location**: `references/storage_schema.md:54-65` **Vulnerability Type**: Weak and misleading cryptographic design **Risk Level**: Low ### Vulnerable Code Snippet ```python json_str = json.dumps(data, ensure_ascii=False) key = hashlib.sha256(password.encode()).digest() encrypted_bytes = bytes( [b ^ key[i % len(key)] for i, b in enumerate(json_str.encode('utf-8'))] ) return base64.b64encode(encrypted_bytes).decode('ascii') ``` The corresponding decryption logic is: ```python key = hashlib.sha256(password.encode()).digest() encrypted_bytes = base64.b64decode(encrypted_str.encode('ascii')) decrypted_bytes = bytes( [b ^ key[i % len(key)] for i, b in enumerate(encrypted_bytes)] ) return json.loads(decrypted_bytes.decode('utf-8')) ``` The same document also proposes saving a photograph's Base64 representation to JSON as an alternative to storing the original photograph. ### Technical Analysis Base64 is a reversible encoding and supplies no confidentiality. Moving Base64-encoded image bytes into JSON does not protect the image. The proposed XOR construction hashes a password once and repeats the resulting bytes across the plaintext. It does not use a per-record salt, a password-hardening KDF, a unique nonce, or an authentication tag. Consequently: - Weak passwords can be tested efficiently offline. - Reuse of the same password-derived stream leaks relationships between records. - Known or predictable JSON structure can assist analysis. - Ciphertext can be modified without authenticated tamper detection. - Corruption and malicious modification are not reliably distinguishable. The code is presented as future implementation guidance rather than an active script, so the current exploitability depends on a user or agent adopting the documented option. It is not a covert exfiltration mechanism: no encoded content is transmitted to a remote endpoint in ...[truncated 1167 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove Base64-only storage from all sections describing privacy or encryption. 2. Remove the repeating-key XOR option rather than labeling it as simple encryption. 3. Recommend only vetted authenticated-encryption primitives and maintained high-level libraries. 4. Use a unique random salt for every password-derived key and a strong password KDF. 5. Use a unique nonce as required by the selected authenticated-encryption construction. 6. Store and verify an authentication tag so tampering fails closed. 7. Keep keys separate from ciphertext and use operating-system key storage where possible. 8. Add versioned ciphertext metadata so algorithms and KDF parameters can be migrated safely. 9. Add tests for wrong passwords, malformed ciphertext, tampering, nonce handling, and interrupted writes. 10. State explicitly that encoding changes representation but does not provide confidentiality. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (148)

Agent Config Directory Access

High

• Category: Agent Snooping

Content

## Gemini CLI

**配置方式（`~/.gemini/config.yaml`）：**
```yaml
system_instructions:
  - |

• Confidence: 90% confidence
• Finding: Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

| 编号 | 术语 | 简短解释 | 知识库链接 |
|------|------|------|------|
| #005 | **渐进超负荷** | 每次训练逐渐增加重量/次数，是肌肉生长的核心原则 | → 术语库 #005 |
| #006 | **RM / 1RM** | Repetition Maximum，某个重量下最多能做几次。1RM = 只能做1次的最大重量 | → 术语库 #006 |
| #007 | **PR**（个人最佳） | Personal Record，你在某项运动上的历史最好成绩 | → 术语库 #007 |
| #008 | **HIIT** | 高强度间歇训练，短时间高强度与休息交替，燃脂效率高 | → 术语库 #008 |
| #009 | **EPOC 效应** | 运动后超额氧耗，俗称"后燃效应"，高强度训练后身体持续燃烧热量 | → 术语库 #009 |

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The trigger scope is so broad that ordinary health-related conversation can activate the skill unexpectedly, causing unnecessary collection or handling of sensitive health and sexual-health context. In this skill, that is more dangerous because the skill is designed to solicit and store highly sensitive medical, TCM, and sexual data once activated.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill claims many specialized coaching and TCM features, but the analysis indicates those functions may not actually be implemented while database and backup behavior is present. Overstated capabilities combined with real data collection/storage can create a privacy and trust vulnerability, because users may disclose more sensitive information than the system legitimately needs or can safely process.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill claims many specialized coaching and TCM features, but the analysis indicates those functions may not actually be implemented while database and backup behavior is present. Overstated capabilities combined with real data collection/storage can create a privacy and trust vulnerability, because users may disclose more sensitive information than the system legitimately needs or can safely process.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill claims many specialized coaching and TCM features, but the analysis indicates those functions may not actually be implemented while database and backup behavior is present. Overstated capabilities combined with real data collection/storage can create a privacy and trust vulnerability, because users may disclose more sensitive information than the system legitimately needs or can safely process.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The skill claims many specialized coaching and TCM features, but the analysis indicates those functions may not actually be implemented while database and backup behavior is present. Overstated capabilities combined with real data collection/storage can create a privacy and trust vulnerability, because users may disclose more sensitive information than the system legitimately needs or can safely process.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The '不可越界' section establishes a narrow analytical role, but other sections normalize prescriptive recommendations. This contradiction is dangerous because downstream agent behavior often follows examples and templates more strongly than abstract policy, increasing the chance that the skill will produce health advice outside its authorized competence.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file sets explicit safety boundaries that Analyst Ray must not provide training, nutrition, or TCM advice, then later includes examples and recommendations that do exactly that. In a health-management skill, this role-confusion can cause the agent to bypass intended safeguards, deliver unqualified medical or fitness guidance, and make unsafe recommendations under the authority of a data analyst persona.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The document says sexual-health data is stored under an independent encrypted key, but later specifies a plain JSON file path, creating a direct contradiction about protection level. For sensitive sexual-health records, this mismatch can result in storage without encryption while users believe stronger safeguards are in place.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The supplement template gives prioritized recommendations, dosage, and timing without any safety warning about contraindications, medication interactions, pregnancy, chronic disease, or age-related risks. Because users are likely to treat this as actionable health advice, the template can directly facilitate unsafe self-medication or excessive supplementation.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The acupressure, moxibustion, cupping, and scraping sections give actionable instructions but omit robust contraindication warnings for pregnancy, bleeding disorders, anticoagulant use, skin disease, neuropathy, fever, allergy, cardiopulmonary disease, or improper technique. This omission materially raises the risk of burns, skin injury, bruising, fainting, asthma exacerbation, and harm from unsupervised use.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The document includes step-by-step instructions for moxibustion, cupping, gua sha, acupressure, and herbal preparation with timing, frequency, and target points, which are semi-clinical interventions carrying burn, bruising, allergy, infection, symptom-worsening, and delayed-care risks. In a consumer health skill without medical supervision, these procedural instructions can directly enable unsafe self-treatment.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The file presents a simplified self-classification rule ('符合3项以上即可初步判定') and extensive treatment guidance without a prominent warning that symptoms may overlap with real medical conditions requiring professional evaluation. Users may self-diagnose based on vague traits and delay evidence-based care for conditions such as hypertension, asthma, infection, depression, or endocrine disease.

Natural-Language Policy Violations

High

• Confidence: 97% confidence
• Finding: This confirmation flow protects backup of highly sensitive sexual-health data, but the warnings and consent prompt are only in Chinese. In a safety-critical consent path, operators who cannot read Chinese may confirm without understanding that private data will be included, increasing the risk of unintended disclosure through backup files or cloud sync.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The activation guidance uses broad topic categories like health, fitness, nutrition, and TCM without strong scope limits or confirmation gates. In shared AI environments, this can cause over-triggering on ordinary conversations, unnecessarily loading the skill and increasing the chance of collecting sensitive health data or steering the assistant into domain-specific behavior when the user did not intend it.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The example phrases shown for Claude.ai are everyday requests such as building a profile or discussing running and constitution, but they lack boundaries on when the skill should activate automatically. This can normalize implicit activation from casual user messages and lead to unwanted handling of medical or wellness topics as structured profile data, creating privacy and consent risks.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The report proposes photo upload and social sharing without any privacy or data-handling warning, despite the skill processing sensitive health, body, and possibly sexual-health information. Photo comparison features can expose identifiable biometric/body data, and sharing features can amplify disclosure risk through accidental publication or overcollection.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The file is framed throughout as a concrete skill architecture and behavior specification, including storage operations, triggers, and module loading instructions. However, L1887-L1891 explicitly says the next step is to start writing the actual SKILL.md and module code, meaning the earlier material is aspirational design documentation rather than code-backed behavior. That is an intent/documentation contradiction within the same file.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The document is entirely structured around Chinese-language prompts and Chinese-specific terminology and workflows, including mandatory examples and interaction text in Chinese, without offering a language choice. For a general health skill, this can violate language/locale policy expectations because users are not given an explicit opt-in or alternative locale.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document specifies collection and storage of highly sensitive health and sexual data, but the warning/consent language is deferred and not prominent where the feature is introduced. In a health-management skill, this is dangerous because users may disclose intimate data before receiving clear notice about storage, access boundaries, retention, and consent.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: Using common everyday phrases like '今天吃什么' or '怎么祛湿' as direct functional triggers risks intercepting normal conversation without clear user intent to use the skill. Because the skill can route users into profiling, advice, and long-term storage flows, over-triggering increases privacy risk and the chance of unsafe or unwanted medical-style guidance.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The document advertises long-term local persistence and privacy features, but it does not prominently warn users at the point of use that sensitive health information will be written to disk. Because the skill handles especially sensitive categories like health and sexual-health records, insufficient upfront disclosure can lead to unintentional retention, exposure through backups, shared machines, or local compromise.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The README instructs users to run `npx skills add ChenChen913/healthfit` without pinning a specific package version. Because `npx` fetches and executes the latest available package, a compromised or maliciously updated package could run arbitrary code during installation, creating a supply-chain execution risk on the user's machine.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The phrase `帮我建立健康档案` is a natural-language request that users may make casually, yet it appears to initiate profile creation for a system that stores health data locally. Without explicit confirmation or warning, the skill may begin sensitive data collection unexpectedly, which is risky given the medical and personal nature of the information involved.

Static analysis

No suspicious patterns detected.