T09 · Insecure Skill Coding Practices
Error
- Location
config.json:63- Finding
Highly Sensitive Health Records Are Stored Without Encryption
- Content
View full analysis
- Remediation
View remediation
Security audit
HealthFit
Security checks for vulnerabilities and agentic risk
Overview
HealthFit is a coherent health tracker, but it stores sensitive health and sexual-health records locally without encryption and uses broad triggers that can load private profile context too easily.
Install only if you are comfortable with a local health tracker keeping plaintext health records in the skill workspace. Avoid entering sexual-health details until encryption, file permissions, retention, and deletion/export behavior are stronger, and use explicit HealthFit commands rather than casual health mentions to reduce accidental activation.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/export.py:65- Finding
CSV Formula Injection Through Exported Health Records
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (74)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill description does not clearly disclose bulk export behavior, yet the file structure and recovery/export guidance indicate JSON, text, and SQLite data can be exported to filesystem artifacts. Bulk export of sensitive health history materially changes the privacy risk profile and can lead to large-scale disclosure if triggered unexpectedly or mishandled.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill description does not clearly disclose bulk export behavior, yet the file structure and recovery/export guidance indicate JSON, text, and SQLite data can be exported to filesystem artifacts. Bulk export of sensitive health history materially changes the privacy risk profile and can lead to large-scale disclosure if triggered unexpectedly or mishandled.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
The skill description does not clearly disclose bulk export behavior, yet the file structure and recovery/export guidance indicate JSON, text, and SQLite data can be exported to filesystem artifacts. Bulk export of sensitive health history materially changes the privacy risk profile and can lead to large-scale disclosure if triggered unexpectedly or mishandled.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The trigger
PRis extremely short and ambiguous, making accidental invocation highly likely in unrelated contexts. Because the skill can access persistent health data and private records, such spurious activation can lead to privacy exposure or unintended stateful actions disproportionate to the user's actual intent.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The report states that the skill stores detailed health data, including sexual health data, but does not present a prominent upfront privacy warning, retention policy, or clear consent flow before collection/storage. Because this skill is designed for long-term profiling and cross-session persistence, users may disclose highly sensitive information without realizing it will be retained locally in multiple formats.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The trigger phrase set is broad enough to activate on ordinary health-related conversation, which can cause the skill to engage unexpectedly and solicit or process sensitive health information without sufficiently explicit user intent. In a health-management skill that supports persistent tracking and sexual-health records, accidental invocation increases privacy and consent risk beyond a typical low-stakes conversational overlap.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 78% confidence
- Finding
The skill explicitly instructs the agent to read and potentially write local files (
profile.json, drafts, logs, DB-related scripts) but does not declare any tool scope or allowed-tools boundary. That creates an authorization/visibility gap where the skill's effective data access is broader than its manifest suggests, increasing the risk of unintended access to sensitive health and sexual-health data.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The description says the skill triggers when users merely discuss broad health topics, which makes invocation boundaries unclear. For a skill handling persistent and sensitive health data, unclear boundaries increase the chance that the agent loads profile context or begins collecting sensitive information without explicit, informed user intent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Broad triggers such as generic health or training phrases increase the chance of accidental invocation during ordinary conversation. In this skill, accidental activation is more dangerous because the session startup logic immediately attempts to read persisted profile data, which may expose or act on sensitive health records without a clearly intentional request.
- Content
Shadow Command Trigger
Medium
- Category
- Trigger Abuse
- Confidence
- 76% confidence
- Finding
The natural-language trigger
log exerciseoverlaps with the built-in-style/logcommand concept, creating ambiguity in routing and command interpretation. In a stateful health-tracking skill, command-shadowing can cause unintended logging, wrong module activation, or accidental writes to persistent records.- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The privacy statement says sexual health data is excluded from backup/export by default, but disaster-recovery instructions broadly direct restoring data from backups and exporting remaining data without preserving or reiterating that exclusion. In a health context, inconsistent handling guidance for sexual-health records can cause accidental inclusion, restoration, or disclosure of highly sensitive data.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The role explicitly forbids providing training plans, yet later includes concrete plateau interventions such as deloading, changing rep ranges, and exercise substitutions. In a health and fitness skill, this boundary violation can cause the analyst persona to deliver prescriptive exercise guidance without the safeguards, scope controls, or role handoff the design claims to enforce.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The documentation says the analyst must not provide diet advice, but the anomaly and plateau handling includes nutrition prescriptions such as protein intake targets and recovery-oriented dietary recommendations. Because this skill processes sensitive health context, users may rely on these recommendations as personalized nutrition guidance despite the role not being authorized or framed to provide it.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly stores sensitive health data, achievements, and summaries in persistent local files and a database, but provides no user warning, consent flow, retention policy, or access controls. Given the skill’s scope includes health profile, body metrics, sexual health records in the broader metadata, and longitudinal tracking, silent persistence materially raises privacy, confidentiality, and regulatory risk.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The role definition explicitly forbids diet advice, but later content gives concrete nutrition guidance ('protein 1.6g/kg'). In a health-management skill, contradictory boundaries can cause the agent to bypass specialist handoff and provide advice outside its authorized scope, increasing risk of inappropriate or unsafe recommendations.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The skill has strong stop-and-refer language for acute symptoms, but it also includes sexual-function enhancement coaching that can drift into medically sensitive territory. In a fitness advisor, mixing emergency triage language with quasi-medical sexual-function guidance creates scope confusion and may lead users to rely on non-clinical advice for conditions with underlying medical causes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The workflow asks for and records health-related metrics such as heart rate, subjective exertion, and training history without an explicit privacy warning or informed-consent step. In a health-management context, collection of personal health data is especially sensitive, so omission of transparency and consent makes misuse, overcollection, and unintended retention more dangerous.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file describes persistent storage of workout and health data in JSON, text logs, and a database without any user-facing notice or consent flow. Because this is health-related behavioral data, silent retention materially raises privacy risk, especially if users do not understand what is stored, for how long, or who can access it.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
Male sexual-function enhancement coaching extends beyond a standard fitness-coach remit and enters a sensitive health domain. Because users may interpret this as treatment-oriented advice, the feature can encourage reliance on non-medical guidance for symptoms that may require professional evaluation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The skill includes Chinese text and transliterated TCM terminology in core user-facing instructions, such as "solar term调养" and later Chinese characters throughout the document. Because the file does not state that users can choose language or that the skill is restricted to a Chinese-speaking context, it effectively imposes a locale/language assumption without opt-in.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly instructs storage of sensitive health-related records, including constitution profiles and daily tongue/health logs, but does not specify consent, retention, access control, minimization, or secure handling requirements. In a health-management context, this can lead to unauthorized collection or persistence of medical-style personal data, creating substantial privacy, compliance, and secondary misuse risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The skill frames nutrition guidance around male/female categories and later provides sex-differentiated recommendations without indicating that this is optional, clarifying whether the basis is sex, gender, hormones, or physiology, or allowing a broader set of user-selected profiles. In a health advice system, this can lead to inaccurate or exclusionary recommendations for transgender, nonbinary, intersex, or hormonally atypical users, which may reduce safety and trust.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly documents persistent storage of sensitive health and diet data across JSON, text logs, and a database, but provides no user notice, consent flow, retention limits, or access controls. In a health-management context, silent persistence of medical-adjacent personal data materially increases privacy and compliance risk because users may disclose medications, biometrics, and sexual-health-related details without realizing they are being retained.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The achievement system incentivizes weight-loss, body-fat, and 'transformation' milestones without any safety framing, medical caveats, or personalization boundaries. In a health-management skill, this can encourage unhealthy dieting, overtraining, or disordered behavior—especially for vulnerable users—because gamified rewards may push users toward unsafe targets or continued tracking of sensitive health indicators.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README promotes a workflow where users upload or capture selfies for movement analysis and progress tracking, but the primary usage section presents this as a normal feature before clearly surfacing privacy, consent, retention, and biometric/health-data risks. In a health-management skill, exercise selfies can reveal sensitive health information and potentially biometric identifiers, so insufficient upfront warning and data-handling guidance can lead to unsafe collection or misuse of personal data.
- Content
Static analysis
No suspicious patterns detected.