Family Health Tracker

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:42 AM UTC
• Version: 1.0.2

Overview

This skill is a clearly disclosed local family health tracker, but users should treat its plaintext health-data file as sensitive.

Install only if you are comfortable storing family health records in a local plaintext health-data.json file. Keep it in a private, non-shared, non-synced, non-version-controlled location, and avoid entering full policy numbers, financial account details, SSNs, or detailed therapy notes.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:20

Finding

Sensitive family health records are stored in an unprotected plaintext JSON file

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:20, SKILL.md:46-47, and sensitive-data schema at SKILL.md:52-140
Vulnerability Type: Plaintext storage of sensitive medical and identifying information
Risk Level: Medium

Vulnerable Code Snippets

SKILL.md:20:

markdown

This skill directs the assistant to read from and write to a single local file (`health-data.json`) in the user's working directory. It does not instruct the assistant to use email tools, browser automation, web search, or any external service. The skill itself ships no executable code, runs no background processes, makes no network calls, and has no telemetry. The assistant should not transmit any health data outside the local tracker file unless the user explicitly asks for that (e.g., asking for a printable summary to share with a doctor).

SKILL.md:46-47:

markdown

## Data Persistence

All data is stored in `health-data.json` in the skill's data directory.

Representative sensitive fields from SKILL.md:52-140:

json

{
  "family": [
    {
      "id": "unique-id",
      "name": "Emma",
      "relationship": "daughter",
      "dateOfBirth": "2018-05-12",
      "bloodType": "",
      "allergies": [
        {
          "allergen": "Penicillin",
          "reaction": "Hives",
          "severity": "moderate",
          "diagnosed": "2020-03-15",
          "notes": ""
        }
      ],
      "medications": [
        {
          "name": "Zyrtec",
          "dosage": "5mg",
          "frequency": "daily",
          "prescribedBy": "Dr. Patel",
          "startDate": "2024-09-01",
          "refillDate": "2026-04-15",
          "pharmacy": "CVS on Main",
          "notes": "Seasonal allergies, spring through fall"
        }
      ],
      "insurance": {
        "carrier": "Blue Cross",
        "planType": "PPO",
        "groupNumber": "",
        "memberIdLast4
...[truncated 2747 chars]

Remediation

View remediation

Remediation Suggestions

1. Define one unambiguous application-private storage location rather than using the current working directory.
2. Create the data file with owner-only permissions, such as mode 0600 on POSIX systems, and verify ownership and permissions before every read or write.
3. Encrypt health records at rest with an authenticated encryption algorithm. Store the encryption key in the operating system keychain or another dedicated secrets facility, not beside the data file.
4. Warn users and require confirmation before storing data in shared, synchronized, temporary, or version-controlled directories.
5. Recommend adding health-data.json and related temporary or backup files to version-control ignore rules.
6. Use atomic writes through a securely created temporary file in the same protected directory, then replace the destination to avoid partially written or broadly accessible copies.
7. Document secure backup, export, retention, and deletion procedures.
8. Minimize retained data and provide controls to delete individual records or the entire tracker.
9. Ensure generated summaries and exports inherit similarly restrictive permissions and require user review before disclosure.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.