Security audit
Security checks for vulnerabilities and agentic risk
The skill is marked suspicious because scanners report that a grocery-shopping skill also offers prescription access, including retrieval of records across linked patient profiles.
Consider the suspicious verdict and the reported access to sensitive prescription information, including records for linked patients, before installing. The scan is incomplete: one executable script was only partially inspected, and a tool-misuse analysis was degraded.
The grocery-focused activation description does not disclose prescription access, a materially different and sensitive capability available through the same skill. Coupons, recipes, and related shopping features are reasonable extensions, but pharmacy access expands the privacy boundary; its explicit documentation and separate sign-in reduce, rather than eliminate, that concern.
The rx command enumerates every linked patient profile and prints prescription identifiers, drug names, refill information, and other medical details without patient selection or output minimization. This can expose family members' sensitive health information unnecessarily to the agent and its output consumers; the pharmacy-session check prevents unauthenticated access but does not constrain retrieval to the user's requested patient or information.
The instructions make prescription retrieval available within a grocery-oriented skill without requiring an explicit health-data authorization decision. Separate pharmacy authentication is a useful safeguard, but an existing authenticated session does not by itself establish consent for an agent to retrieve medical information.
L49 documents a customer-profile GET endpoint and explicitly acknowledges that it contains personal data. Reading the customer's personal profile is not among the manifest's declared shopping operations, and the reference already obtains the required store context through modality preferences without this endpoint.
