T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:97- Finding
Shell Command Injection Through User-Controlled Food Names
- Content
View full analysis
- Remediation
View remediation
Security audit
Calorie Counter
Security checks for vulnerabilities and agentic risk
Overview
This calorie-tracking skill is mostly purpose-aligned, but it gives agents unsafe command templates for user-supplied food names and stores sensitive diet and weight data automatically in a local database.
Review this skill before installing. It keeps diet and weight records in a local plaintext SQLite database, may be invoked by broad food-related phrasing, and should not be used on shared or synced workspaces without understanding where calorie_data.db will live. The command templates should be fixed to pass arguments without a shell or with robust escaping before relying on it for untrusted food text.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file includes a 'Deleting Mistakes' section with the example command 'Delete entry 5' but does not warn that the entry will be removed from the local tracking database. Because deletion affects user data and may be irreversible, the skill description should disclose that behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The markdown explicitly documents the command 'python3 ... delete 5' but provides no caution that it performs a destructive operation on stored calorie entries. For markdown files, behaviors affecting user data should be accompanied by a warning about the impact and reversibility.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README describes persistent storage of food intake and weight data in a local SQLite database and says the agent will automatically use the skill, but it does not clearly warn users that sensitive personal health information will be retained on disk. In an agent setting, automatic logging without prominent disclosure can lead to unintentional collection of health-related data, especially on shared machines or synced workspaces.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The activation text is broad enough to trigger on common conversation about food, calories, or weight, which can cause the agent to invoke the skill in situations where the user did not clearly intend persistent health tracking. In this skill, that risk is amplified because invocation can lead to storage of sensitive diet and weight data in a local SQLite database.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill stores food intake, protein totals, goals, and weight history in persistent SQLite storage, which is health-related personal data, but the documentation does not clearly warn that this information will be retained. Users may disclose sensitive wellness data without realizing it will be stored beyond the current interaction.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This skill persistently stores sensitive health-related data, including food intake and body weight, in a local SQLite database without any user-facing notice, consent flow, or retention controls. Even though the database is local, the stored data could be exposed to other local users, backups, or malware, creating a privacy risk that is material for health data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The
delete_entryfunction permanently removes a food log entry from the database as soon as the command is invoked. While it prints a message after deletion, there is no confirmation prompt or advance warning before this destructive action occurs.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The phrase 'English language' appears as a positive characteristic in the comparison section, implying a language restriction. The file does not offer language choice, opt-in, or a documented reason for limiting the skill to English, which conflicts with the language/locale policy criteria.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The documented deletion flow allows removal by numeric ID without any warning, preview, or confirmation step, increasing the chance of accidental data loss. In a conversational-agent context, misheard or misinterpreted deletion requests could permanently remove user records with no easy recovery path.
- Content
Static analysis
No suspicious patterns detected.