T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:46- Finding
Persistent Device Fingerprinting for Correlation of Health Consultations
- Content
View full analysis
- Remediation
View remediation
Security audit
Acupoint Health Tool 经络穴位健康助手
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a disclosed health-service connector, but it requires persistent device fingerprinting and links health consultations to that stable identifier without clear user consent.
Review this skill before installing if you are uncomfortable with persistent tracking. It instructs the agent to read a machine identifier, hostname, and username, hash them into a stable client ID, and send that ID with health consultation content to health.geeyo.com. Avoid using share_create for sensitive conversations unless you intend the conversation to be available through a share link.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill directs the agent to collect OS-level machine identifiers, hostname, and username to derive a stable cross-session client ID. Even though it says to hash the values before sending, this is still device fingerprinting for a health-related skill and is not necessary to answer acupoint questions; it enables persistent user/device tracking and encourages execution of local shell commands to access sensitive host data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill omits a clear user-facing warning that it collects local machine fingerprint components to create a stable identifier. In a health consultation context, undisclosed persistent identification undermines informed consent and can link sensitive symptom history to the same device over time, increasing privacy risk even if the raw fingerprint is hashed.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The share_create feature allows publishing full conversation content via a shareable link, but the skill does not clearly warn that health-related messages may become accessible to anyone with the link. For a medical/wellness skill, this can expose sensitive personal information and create unintended disclosure if users assume sharing is private or internal.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
1. initialize（新会话）
bash curl -s -D - -X POST $BASE_URL/mcp \ -H "Content-Type: application/json" \ -H "Accept: application/json, text/event-stream" \ -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"my-agent","version":"1.0"}}}'
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The example request includes symptom details in the
messagefield and transmits them to a remote service, but the markdown does not warn users that health-related input will be sent over the network. For markdown files, user-facing documentation should disclose behaviors that may affect privacy or user data.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 75% confidence
- Finding
All user-facing instructional text in the file is written in Chinese, with no indication that another language is available or that the locale is intentionally constrained. The policy requires avoiding language or locale restrictions unless they are explicitly optional or justified.
- Content