Security audit
Security checks for vulnerabilities and agentic risk
This skill appears purpose-built for VITA health lookups, but it can access sensitive personal health data with broad triggers and limited per-request consent guidance.
Install only if you are comfortable letting the agent use your VITA API key to retrieve personal health, wearable, and supplement data. For ambiguous health questions, explicitly tell the agent whether it should or should not access VITA, and avoid sharing outputs where sensitive health details should remain private.
The documentation instructs the agent to access and transmit sensitive health data to an external API but provides no explicit privacy warning, consent check, or data-handling constraints. In a health context, missing notice and consent controls raises the likelihood of unauthorized collection, transmission, or over-sharing of regulated or highly personal information.
The skill description is broad enough to trigger on generic health-related queries, which can cause the agent to access highly sensitive personal health data when the user may only be asking for general wellness advice. Because health data is especially sensitive, overbroad activation materially increases the risk of unintended data access and disclosure.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Add `get_todays_outlook` for raw wearable numbers (HRV, sleep score, recovery %)
- Add `get_protocols` when the user asks about supplements or what to take
- Call all 3 in parallel for a complete daily briefing
- Interpret data yourself — do not ask the user to explain their metrics
- If you get a 401, the key may have been deleted — ask the user to generate a new one in VITA Settings
No suspicious patterns detected.