Security audit

Life State

Security checks across malware telemetry and agentic risk

Overview

This skill coherently logs user-provided wellness check-ins to local files, but users should know those notes can persist and be reused by other lifekit skills.

Install this only if you are comfortable with mood, energy, soreness, sleep quality, and notes being saved locally in plain JSON where other lifekit skills and local tools can read them. Avoid putting sensitive medical details in notes unless your local storage and backups are protected, and use LIFE_STATE_DIR if you want the files somewhere specific.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The README explicitly states that daily mood, energy, soreness, sleep quality, and notes are written persistently to a predictable path under the user's home directory, but it does not warn users about the privacy sensitivity of this health- and behavior-related data or the retention implications. In the context of a personal-AI memory skill, this increases the chance users store sensitive personal information without informed consent, which could later be exposed through backups, shared machines, permissive filesystem settings, or other tools that read the same directory.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger set includes very broad everyday phrases like 'I feel', 'today I am', and 'energy is', which can cause the skill to activate during ordinary conversation rather than an intentional logging flow. Because this skill writes persistent wellness data to disk, accidental invocation can capture sensitive health-like information or overwrite daily state without clear user intent.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly stores daily mood, energy, soreness, sleep quality, and notes in a stable on-disk location, but does not warn the user about this persistence at the point of use. This creates a privacy risk because sensitive wellness data may be retained locally or in shared/containerized environments without the user's informed consent.

Shadow Command Trigger

Medium

Category: Trigger Abuse
Confidence: 89% confidence
Finding: The trigger phrase 'log mood' begins with a generic built-in command term, increasing the chance that command routing will misfire or that users intending a different 'log' action will invoke this skill instead. In this skill's context, a routing collision is more dangerous because it can lead to unintended persistence of personal wellness data.

Shadow Command Trigger

Medium

Category: Trigger Abuse
Confidence: 89% confidence
Finding: The trigger phrase 'log energy' similarly conflicts with a generic built-in 'log' command namespace, making accidental activation plausible. Since this skill updates a persistent per-day state file using merge semantics, misrouting can silently modify sensitive state and affect downstream skills that consume it.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.