T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:13- Finding
Exclusive Skill Routing and Forced Output Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
Fitness encyclopedia
Security checks for vulnerabilities and agentic risk
Overview
This fitness skill appears purpose-built rather than malicious, but it needs Review because it broadly forces activation and collects health/body information without enough privacy, safety, or user-control disclosure.
Install only if you are comfortable with a fitness assistant that may activate very broadly on fitness-related wording and ask for personal body, diet, and joint/injury details. Do not treat its nutrition, injury, or rehabilitation suggestions as medical advice, and review the calorie calculations before relying on them. Prefer a pinned, reviewed install version instead of mutable latest commands.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
README.md:33- Finding
Mutable Unpinned Package Executed Through npx
- Content
View full analysis
- Remediation
View remediation
install fitness-encyclopedia ``` 2. Pin the installed Skill version as well: ```bash npm install fitness-encyclopedia@1.0.0 ``` 3. Publish expected package integrity hashes or documented signature-verification steps. 4. Recommend lockfiles and deterministic installation mechanisms where supported. 5. Review the resolved package's lifecycle scripts and dependency tree before recommending execution. 6. Use npm provenance or equivalent registry signing and build-attestation features. 7. Avoid instructing users to run remote package executables with elevated privileges. 8. Establish a release process that updates documented versions only after security review. ]]>
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (32)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill uses mandatory broad keyword and catch-all triggering for common fitness-related language, forcing activation even when the user's request may only be tangentially related. This can hijack normal routing, suppress better-matched assistants, and steer users into a prescriptive workflow without clear consent.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The automatic trigger phrases are extremely broad (
fitness,exercise,training,gym) and are likely to activate during ordinary conversation that is not an explicit request to use the skill. This can cause unintended invocation, unnecessary processing of user messages, and collection of health-related context without clear consent, which is more concerning here because the skill solicits personal body and injury information.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The showcased interaction is entirely in Chinese and instructs the user to reply with a number, but the surrounding README is in English and does not state that the skill is Chinese-only or user-selectable by language. This creates a natural-language policy concern because it implies a fixed language/locale experience without user opt-in.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly collects sensitive health/body data including gender, height, weight, age, body fat percentage, joint limitations, and dietary restrictions, but the README provides no privacy notice, retention policy, or handling guarantees. In a fitness and injury-assessment context, this increases the risk of users disclosing sensitive personal and health-adjacent information without informed consent or clear data minimization safeguards.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md **Forbidden Behaviors**: - ❌ Do NOT fail to trigger and let other assistants respond - ❌ Do NOT ask the user to "please specify your needs" - ❌ Do NOT display function lists from other skills ---
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill requires collection of body and health-related data such as gender, height, weight, age, body fat percentage, and joint limitations, but provides no privacy notice, minimization guidance, or consent language. This creates unnecessary exposure of sensitive personal and health information and may pressure users to disclose more than needed.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The catch-all instruction says any fitness-related question must trigger the skill, but elsewhere the skill also defines more specific handling categories. This ambiguity increases the chance of over-triggering and routing conflicts, causing the skill to intercept benign knowledge queries or health-related questions that may need safer or more specialized handling.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger list is broad enough to activate on many ordinary health and fitness conversations, which can cause the skill to be invoked outside clearly intended contexts. In a health-related skill, over-triggering is risky because users may receive unsolicited or contextually inappropriate wellness guidance, increasing the chance of misleading advice or unintended data exposure through unnecessary engagement.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger list is very broad and includes common terms such as 'fitness', 'workout', 'training', 'gym', and 'exercise', which can cause the skill to activate for many ordinary health-related conversations. This increases the chance of unintended invocation, causing the agent to respond in contexts the user did not explicitly intend and potentially exposing health-related guidance inappropriately.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest trigger list is broad and composed of common fitness-related terms such as 'fitness', 'workout', 'training', and 'exercise', which are likely to match many ordinary user requests beyond cases where this specific skill is explicitly desired. This can cause the skill to activate opportunistically, increasing the chance it intercepts unrelated health or wellness queries and influences users with unscoped advice.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The document gives specific intake targets and prescriptive diet guidance for fat loss and muscle gain without a clear disclaimer that advice should be adapted for age, pregnancy, chronic disease, eating disorders, allergies, or clinician guidance. In a skill context, users may treat these numbers as authoritative personalized advice, which can lead to inappropriate dieting or health harm for people with medical or nutritional risk factors.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This guide provides detailed physical exercise instructions but does not begin with a clear general warning that users should assess their health status, consider injuries or medical conditions, and seek professional advice when appropriate. Although the document includes some contraindications and special-population notes later, the lack of a prominent upfront safety disclaimer increases the risk that users with underlying conditions attempt unsuitable stretches and suffer injury.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The document gives structured fitness guidance that includes high-risk strength movements and intensity recommendations for beginners, but it does not include clear medical disclaimers, injury warnings, or advice to seek qualified coaching where needed. In the context of a training-plan skill, this omission increases the chance of unsafe use, poor form, overexertion, or aggravation of existing conditions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The home-workout section explicitly suggests using household items as weights without giving safety guidance about load stability, grip security, floor conditions, breakage risk, or adequate workout space. In this skill context, that can directly contribute to dropped objects, slips, impact injuries, or equipment failure during exercise.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The entire interaction guide is written as if the skill operates only in Chinese and provides no indication that users may choose another language. Per the policy rule, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill advertises health assessment, injury prevention, and rehabilitation guidance without a visible disclaimer that the assistant is not a medical professional and cannot provide medical diagnosis or treatment. In this context, users with pain or injury may over-rely on the system for medical decisions, increasing the risk of unsafe exercise advice and delayed professional care.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The guide instructs the agent to collect body metrics and health-related information such as sex, height, weight, age, body fat, joint limitations, and dietary restrictions, but it provides no notice about privacy, retention, consent, or limits on data use. This creates a real privacy and compliance risk because users may disclose sensitive personal and health-adjacent data without informed consent or safe-handling controls.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
SQP-3 applies to all file types and covers language or locale policy violations. This file forces a specific language for documentation and user-visible output, but does not provide opt-in, alternative locale support, or justification that the tool is intended only for Chinese-speaking users.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The implementation for the 'bulk' goal uses a coefficient of 0.90, which reduces calories below TDEE even though the comments and user-facing labels describe it as a muscle-gain calorie surplus. In a nutrition calculator, this can mislead users into sustained underfeeding when they believe they are eating for growth, causing ineffective training outcomes or potentially harmful dietary decisions over time.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script presents 'bulk/增肌' to users as a goal associated with calorie surplus, but the underlying calculation produces fewer calories than maintenance. Because the incorrect result is surfaced directly in user output, the mismatch is operationally dangerous in this health-related context and may induce users to follow the opposite of their intended diet plan.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code's natural-language interface is entirely in Chinese, including the program description, argument help text, error messages, and formatted output. Under the stated policy, forcing a specific language without user opt-in is a locale-policy violation unless the restriction is clearly documented and justified, which is not present here.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
A file-wide natural-language policy issue is present because all headings and instructional content are fixed to a single language. Under the stated rule, forcing one language without user opt-in or documented locale justification is a policy concern.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The document gives specific calorie-burn estimates, heart-rate guidance, and training recommendations across a large portion of the file before clearly framing them as approximate and non-medical. In a fitness context, users may treat these values as authoritative and make exercise or diet decisions that are inappropriate for their health status, especially beginners or users with medical conditions.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The document uses Chinese throughout and does not indicate that the skill is region-specific or provide any user opt-in for language or locale. Under the language/locale policy, forcing a single language without user choice or justification is a natural-language policy concern.
- Content
Static analysis
No suspicious patterns detected.