T09 · Insecure Skill Coding Practices
Error
- Location
scripts/pregnancy_helper.py:29- Finding
Pregnancy Health Data Stored in Plaintext Without Restrictive File Permissions
- Content
View full analysis
- Remediation
View remediation
Security audit
Pregnancy Care
Security checks for vulnerabilities and agentic risk
Overview
This pregnancy tracker is purpose-aligned but needs review because it stores and retains sensitive pregnancy data locally without clear privacy, deletion, or user-isolation safeguards.
Install only if you are comfortable with pregnancy-related information being stored locally in plaintext and potentially retained after tracking stops. Before use, the publisher should add clear consent, documented storage and deletion behavior, stronger per-user isolation, restrictive file permissions or secure storage, and avoid creating persistent memory for birth or pregnancy status without explicit confirmation.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/pregnancy_helper.py:56- Finding
Caller-Controlled User Identifiers Permit Cross-User Record Access and Modification
- Content
View full analysis
1: cmd = sys.argv[1] u_id = sys.argv[2] if len(sys.argv) > 2 else "test_user" if cmd == "context": val = sys.argv[3] if len(sys.argv) > 3 else None print(json.dumps(get_pregnancy_context(u_id, val), indent=2, ensure_ascii=False)) elif cmd == "complete": task = sys.argv[3] print(mark_task_complete(u_id, task)) elif cmd == "add_custom": title = sys.argv[3] week = int(sys.argv[4]) print(add_custom_milestone(u_id, title, week)) elif cmd == "archive": print(archive_pregnancy(u_id)) else: print("Usage: python pregnancy_helper.py [context|complete|add_custom|archive] [user_id] [args...]") ``` ### Technical Analysis The CLI accepts `user_id` directly from a command-line argument and uses it as the key for records in a shared datastore. No authentication, ownership check, capability validation, or trusted mapping binds the supplied identifier to the caller. All read and write functions rely on the same caller-controlled identifier. The affected operations include retrieving pregnancy context, changing the LMP through the context command, completing tasks, adding custom milestones, assigning roles through library calls, and archiving a pregnancy. This is an insecure direct obje ...[truncated 1725 chars]- Remediation
View remediation
other
Warning
- Location
SKILL.md:62- Finding
Stop-Tracking Workflow Retains Health Records and Directs Persistent Memory Duplication
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (9)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
The code is related to pregnancy care, but it implements only a narrow subset of the declared functionality. It provides static milestone/advice data and simple helper functions for trimester lookup and upcoming checklist items. It does not show multiple-user management, personalized recommendations, full gestational age tracking features, or distinct weekly updates. So the description overstates the implemented capabilities enough to constitute a mismatch.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill instructs the agent to call a helper script that stores and updates pregnancy-related user data, but the manifest declares no explicit tool scope or permission boundaries. In a multi-user, sensitive-health context, undeclared file read/write capabilities increase the risk of unintended data access, persistence, or cross-user leakage because operators and users cannot clearly see what storage actions are authorized.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill handles highly sensitive health and role data for multiple users but does not warn users that such data may be stored and separated by user identity. In a pregnancy-care context, lack of disclosure around collection and retention increases privacy risk and can lead to users sharing medical information without informed consent, especially where multiple-user isolation is only described, not proven.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill explicitly instructs agents to archive user data and create a Core Memory entry when pregnancy tracking ends, but it gives no user-facing retention warning or consent step. Because pregnancy status and birth events are sensitive health and family data, silent archival can create long-lived records that outlast the user's expectation and increase exposure in future interactions.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The persona section instructs the agent to address the pregnant person as "She" when speaking to a partner. This forces a specific gendered reference without confirming the user's preferred language or pronouns, which is a natural-language policy issue.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This code contains user-facing titles, descriptions, and advice primarily in Chinese, while also mixing in English labels. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the locale constraint is clearly documented and justified, which is not present here.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The code persists highly sensitive pregnancy-related data, including last menstrual period, role/relationship information, completed tasks, and custom milestones, to a predictable local JSON file without any consent flow, notice, encryption, or access-control mechanism. In a multi-user or shared-host environment, this creates a real confidentiality risk because intimate health data may be exposed through local filesystem access, backups, logs, or improper workspace sharing.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The usage guide lists "Update me" as a user phrase for invoking the pregnancy status flow. This phrase is very generic in everyday conversation and the document does not provide limiting context or negative examples to clarify when it should activate this skill versus other update-related tasks.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The natural-language documentation and parsing logic explicitly support Chinese-formatted dates using 年/月/日 while not offering any locale selection mechanism. This introduces a locale-specific behavior in the skill without documenting it as region-specific or making it user-selectable.
- Content
Static analysis
No suspicious patterns detected.