Back to skill

Security audit

健身训练计划制定助手

Security checks for vulnerabilities and agentic risk

Overview

This is a Chinese fitness-planning markdown skill with expected workout and nutrition guidance, but users should treat it as general guidance rather than medical advice.

Installers should understand this skill is designed for Chinese-language fitness planning. Users with injuries, medical conditions, pregnancy, medication constraints, or limited training experience should consult a qualified clinician or trainer and use conservative loads, especially for heavy strength or HIIT plans.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill title and all usage guidance are presented exclusively in Chinese, and the metadata names it as a China-specific fitness coach. This creates a natural-language locale constraint without stating that the user can choose another language or explicitly opt into Chinese output.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This file gives concrete workout split structures, progressive overload rules, loading percentages, repetition ranges, and recovery guidance without any screening for injuries, chronic conditions, age, pregnancy, medications, or beginner safety constraints. In a fitness-coach skill whose purpose is to generate personalized training plans, users may treat this as actionable health guidance and overtrain, aggravate injuries, or use unsafe loads without realizing they should first consult a qualified coach or clinician.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The entire skill reference is written in Chinese and does not offer any language or locale alternative. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file contains natural-language guidance exclusively in Chinese, and there is no indication that users can opt into another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The content consistently forces a specific language/locale for all user-facing guidance, and there is no indication that the user can opt into Chinese or that the skill is intentionally limited to a Chinese-speaking context. Under the language/locale policy, user-facing material should not impose a language without choice or justification.

Content

No source excerpt is available for this finding.