Calorie Tracker

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:40 AM UTC
• Version: 1.0.24

Overview

This health-tracking skill is purpose-aligned but needs Review because its privacy promises conflict with mandatory cloud analysis and it broadly handles health data credentials.

Before installing, assume food and exercise descriptions, image URLs, weight and BMI data, screenshots, email addresses, and access tokens may be sent to and stored by the provider. Avoid uploading full app or device screenshots with extra personal details, and install only if you are comfortable with cloud processing, token reuse, and 24-month data retention as described.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

other

Error

• Location: food-analyzer.md:46
• Finding: Mandatory External Transmission of Complete Food Descriptions and Image URLs## Vulnerability Details **File Location**: `food-analyzer.md:46-63` **Vulnerability Type**: Undisclosed personal data exfiltration **Risk Level**: High **Vulnerable Instruction:** ```markdown - Note: - At least one of description or image_urls must be provided - **Original Input Pass-Through Principle (Mandatory Enforcement)**: - Must pass the user's original food description input **completely and verbatim** to the description parameter, **strictly prohibiting any form of processing** - Prohibited behaviors include but are not limited to: - Summarization - Extracting key information and rewriting - Omitting details - Reorganizing language or adjusting expression order - Deleting any words, interjections, or modifiers from user input - Must pass the user's originally uploaded image URLs **directly** to the image_urls parameter - **Strictly prohibited** to perform content recognition on images and convert them to text descriptions before calling the interface - Judgment criteria: Any difference (regardless of size) between the description or image_urls content and the user's original input is considered a violation ``` ### Technical Analysis The skill mandates transmitting the user's complete food-related input to the external `/foods/analyze` service without minimization or redaction. Food descriptions constitute personal health information and may also contain names, locations, medical conditions, medication information, or unrelated conversational content. The instruction explicitly prohibits removing any words or modifiers. It therefore prevents the agent from applying normal data-minimization controls. Directly forwarding image URLs is similarly unsafe because URLs may contain signed query parameters, access tokens, account identifiers, or private storage paths. The confirmation process in `SKILL.md` applies to persistent record storage, but the external ...[truncated 1126 chars]
• Remediation: ## Remediation Suggestions - Obtain explicit, informed consent before sending any text or image information to an external analysis service. - Clearly identify the external provider, transmitted fields, processing purpose, retention period, and applicable privacy policy. - Extract and transmit only the minimum fields required for analysis, such as food name, quantity, and cooking method. - Redact names, contact details, locations, medical details unrelated to nutrition, and other incidental content. - Remove credentials, signatures, and identifying query parameters from image URLs. - Prefer short-lived service-mediated image references rather than forwarding original URLs. - Provide a genuinely local-only analysis mode and make external analysis opt-in. - Ensure that refusing storage also permits the user to refuse external analysis.

other

Error

• Location: exercise-analyzer.md:45
• Finding: Mandatory External Transmission of Complete Exercise Descriptions and Image URLs## Vulnerability Details **File Location**: `exercise-analyzer.md:45-62` **Vulnerability Type**: Undisclosed personal data exfiltration **Risk Level**: High **Vulnerable Instruction:** ```markdown - Note: - At least one of description or image_urls must be provided - **Original Input Pass-Through Principle (Mandatory Enforcement)**: - Must pass the user's original exercise description input **completely and verbatim** to the description parameter, **strictly prohibiting any form of processing** - Prohibited behaviors include but are not limited to: - Summarization - Extracting key information and rewriting - Omitting details - Reorganizing language or adjusting expression order - Deleting any words, interjections, or modifiers from user input - Must pass the user's originally uploaded image URLs **directly** to the image_urls parameter - **Strictly prohibited** to perform content recognition on images and convert them to text descriptions before calling the interface - Judgment criteria: Any difference (regardless of size) between the description or image_urls content and the user's original input is considered a violation ``` ### Technical Analysis The exercise analyzer mandates sending complete exercise descriptions and original image URLs to the external `/exercises/analyze` service. Exercise descriptions may disclose health conditions, physical limitations, locations, schedules, device readings, heart-rate information, or other biometric data. Requiring verbatim transmission removes the possibility of data minimization. The direct use of image URLs can additionally expose URL-embedded credentials and private storage information. The skill does not require separate consent for this external analysis operation; its explicit confirmation requirement concerns only subsequent record storage. ### Attack Path 1. A user describes an exercise session, potential ...[truncated 820 chars]
• Remediation: ## Remediation Suggestions - Require informed opt-in consent before every initial external exercise-analysis operation. - Minimize requests to necessary attributes such as exercise type, duration, and intensity. - Remove unrelated symptoms, names, precise locations, schedules, and identifiers unless strictly required and explicitly approved. - Strip authentication material and signed parameters from image URLs. - Use controlled, short-lived image upload references with narrowly scoped access. - Document the external provider, processing purpose, retention policy, and transmitted data categories. - Provide a local processing alternative and allow users to decline external analysis independently of record storage.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:116
• Finding: Privacy Assurance Contradicts Mandatory Cloud Analysis Behavior## Vulnerability Details **File Location**: `SKILL.md:116-125` **Vulnerability Type**: Misleading privacy configuration and disclosure **Risk Level**: High **Vulnerable Instruction:** ```markdown ### Data Processing Localization All data processing is completed locally to ensure user privacy and data security: - **Semantic Analysis and Reasoning**: Local large models complete natural language understanding, nutrition estimation, and calorie calculation; - **Data Isolation**: All user raw data (text) is processed locally only, and is not uploaded to any external servers. - **Temporary Data**: All temporary processing data (text intermediate results) is immediately cleared after task completion, without establishing any form of local data persistence or logging; ### External Service Interfaces This skill uses the following external API services for data storage and query: - United States: `https://us.guangxiankeji.com/calorie/service/user/api-spec` - China: `https://cn.guangxiankeji.com/calorie/service/user/api-spec` ``` ### Technical Analysis The skill states that all raw text remains local and is never uploaded to external servers. That assertion directly conflicts with `food-analyzer.md` and `exercise-analyzer.md`, which mandate sending original descriptions verbatim to cloud analysis endpoints. The external-service disclosure describes the service as being used for storage and queries, omitting its processing of raw food and exercise descriptions and image URLs. Users therefore cannot make an informed decision about sharing health information. This discrepancy is security-relevant because the inaccurate assurance may cause users to disclose information they would not provide if external processing were accurately disclosed. ### Attack Path 1. The user reads or relies on the statement that raw text is processed locally only. 2. Based on that assurance, the user supplies sensitive food, exercise, or health-relat ...[truncated 475 chars]
• Remediation: ## Remediation Suggestions - Remove the claim that all raw data remains local while cloud analysis is enabled. - Enumerate all external analysis, storage, authentication, and query operations. - Identify the exact categories of text, images, URLs, credentials, and health data transmitted. - Explain the processing purpose, service provider, jurisdiction, retention period, and deletion procedure. - Introduce explicit consent before external analysis rather than relying only on storage confirmation. - Ensure the published privacy policy and in-skill disclosures are consistent with actual runtime behavior. - Add automated documentation tests that detect contradictions between privacy declarations and module instructions.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: api-service.md:37
• Finding: Bearer Tokens Are Persisted and Propagated Across Agents and Channels## Vulnerability Details **File Location**: `api-service.md:37-74` **Vulnerability Type**: Excessive credential propagation and insufficient credential isolation **Risk Level**: High **Vulnerable Instruction:** ```markdown ### Token Management - **Token Validity**: Access token validity is based on the information returned by the login endpoint - **Token Storage**: Agents should securely store access tokens and reuse them within the validity period - **Token Refresh**: After token expiration, re-execute the login flow to obtain a new token 3. **User Identifier** - **Transmission Method**: User identifier is passed through Bearer Token in Authorization header, server parses user information from the token. - **User Management**: Users are uniquely identified by email address, agents should store user's email address and corresponding access token. - **Stability**: The same user should use the same email address to ensure historical data association. - **Consistency**: - **Multi-agent Consistency**: Agents and all sub-agents must ensure the same email address and access token are used to ensure user data consistency. - **Multi-channel Consistency**: For multi-channel access scenarios, agents should ensure the same email address is used across different channels to guarantee user data consistency; ``` ### Technical Analysis The service uses bearer tokens, meaning possession of a token is sufficient to exercise the associated authority. The instructions require storing the email address and access token and explicitly sharing the same credentials with all sub-agents. They also promote identity continuity across channels. No concrete protections are specified for encryption at rest, secret-store isolation, token audience restrictions, least-privilege scopes, sub-agent access controls, rotation, revocation, or channel separation. Broad credential propagation increases the number of components that ca ...[truncated 1025 chars]
• Remediation: ## Remediation Suggestions - Store bearer tokens exclusively in a dedicated encrypted secret manager. - Never include access tokens in prompts, ordinary agent memory, logs, or sub-agent context. - Use a trusted credential broker to execute authenticated requests without revealing tokens to agents. - Issue short-lived, task-specific, audience-restricted, and least-privilege credentials. - Use separate tokens for separate agents and channels rather than sharing one account-wide token. - Implement revocation, rotation, expiration enforcement, and anomalous-use detection. - Bind tokens to the intended service and, where supported, use proof-of-possession credentials instead of unrestricted bearer tokens. - Avoid persisting email addresses unless necessary, and encrypt any required identity mapping.

T01 · Skill Instruction Hijacking

Error

• Location: api-service.md:13
• Finding: Agent Behavior Depends on an Unpinned Remotely Mutable API Specification## Vulnerability Details **File Location**: `api-service.md:13-51` **Vulnerability Type**: Remote instruction and interface manipulation **Risk Level**: High **Vulnerable Instruction:** ```markdown ### Interface Documentation **Important Note**: Interfaces are cloud services and may change at any time. Please obtain the latest interface information through the following addresses: **API Specification Addresses**: - United States: `https://us.guangxiankeji.com/calorie/service/user/api-spec` - China: `https://cn.guangxiankeji.com/calorie/service/user/api-spec` ### Interface Acquisition Method Agents should access the above API specification addresses in real-time to obtain the latest interface definitions, including: - Interface paths - Request methods - Parameter descriptions - Response formats - Error code definitions ## Interface Call Principles 1. **Active Acquisition**: Actively obtain latest interface information, must re-acquire when call fails 2. **Dynamic Adaptation**: Dynamically adjust call methods based on obtained interface specifications 3. **Error Handling**: Handle call failures caused by possible interface changes 4. **Retry Strategy**: For call failure situations, perform up to 3 retries, with 1 second interval between each retry 5. **Version Compatibility**: Consider version change compatibility handling ``` ### Technical Analysis The skill delegates runtime API behavior to remotely hosted, mutable documentation. Agents are instructed to retrieve the specification in real time and dynamically alter request methods, paths, parameters, and response handling. The skill does not define a pinned schema version, cryptographic signature verification, strict hostname and path allowlists, approved HTTP methods, fixed request-field schemas, or separation between untrusted documentation and executable agent instructions. If the remote specification or its hosting infrastructure is compromised, ...[truncated 1369 chars]
• Remediation: ## Remediation Suggestions - Bundle a reviewed, version-pinned API schema with the skill. - Require cryptographically signed specification updates and verify signatures against a pinned public key. - Allow only predefined HTTPS hosts, paths, HTTP methods, content types, and request fields. - Reject redirects to unapproved origins and prohibit credentials from being forwarded across redirects. - Parse remote specifications strictly as untrusted structured data, never as natural-language agent instructions. - Validate fetched schemas against a local meta-schema and reject unexpected operations or sensitive fields. - Require explicit review and a skill update for security-sensitive interface changes. - Apply fail-closed behavior when the pinned schema cannot be validated rather than dynamically adapting to arbitrary remote changes.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (19)

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The skill claims that all data processing is completed locally and that raw user data is not uploaded to external servers, but elsewhere explicitly documents external API services for storage/query and cloud retention of personal health data. This contradiction can mislead users into disclosing sensitive health information under false privacy assumptions, undermining informed consent and increasing legal/compliance risk.

Credential Access

High

• Category: Privilege Escalation

Content

### Authentication Flow
1. **Send Verification Code**: Send a POST request to `/auth/send-code` endpoint with email address to obtain verification code
2. **Login to Get Token**: Send a POST request to `/auth/login` endpoint with email address and verification code to obtain access token
3. **Use Token**: Pass token in `Bearer <access_token>` format in the Authorization header of subsequent API requests

### Token Management

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

3. **Use Token**: Pass token in `Bearer <access_token>` format in the Authorization header of subsequent API requests

### Token Management
- **Token Validity**: Access token validity is based on the information returned by the login endpoint
- **Token Storage**: Agents should securely store access tokens and reuse them within the validity period
- **Token Refresh**: After token expiration, re-execute the login flow to obtain a new token

• Confidence: 87% confidence
• Finding: The instruction to store and reuse access tokens creates a real credential-handling risk because bearer tokens grant account access to calorie and health-related records. Without strict constraints on storage location, encryption, scoping, and log exclusion, agent memory, tool logs, or shared state may leak tokens and enable unauthorized API access.

Credential Access

High

• Category: Privilege Escalation

Content

### Token Management
- **Token Validity**: Access token validity is based on the information returned by the login endpoint
- **Token Storage**: Agents should securely store access tokens and reuse them within the validity period
- **Token Refresh**: After token expiration, re-execute the login flow to obtain a new token

### Service Address Change Handling

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Self-Modification

High

• Category: Rogue Agent

Content

### Service Address Change Handling

**Service Discovery Mechanism**: If API service cannot be accessed after multiple retries, it may indicate that the service address has migrated. Please visit [ClawHub](https://clawhub.ai/) or other skill markets, search and update this skill to obtain the latest API service address.

## Interface Call Principles

• Confidence: 95% confidence
• Finding: The skill directs the agent to visit an external marketplace and update the skill if the service becomes unavailable, which is a self-modification/update path outside a pinned, trusted source. An attacker controlling DNS, a marketplace listing, or a lookalike update could steer the agent toward malicious instructions or a swapped endpoint, making this especially risky because the skill also handles bearer tokens and health-related user data.

Credential Access

High

• Category: Privilege Escalation

Content

3. **User Identifier**
   - **Transmission Method**: User identifier is passed through Bearer Token in Authorization header, server parses user information from the token.
   - **User Management**: Users are uniquely identified by email address, agents should store user's email address and corresponding access token.
   - **Stability**: The same user should use the same email address to ensure historical data association.
   - **Consistency**:
      - **Multi-agent Consistency**: Agents and all sub-agents must ensure the same email address and access token are used to ensure user data consistency.

• Confidence: 91% confidence
• Finding: This section explicitly instructs agents to store a user's email address together with the corresponding access token as a persistent identifier. Combining personal identifiers with bearer credentials is especially dangerous in a health-tracking skill because compromise can expose sensitive diet, exercise, and inferred health data while also enabling direct account access.

Credential Access

High

• Category: Privilege Escalation

Content

- **User Management**: Users are uniquely identified by email address, agents should store user's email address and corresponding access token.
   - **Stability**: The same user should use the same email address to ensure historical data association.
   - **Consistency**:
      - **Multi-agent Consistency**: Agents and all sub-agents must ensure the same email address and access token are used to ensure user data consistency.
      - **Multi-channel Consistency**: For multi-channel access scenarios, agents should ensure the same email address is used across different channels to guarantee user data consistency;
   - **Privacy Statement**:
      - **Usage Purpose**: Email address is only used for user authentication and data association, not for other purposes.

• Confidence: 93% confidence
• Finding: Requiring all sub-agents and channels to reuse the same email and access token materially increases the credential exposure surface. Every additional agent, channel, or context that receives the bearer token becomes another place it can be leaked, mishandled, or abused, magnifying the blast radius of a single compromise.

Credential Access

High

• Category: Privilege Escalation

Content

- **Multi-channel Consistency**: For multi-channel access scenarios, agents should ensure the same email address is used across different channels to guarantee user data consistency;
   - **Privacy Statement**:
      - **Usage Purpose**: Email address is only used for user authentication and data association, not for other purposes.
      - **Privacy Protection**: Access token is only sent when user identity needs to be confirmed, and is not directly associated with users' real identity information.

4. **Time Handling**
   ### 4.1 Principles

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The markdown presents strong local-processing/privacy assurances while the skill behavior includes external cloud storage and query APIs, without a clear upfront warning at the point users are asked to provide health data. In a health-tracking context, this makes the issue more dangerous because users may reasonably expect especially sensitive food, exercise, and weight data to remain local.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The skill instructs agents to transmit and persist privacy-sensitive identifiers and bearer tokens, but does not require explicit user consent, minimization, retention limits, or secure handling boundaries. In an agent ecosystem, this can lead to unnecessary storage or sharing of authentication material across components, increasing the chance of account takeover or privacy leakage if logs, memory, or sub-agents are exposed.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: Line L003 states the module parses exercise information through 'natural language interaction, voice input, and image uploads'. However, the only documented API parameters are 'description' and 'image_urls' (L042-L047), and the processing flow only branches into text, image, or text+image input without any voice-specific handling (L089-L097). This is an active contradiction between the module description and the documented behavior.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The module explicitly instructs passing the user's original exercise description verbatim and uploading original image URLs to external APIs, but does not warn users that their text and image references are sent off-system. In a health-tracking context, this can expose sensitive wellness data and linked resources without informed consent, increasing privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly requires sending the user's original food description and uploaded image URLs verbatim to an external analysis API, but provides no requirement to warn the user, minimize data, or obtain consent before transmission. In a health-tracking context, free-form food descriptions and images can contain sensitive health, lifestyle, location, or identifying information, so mandatory verbatim pass-through increases privacy exposure and data-leak risk.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The module explicitly records, compares, and analyzes weight data together with related health attributes such as age, gender, height, and body fat percentage, which are sensitive health-related personal data. The file provides workflow and storage/analysis behavior but omits any privacy notice, consent requirement, retention limits, or handling restrictions, increasing the risk of over-collection, unauthorized retention, or improper downstream use.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill encourages users to upload photos of health apps, wearable devices, and full interfaces that may contain sensitive health information and additional identifiers such as names, account details, timestamps, device IDs, or other on-screen notifications. Because the instructions lack any warning to review, crop, or redact images before upload, users may unintentionally disclose more sensitive information than needed.

Natural-Language Policy Violations

Low

• Confidence: 79% confidence
• Finding: The instruction to 'Use local time for user input and display' imposes a locale/timezone behavior as a requirement. Under the policy, locale-related behavior should either be user-selectable or explicitly justified as a documented constraint.

Intent-Code Divergence

Low

• Confidence: 88% confidence
• Finding: Line L003 says the module is 'calculating calories consumed by exercises', which semantically implies intake rather than calories burned. The remainder of the document repeatedly describes 'calorie expenditure' estimation for exercise (for example L011, L018-L023, and L107). This is a direct intent/documentation contradiction that could mislead users or downstream developers about the module's purpose.

Scope Creep

Low

• Category: Excessive Agency

Content

- At least one of description or image_urls must be provided
  - **Original Input Pass-Through Principle (Mandatory Enforcement)**:
    - Must pass the user's original food description input **completely and verbatim** to the description parameter, **strictly prohibiting any form of processing**
    - Prohibited behaviors include but are not limited to:
      - Summarization (e.g., simplifying "I had two fried eggs with a cup of soy milk this morning" to "fried eggs + soy milk")
      - Extracting key information and rewriting (e.g., rewriting "about 100 grams or so of chicken breast" to "chicken breast 100g", losing uncertainty information)
      - Omitting details (e.g., simplifying "I ate braised pork, it was a bit salty" to "braised pork", losing state description)

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Scope Creep

Low

• Category: Excessive Agency

Content

- At least one of description or image_urls must be provided
  - **Original Input Pass-Through Principle (Mandatory Enforcement)**:
    - Must pass the user's original food description input **completely and verbatim** to the description parameter, **strictly prohibiting any form of processing**
    - Prohibited behaviors include but are not limited to:
      - Summarization (e.g., simplifying "I had two fried eggs with a cup of soy milk this morning" to "fried eggs + soy milk")
      - Extracting key information and rewriting (e.g., rewriting "about 100 grams or so of chicken breast" to "chicken breast 100g", losing uncertainty information)
      - Omitting details (e.g., simplifying "I ate braised pork, it was a bit salty" to "braised pork", losing state description)

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Static analysis

No suspicious patterns detected.