Pet Vaccine Record Wallet

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:44 AM UTC
• Version: 1.0.2

Overview

This prompt-only skill mostly organizes pet vaccine records, but some examples conflict with its safety boundary by giving veterinary or travel-compliance guidance and by suggesting broad record sharing.

Review this skill before installing. It is not code-executing malware, but users should treat it only as a record organizer, avoid relying on its examples for vaccine, revaccination, antibody testing, or travel-entry decisions, and avoid creating full-record QR links unless sharing is explicitly redacted, temporary, and access-controlled.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

other

Warning

• Location: SKILL.md:129
• Finding: Generated Booster Calendar Violates the Veterinary Safety Boundary## Vulnerability Details **File Location**: `SKILL.md`, lines 129-133 **Vulnerability Type**: Conflicting medical-schedule instructions **Risk Level**: Medium **Code Snippet**: ```markdown ### Scenario 1 **User Input:** "Add my 3-year-old Golden Retriever. He got rabies (3-year), DHPP, and Bordetella vaccines on different dates." **Expected Output:** Pet profile created with vaccine timeline. Each vaccine logged with: date given, expiration, lot number placeholder, and vet clinic. Upcoming booster calendar generated. ``` ### Technical Analysis The expected output instructs the agent to generate an upcoming booster calendar. This conflicts with the explicit safety boundary elsewhere in `SKILL.md`, which limits the skill to organizing dates already printed on supplied records and prohibits medical schedule creation. If records do not contain explicit due or expiration dates, generating a booster calendar necessarily risks inferring a vaccination schedule from vaccine names, durations, or general veterinary knowledge. Such an inference can be mistaken for individualized veterinary advice. It can also cause the agent to present estimated dates as authoritative record facts. ### Attack Path 1. A user provides vaccine names and administration dates but no documented due dates. 2. The agent matches the request to Scenario 1. 3. The scenario directs the agent to generate an upcoming booster calendar. 4. The agent infers future booster dates instead of writing `Not shown on record`. 5. The user may rely on those inferred dates when making veterinary, boarding, licensing, or travel decisions. ### Impact Assessment This issue does not grant filesystem, network, execution, or administrative privileges. Its impact is confined to the integrity and safety of generated veterinary-record information. The affected scope includes users who submit incomplete vaccination records. They could receive unsupported medical scheduling ...[truncated 155 chars]
• Remediation: ## Remediation Suggestions Replace the expected output with instructions that preserve only dates explicitly shown in source records. For example: ```markdown **Expected Output:** Create a pet profile and vaccine timeline using only dates shown on the supplied records. If a due or expiration date is absent, write `Not shown on record` and advise the user to confirm it with a licensed veterinarian. ``` Additional hardening measures: - Prohibit inferred booster dates in every usage scenario and example. - Add an explicit validation rule that calendar entries require a source-record due or expiration date. - Label every tracked date as either `Verified from record`, `Missing`, or `Unclear`. - Add an acceptance test using administration dates without due dates and verify that no future schedule is generated. - Review the README and all localized examples to remove recommendations about antibody testing, revaccination decisions, treatment outcomes, and medical pricing.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:135
• Finding: Full Veterinary Records May Be Exposed Through an Unspecified QR-Code Link## Vulnerability Details **File Location**: `SKILL.md`, lines 135-139 **Vulnerability Type**: Insecure sensitive-record sharing design **Risk Level**: Medium **Code Snippet**: ```markdown ### Scenario 2 **User Input:** "The boarding kennel needs proof of Bordetella within the last 6 months. Generate a shareable record." **Expected Output:** One-page vaccine certificate PDF showing pet name, Bordetella date, expiration, vet contact, and a QR code linking to the full record. ``` ### Technical Analysis The expected output directs the agent to create a QR code linking to the full veterinary record without defining authentication, authorization, expiration, redaction, hosting, or user-consent requirements. Veterinary documents may contain owner contact information, addresses, microchip identifiers, rabies certificate numbers, tag numbers, signatures, clinic details, and unrelated medical information. A QR code is only an encoding mechanism; it does not provide confidentiality. If it contains a public, predictable, or indefinitely valid URL, anyone who sees or photographs the document can retrieve the linked record. This instruction also conflicts with `skill.json`, which declares `no_network: true`. Although the project contains no executable networking code, producing a functional remote link would require external hosting or a third-party service not disclosed by the metadata. ### Attack Path 1. A user provides a full veterinary record to prepare boarding proof. 2. The agent follows Scenario 2 and creates or recommends a remotely accessible full-record link. 3. That link is embedded in a QR code on the shareable certificate. 4. The certificate is printed, emailed, uploaded, or presented to multiple parties. 5. A recipient or bystander scans or copies the QR code. 6. If the link lacks authentication or expiration, the party gains access to the complete record rather than only the minimum boarding evidence. 7. The l ...[truncated 586 chars]
• Remediation: ## Remediation Suggestions Remove the default requirement to link the QR code to the full record. Generate a local, redacted proof document containing only the fields required by the requesting organization. If remote sharing is intentionally supported in a future version: - Obtain explicit user consent before uploading or linking any record. - Show the user exactly which fields and documents will be shared. - Redact owner addresses, unrelated medical details, payment data, signatures, microchip numbers, and certificate identifiers unless specifically required. - Use authenticated access with short-lived, revocable links rather than public URLs. - Set a defined expiration time based on the stated sharing purpose. - Prevent indexing and disable unnecessary downloads where the hosting platform supports it. - Avoid provider-specific cloud-upload recommendations unless privacy terms and access controls are explained. - Update `skill.json` so network-related declarations accurately reflect actual behavior. - Add acceptance tests confirming that QR codes cannot expose full records by default.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: Scenario 4 directly gives veterinary/treatment guidance, including revaccination decisions, antibody testing, and procedural medical next steps, which contradicts the skill's stated boundary of being an administrative proof organizer only. This scope drift is dangerous because users may rely on unqualified medical guidance presented under the authority of the skill, especially when record gaps or rabies questions can have health and legal consequences.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The acceptance test explicitly requires English-first output with no CJK text, which imposes a language restriction without any user opt-in or accessibility justification. This can cause exclusion of users who need another language, suppress user-preferred language output, and create discriminatory or non-compliant behavior in downstream deployments.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The README presents the skill’s description and all assistant responses in Chinese, even when user inputs are in English, which implies a fixed output language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly justified, which is not documented here.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The README claims the skill does not provide veterinary advice, but the example gives concrete medical guidance: suggesting antibody testing, stating a price range, and asserting that a qualifying titer means revaccination is unnecessary. That can cause users to rely on unverified health guidance for vaccination decisions, creating safety, liability, and trust risks because the skill may be interpreted as professional veterinary advice.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The examples expand the skill into assessing overdue vaccines and interpreting travel/border requirements, which goes beyond merely organizing documentary proof. That creates a risk of users receiving quasi-medical or quasi-legal compliance judgments from a tool that explicitly says it should not infer schedules, legal compliance, or travel clearance.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The skill's Scenario 4 is written entirely in Chinese and its expected output prescribes Chinese-language guidance plus specific China-centric services such as WeChat and Baidu Netdisk. This creates a locale/language policy issue because the skill otherwise does not state that it is region-specific or that the user can choose their preferred language.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: The manifest explicitly sets the skill language to "en", which is a natural-language locale constraint. The file does not indicate that users can choose another language or that the English-only restriction is justified by a region-specific requirement.

Static analysis

No suspicious patterns detected.