Security audit
Security checks for vulnerabilities and agentic risk
This skill is not overtly malicious, but it should be reviewed because it can ask for binary gender in a headache-related interaction before giving simple ASMR links.
Before installing, consider whether users should be asked to disclose male/female gender for headache-relief audio recommendations. The skill should ideally make ASMR support opt-in, allow users to decline gender disclosure, and keep medical escalation guidance for severe or persistent symptoms.
The skill instructs the assistant to require a binary male/female classification before providing a recommendation, despite no clear safety or functional justification in the skill content. This creates unnecessary collection of sensitive personal data, excludes non-binary users, and can pressure users to disclose demographic information in a vulnerable health-related interaction.
The activation conditions are broad enough to trigger on ordinary mentions of headaches, migraines, or head pain, which can cause the skill to engage without a clear user request for this specific ASMR workflow. In a health-adjacent context, unintended activation increases the chance of irrelevant or inappropriate recommendations and may steer users into a scripted path that collects sensitive information unnecessarily.
