Security audit

Nutrition

Security checks across malware telemetry and agentic risk

Overview

This nutrition skill is local and purpose-aligned, but it automatically reads and writes sensitive health records without opt-in confirmation.

Install only if you want this skill to maintain local health and nutrition records across sessions. Review the Clawic health, nutrition, and contacts folders before and after use, and avoid sharing lab reports or medical details unless you are comfortable with local persistent notes being updated automatically.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (35)

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The instruction to write meal-level fixes and timing notes into persistent health memory files causes the agent to modify stored user health data as part of normal advisory behavior, without clear necessity or explicit consent. In a health context, this can create inaccurate or overbroad longitudinal records, propagate stale guidance across future sessions, and expand sensitive data retention beyond what the user expects from a nutrition advice interaction.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The instruction directs the skill to persist sensitive health conditions, nutrient status, monitoring schedules, and clinician-set targets into local memory artifacts, which goes beyond providing nutrition guidance and creates/updates long-lived medical records. This is dangerous because it expands the skill from advisory use into unauthorized collection and retention of health data, increasing privacy risk and enabling silent modification of user records without clear consent.

Context-Inappropriate Capability

Medium

Confidence: 85% confidence
Finding: The file instructs the skill to read personal health profile data and clinician/contact information before answering, even when many nutrition questions may not require that breadth of access. This is dangerous because it grants the skill access to sensitive medical and relationship data by default, violating least-privilege principles and increasing the chance of unnecessary exposure or misuse of personal information.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to write sensitive health information into persistent memory files and create treatment protocol artifacts. That expands the skill from transient nutrition guidance into longitudinal storage and care-tracking of medical data, increasing privacy, retention, and misuse risk if the platform or user did not explicitly authorize such persistence.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The file directs the agent to read and rely on existing longitudinal health records before handling a symptom, which operationally turns the skill into a persistent health-profile processor rather than a one-off nutrition responder. In a health context, broad access to prior conditions, medications, and supplement history increases exposure of sensitive medical data and can exceed the least-privilege expected from the stated skill description alone.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill explicitly instructs the agent to write health-related conclusions and schedules into persistent memory and artifact files, which exceeds a purely ephemeral advisory interaction and creates privacy and integrity risk. If done without clear user consent and strict minimization, the agent may permanently store sensitive medication and supplement data that the user did not expect to retain.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The instruction to update the general health profile with medications broadens the skill from nutrition advice into long-term medical profile management. That expansion increases the chance of collecting, retaining, or modifying sensitive health data outside the user's expectations and outside the narrow scope needed to answer the immediate question.

Intent-Code Divergence

Low

Confidence: 78% confidence
Finding: The file says the output should be limited to a timing schedule and a clinician statement, but later adds instructions to modify multiple persistent records. That inconsistency can mislead reviewers and users about the real behavior of the skill, increasing the risk of unanticipated data modification.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The instruction to 'write in the same turn' to ~/Clawic/data/health/profile.md requires persistent storage and modification of sensitive health data during routine interpretation. That exceeds pure analysis and creates a privacy and integrity risk because lab values, reference ranges, and follow-up plans could be stored or altered without explicit user consent or clear data-handling boundaries.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The text directs the agent to create dated follow-up tasks in '## Due' and maintain ongoing health record workflows, which introduces durable scheduling and record-management behavior beyond interpreting nutrition labs. In a health context, this can silently create or modify sensitive longitudinal records and action items that affect future interactions without the user's awareness.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The documentation explicitly instructs the skill to write to persistent user files such as config.yaml, memory.md, and artifacts files. That expands the skill from nutrition advice into state mutation and record-keeping, which can create unauthorized profile changes, stale medical notes, or privacy issues if done without explicit user consent and clear scope controls.

Context-Inappropriate Capability

Low

Confidence: 83% confidence
Finding: The skill directs the agent to create review dates and lab follow-up entries in a due-tracking section, which adds scheduling/task-management behavior beyond pure nutrition analysis. While not overtly malicious, this broadens the operational scope of the skill and can cause unwanted persistent reminders or health-management actions the user did not request.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The instruction explicitly tells the agent to write life stage, nutrient status, and due dates into persistent profile storage, which expands the skill from advice into modifying long-lived health records. In a nutrition context this is sensitive medical information, and persisting it without a clearly scoped need, user consent flow, or retention controls creates privacy and integrity risk if the data is wrong, stale, or exposed to other skills.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The file embeds a persistent-memory update workflow for health profile and due-date management even though the skill description is about assessing micronutrient gaps and interactions, not maintaining a medical record. This broadens capability in a way that can silently accumulate sensitive health facts and reminders, increasing the attack surface for privacy leakage, unauthorized cross-skill use, and harmful downstream decisions based on outdated entries.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The file directs the skill to conduct allergy/intolerance classification, elimination protocols, reintroduction workflows, and pre-test sequencing such as celiac screening before gluten removal. That expands the skill from micronutrient guidance into quasi-diagnostic clinical workflow, creating a risk that the agent gives medical-style advice or manages conditions outside its declared scope and safeguards.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The file instructs the agent to write confirmed allergies or intolerances into health records, log reactions, create elimination artifacts, and update due dates and restrictions. Allowing a nutrition skill to persist diagnostic-style medical conclusions and protocol state increases the chance of incorrect or overconfident health record updates that may affect future recommendations and user safety.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The file instructs the skill to read persistent health profile and nutrition memory files before making escalation decisions, expanding behavior from one-turn nutrition advice into cross-session retrieval of sensitive medical context. In a health skill, this increases privacy and over-collection risk because highly sensitive data is accessed by default even when not strictly necessary for the current request.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The guidance requires writing escalation notes, declined requests, follow-up items, and new health facts into persistent files, which materially extends the skill into longitudinal health recordkeeping. Persisting this information can expose sensitive medical and behavioral data across sessions and creates retention risks if access controls, minimization, or user consent are weak or absent.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs automatic session-start reads of sensitive local files, including health/profile data and dynamically indexed files, without a clear up-front user-facing warning or consent gate in the description. Because the data includes medical conditions, medications, allergies, and profile information, this creates a privacy risk through unexpected collection/access even if the data remains local.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill mandates automatic end-of-session writes of durable health and nutrition information, including symptoms, lab values, medications, supplement changes, and plans, without a prominent user warning or explicit confirmation flow. Silent persistence of sensitive medical data increases the risk of retaining information the user did not expect to store, especially on shared devices or multi-user environments.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The file instructs the agent to write to user health/nutrition memory in the same turn, but provides no user-facing warning that sensitive health data will be stored or altered. In a medical-adjacent skill, silent persistence is dangerous because users may disclose symptoms, lab values, supplements, and conditions expecting transient advice, while the system quietly creates durable records that can influence later responses.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The markdown tells the skill to perform persistent writes to health-record-like files in the same turn, but provides no requirement to notify the user or obtain confirmation before modifying those files. This is dangerous because users may unknowingly have sensitive medical data recorded or altered, creating privacy, integrity, and trust issues, especially for health information.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The file explicitly instructs the agent to write health-related and dietary information into persistent local files in the same turn, but it does not require notifying the user or obtaining consent before storing or modifying that data. Because the data includes nutrition history, conditions, medications, and review scheduling, this creates a privacy and integrity risk: sensitive personal health information may be retained or altered unexpectedly.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill directs writing a supplement schedule to an artifact file without any explicit warning that user data will be modified and stored. In a health context, even a schedule can reveal medication use and medical conditions, so silent persistence creates privacy and expectation-of-use problems.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill instructs updates to health and nutrition memory files containing sensitive medical and supplement data, but provides no explicit privacy notice, consent mechanism, or review step. Because these are durable records of protected-like health information, unauthorized or unexpected writes could expose, propagate, or corrupt highly sensitive personal data.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: memory-template.md:60