Security audit

suhuaren-dandao

Security checks across malware telemetry and agentic risk

Overview

This is a knowledge-only Daoist wellness skill, but it should be reviewed because it can give confident medical-adjacent exercise, diet, and fasting guidance.

Review before installing. This skill does not appear to be a code-execution or data-access risk, but it should be used only as a traditional/religious wellness reference. Do not rely on it for diagnosis, medication changes, chronic disease management, emergency symptoms, fasting or water deprivation, restrictive diet changes, or intensive breath/meditation/exercise routines without qualified medical advice and appropriate in-person instruction.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (18)

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README includes concrete health triage and exercise prescriptions for symptoms like fatigue, insomnia, and chronic disease, with dosage-like instructions and efficacy claims, but the nearby examples do not clearly require medical evaluation, contraindication screening, or individualized supervision. In this context, users may substitute the skill for medical care or follow potentially unsafe practices based on unverified claims, increasing the risk of delayed treatment or physical harm.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The skill hard-codes a single persona, tone, and response style ('以苏华仁的视角传道', mandatory source framing, no humor, fixed certainty) without allowing user preference or override. This is not a classic security bug, but it is a genuine policy/control weakness because it can reduce user agency, pressure the model into authoritative health-spiritual advice, and make misleading claims sound more credible in a sensitive wellness context.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The page presents condition-specific health guidance and exercise recommendations for issues like gout without any medical disclaimer, triage language, or instruction to seek professional care. In a wellness skill, this can cause users to substitute unverified advice for proper diagnosis or treatment, especially because the examples are framed authoritatively and as directly actionable.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The feature descriptions market a large library of movement and meditative practices that may affect physical or mental wellbeing, but omit any warnings about contraindications, supervision, or user health limitations. Because the page encourages direct use of these practices, users may attempt them despite injury, illness, age-related risk, or mental health concerns.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The copy says users can directly activate the persona in conversation to ask wellness questions, with broad phrasing and no meaningful boundaries. In a health-related skill, overbroad activation increases the chance that ordinary discussion of symptoms or sensitive topics triggers domain-specific guidance when the user did not intend to invoke it.

Vague Triggers

High

Confidence: 97% confidence
Finding: The usage section explicitly states that ordinary wellness questions will automatically trigger the skill and that no special instruction is needed. That is risky because it allows a highly opinionated health persona to engage on broad symptom descriptions without consent gating, safety screening, or exclusion logic, increasing the chance of unsafe or misleading medical-adjacent output.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The file gives detailed meditation, breath-control, prolonged practice, posture, sleep-position, and body-manipulation instructions while making health and longevity claims, but provides no safety screening, contraindications, stop conditions, or medical disclaimer. In this context, users may follow practices such as forceful breathing, extended sessions, involuntary 'qi' expectations, and sexual/physiological manipulation despite underlying cardiovascular, psychiatric, respiratory, neurological, or musculoskeletal conditions, increasing risk of harm or delayed medical care.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: This is a true safety vulnerability: the file gives detailed exercise and self-treatment instructions, including claims about treating chronic disease, poisoning, sexual/reproductive effects, and repeated physical motions, without screening, contraindications, stop conditions, or advice to seek medical care. In this skill context, the danger is increased because the content is presented as authoritative health guidance tied to broad therapeutic claims, which may cause users to delay proper treatment or perform movements that aggravate injury or medical conditions.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The file repeatedly presents seated practices and '治病/悉治' disease-treatment claims for a wide range of symptoms, but provides no warning that this is not medical advice and should not replace professional diagnosis or treatment. In a wellness skill, users may delay care for serious conditions such as stroke-like symptoms, severe pain, bleeding, respiratory distress, or mental health emergencies because the content frames the exercises as therapeutic.

Missing User Warnings

Low

Confidence: 89% confidence
Finding: The dual-person '太极合掌' section instructs direct body contact and coordinated movement ('掌连掌，穴对穴', '不丢、不顶、不抗、不坠') without any safety guidance about partner selection, force limits, stopping on pain, fall prevention, or avoiding practice when injured. Users could misapply pressure, lose balance, or aggravate musculoskeletal conditions, especially because the text frames the method as a beneficial cultivation practice rather than a potentially risky physical drill.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The file gives detailed instructions for esoteric breathing, posture, genital compression, prolonged sitting, and other body practices while making strong therapeutic and transformative claims, but it does not provide meaningful safety warnings, contraindications, or clear direction to seek qualified medical or in-person instruction. In this skill context, that is more dangerous because the content is framed as authoritative lineage-based health guidance and includes claims about treating sexual dysfunction, chronic illness, and producing unusual bodily effects, which could lead users to self-experiment, delay medical care, or physically injure themselves.

Missing User Warnings

High

Confidence: 95% confidence
Finding: This file presents extensive therapeutic and quasi-medical claims, including disease treatment, self-healing, longevity, and physiological effects, without any safety disclaimer, medical caution, or instruction to seek licensed care. In the context of a skill explicitly associated with health practices and a named tradition/teacher, users may reasonably treat these claims as actionable medical guidance, creating a real risk of delayed treatment, unsafe self-experimentation, and reliance on unverified practices for serious conditions.

Missing User Warnings

High

Confidence: 98% confidence
Finding: This section describes prolonged fasting, cessation of water intake, and extended meditation as spiritually meaningful or evidentiary practices without any medical disclaimer, harm warning, or instruction not to imitate them. In a wellness/spiritual skill, such content can encourage users to attempt dehydration or starvation practices that can rapidly cause organ injury, altered mental status, or death.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: This instructional section promotes strict lifelong dietary restriction, intensive daily practice schedules, oath-based obedience to a 'master,' and secret initiation-style training while presenting health and longevity claims as authoritative. In context, this can pressure vulnerable users into unsafe diet changes, overexertion, or coercive guru-dependent behavior without informed consent or safety boundaries.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This is a true safety issue because the file presents broad, prescriptive health heuristics such as treating chronic disease as kidney deficiency and recommending specific exercise/breathing regimens without any medical disclaimer, screening criteria, or escalation guidance. Users may delay appropriate diagnosis or treatment, especially for chronic illness, and the authoritative framing of the rules makes the advice more likely to be followed as medical guidance.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: This is a true vulnerability because it mandates a restrictive all-vegetarian diet and forbids broad food categories with no nutritional caution, personalization, or medical exceptions. Such absolute dietary rules can be harmful for users with specific health conditions, eating disorders, pregnancy, aging-related needs, or existing nutrient deficiencies, and the coercive 'must' language increases the chance of misuse.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The file gives prescriptive diet and wellness guidance, including absolute rules like full veganism, disease-specific dietary adjustments, and exercise/fasting timing, without any warning that the content is not medical advice or that it may be unsafe for people with medical conditions. In this skill context, the risk is elevated because the material is framed as authoritative lineage-based health instruction and could cause users to delay appropriate care, follow nutritionally restrictive advice, or apply unvalidated recommendations to chronic illness management.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: This file gives symptom-based health triage and prescriptive recommendations for conditions including insomnia, hypertension, diabetes, immune weakness, and post-illness recovery, but it does not clearly instruct users to seek licensed medical care or avoid self-treating serious conditions. In the context of a cultivation/health skill with strong authority cues and disease-specific advice, users may delay real diagnosis or substitute unvalidated practices and restrictive diet changes for appropriate treatment.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.