T08 · Insecure Dependencies
Error
- Location
SKILL.md:14- Finding
Unpinned and Unauditable Executable PyPI Dependency
- Content
View full analysis
- Remediation
View remediation
Security audit
Skill
Security checks for vulnerabilities and agentic risk
Overview
This nutrition tracking skill is useful and mostly purpose-aligned, but it stores sensitive diet and health information silently and installs persistent prompts without clear consent.
Install only if you are comfortable with the agent keeping long-term nutrition, allergy, diet, and health-context notes and with a heartbeat integration that can prompt you in later sessions. Review or remove the heartbeat block if you do not want proactive prompts, and prefer a pinned, reviewed nutrition-cli package before relying on it.
Vulnerability Patterns
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T06 · System Persistence
Warning
- Location
ONBOARDING.md:52- Finding
Mandatory Persistent Heartbeat Hook Installed Before Reminder Consent
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:49- Finding
Shell Command Injection Through Unescaped User-Controlled Values
- Content
View full analysis
- Remediation
View remediation
other
Warning
- Location
SKILL.md:100- Finding
Silent Persistent Collection of Sensitive Health and Behavioral Data
- Content
View full analysis
45 min on average Action: update meal times in MEMORY.md "Nutrition profile" to match observed times. Say: "I've updated your meal times in my memory to match when you actually eat." ### Calorie patterns Trigger: user consistently goes over or under target by >15% for 5+ days Action: append to MEMORY.md "Health context": Over: `- Tends to exceed calorie target (observed {DATE})` Under: `- Often under-eats on {DAY_PATTERN} (observed {DATE})` Do NOT suggest changing the target without being asked. ### Health context Trigger: user mentions health conditions, fitness goals, or medications ("I'm trying to lose weight", "I have diabetes", "I'm training for a marathon") Action: append to MEMORY.md "Health context": `- {HEALTH_NOTE} (mentioned {DATE})` Only write what the user explicitly stated. Never infer diagnoses. ``` Persistent schema in `MEMORY_TEMPLATE.md`: ```markdown ## Nutrition profi ...[truncated 2620 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md ## Nutrition profile <!-- nutrition-cli managed section — do not edit manually --> - Daily calorie target: {KCAL_TARGET} kcal - Protein goal: {PROTEIN_G}g/day - Fat limit: {FAT_G}g/day (optional)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The trigger conditions are intentionally broad enough to activate on casual mentions of food in ordinary conversation. That makes unintended invocation likely and increases the chance the skill will collect, suggest logging, or persist sensitive dietary information when the user did not actually ask for nutrition tracking.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The meal-logging section reinforces ambiguous activation by treating essentially any food mention in passing as a trigger. In context, this is especially dangerous because later steps can lead to nutrition searches, offers to log, and persistent memory updates, turning casual conversation into data collection and profiling.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly instructs silent writes of sensitive health context, food preferences, calorie patterns, and behavior observations to persistent memory without user-facing warning in the skill description. This is a strong privacy and consent failure because users may believe they are getting one-off nutrition help while the system is quietly building a sensitive profile.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill behavior includes checking daily memory files and noting incidental food mentions, but the snippet provides no user-facing warning that these statements may be stored or used for meal tracking. In a nutrition context this is more sensitive than ordinary preferences because it can reveal health, dieting, religious, or medical information, so silent collection increases privacy harm.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The snippet explicitly instructs the agent to react to any incidental mention of food and to note it before asking whether it should be logged. That creates a privacy and consent risk because casual conversation can be transformed into health- or diet-related tracking without a clear opt-in boundary, and nutrition data can be sensitive personal information.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The onboarding flow instructs the agent to collect sensitive health-related information, including calorie targets, protein goals, dietary restrictions, allergies, and meal timing, and persist it to MEMORY.md without requiring explicit user consent or clearly warning that the data will be stored long-term. In a nutrition skill, this data is especially sensitive because it can reveal health status, religious practices, disabilities, or medical risks, and persistent storage increases exposure to later unintended access or reuse.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill silently writes long-term health-related data, food preferences, behavior patterns, and inferred trends into persistent memory. Even if intended to improve personalization, this collects sensitive personal and health-adjacent information without prominent upfront disclosure or explicit consent, creating privacy, profiling, and retention risks well beyond a simple nutrition lookup tool.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill creates persistent cron jobs that can trigger future agent actions outside the immediate user request. Although reminder functionality is plausibly related to nutrition tracking, scheduled execution increases the skill's authority and persistence, and the embedded scheduled prompts can cause ongoing data collection or logging if enabled. This is riskier because the skill can continue acting later in a separate session context.
- Content
Static analysis
No suspicious patterns detected.