Muscle Gain

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:25 AM UTC
• Version: 1.0.0

Overview

This fitness tracking skill is mostly purpose-aligned, but it makes unsupported privacy and encryption promises about sensitive body, nutrition, and photo data.

Install only if you are comfortable entering fitness, body-measurement, nutrition, and possibly progress-photo data into the surrounding agent environment. Treat the local-only and encrypted-storage claim as unverified unless the platform separately documents and enforces those protections.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

other

Warning

• Location: SKILL.md:58

Finding

Unsupported Privacy and Encryption Guarantee

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 58
Vulnerability Type: Misleading privacy and security assurance
Risk Level: Medium

Vulnerable Snippet

markdown

5. **All data stays local on your machine** - Your training logs, weight history, and progress photos are encrypted and stored offline. No cloud upload, no third-party access, full privacy.

Technical Analysis

The skill makes absolute claims that sensitive fitness records and progress photographs are encrypted, stored offline, never uploaded to the cloud, and inaccessible to third parties. However, the audited package contains only SKILL.md; it provides no executable implementation, storage configuration, encryption mechanism, key-management controls, access restrictions, or network-boundary enforcement supporting these claims.

The package also cannot independently control how the hosting agent platform processes, transmits, logs, or retains user-submitted text and images. The assurance may therefore cause users to disclose sensitive information based on privacy properties that this artifact neither implements nor verifies.

Attack Path

1. A user loads the skill and reads its local-storage and encryption guarantee.
2. Relying on that guarantee, the user submits body measurements, health-related records, dietary information, or progress photographs.
3. The surrounding agent platform handles the submitted information according to its own storage, telemetry, retention, and network policies.
4. If those policies involve remote processing, cloud retention, logging, or third-party access, the user's data leaves the promised security boundary.
5. The user may remain unaware because the skill explicitly represented the processing as offline and fully private.

Impact Assessment

The issue does not directly grant an attacker system privileges or code execution. Its impact is the potential unauthorized exposure, retention, or third-party processing of sensitive ...[truncated 180 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove absolute claims such as “all data stays local,” “no cloud upload,” “no third-party access,” and “full privacy” unless they are technically enforced and independently verifiable.
2. State explicitly that data processing, transmission, retention, and encryption depend on the hosting agent environment.
3. If local encrypted storage is intended, implement and document:
   • The storage location and data lifecycle.
   • Encryption algorithms and authenticated-encryption modes.
   • Key generation, storage, rotation, recovery, and deletion.
   • File permissions and local access controls.
   • Network restrictions preventing unintended uploads.
   • Secure deletion and retention controls.
4. Require explicit user consent before accepting sensitive photographs or health-related records.
5. Align documentation with actual platform behavior and provide a clear privacy notice describing any telemetry, remote processing, subprocessors, and retention periods.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are common, natural-language fitness terms such as 'protein today' and 'strength gains', which can cause the skill to activate in ordinary conversation without a clear user intent to invoke it. While the skill appears benign and purely fitness-focused, overbroad activation increases the chance of unintended invocation and exposure of sensitive health or body-composition data within the skill flow.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.