Security audit
Pregnancy Tracker
Security checks across malware telemetry and agentic risk
Overview
This pregnancy tracker is not malware, but it asks users to record sensitive health information while giving conflicting privacy claims about local-only storage versus cross-device sync.
Review carefully before installing if you would enter pregnancy symptoms, appointments, due dates, or other health details. The skill appears purpose-aligned and non-executable, but the privacy language is inconsistent about whether data stays only on one device or syncs elsewhere, and it does not explain retention, deletion, or sharing controls.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
65/65 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.