Back to skill

Security audit

Quit Weed

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a local cannabis-quitting aid, but it gives under-qualified health advice that users could act on unsafely.

Review this skill carefully before installing if you may rely on it for health decisions. Treat its timeline and hydration advice as non-medical support, avoid materially increasing water intake based on the skill alone, and seek qualified medical help for severe, worsening, persistent, or mental-health-related withdrawal symptoms.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

other

Warning
Location
SKILL.md:67
Finding
Unsafe and Overly Definitive Cannabis Withdrawal Health Guidance## Vulnerability Details **File Location**: `SKILL.md`, lines 67-81 **Vulnerability Type**: Unsafe health guidance **Risk Level**: Medium ### Vulnerable Content ```markdown Get science-backed expectations for sleep, focus, mood, and cognition at each stage. ## Clarity Timeline | Milestone | Mental/Physical Changes | |-----------|------------------------| | **Day 1** | Initial urges peak. Sleep may be disrupted. Energy dips. Irritability common. | | **Day 3** | Brain fog starts lifting slightly. Sleep patterns normalize. Appetite returns. | | **1 Week** | Mental clarity noticeably sharper. Vivid dreams resume. Mood stabilizes. Anxiety reduces. | | **2 Weeks** | Focus and concentration significantly improved. Energy rebounds. Sleep quality deepens. | | **1 Month** | Memory and cognition baseline restored. Motivation increases. Lungs clear. Appetite normalized. | ## Tips 1. **Hydrate heavily** - Drink 2-3x normal water intake. Helps flush your system and reduces cravings. ``` ### Technical Analysis The Skill presents fixed cannabis-withdrawal and recovery milestones as broadly applicable, including definitive statements such as “Memory and cognition baseline restored.” These outcomes vary based on usage frequency, dosage, duration, individual physiology, coexisting conditions, and other substance use. The document provides no citations, uncertainty language, contraindications, or escalation guidance for persistent or severe symptoms despite describing the expectations as “science-backed.” The instruction to drink two to three times the user's normal water intake is particularly unsafe. It provides neither a volume limit nor consideration for kidney, cardiac, or electrolyte-related conditions. Excessive water consumption can cause hyponatremia and other complications. The accompanying assertion that heavy hydration “flush[es] your system” is presented as established fact without support. ### Attack Path This is ...[truncated 1093 chars]
Remediation
## Remediation Suggestions 1. Remove the recommendation to drink “2-3x normal water intake” and the unsupported claim that excess water flushes cannabis from the body. 2. Replace it with conservative guidance to maintain normal hydration according to thirst, environmental conditions, and advice from a qualified healthcare professional. 3. Present withdrawal and recovery milestones as approximate ranges rather than guaranteed outcomes. 4. Add clear language explaining that symptom severity and duration vary substantially between individuals. 5. Cite reputable medical or public-health sources for any physiological or cognitive claims. 6. Avoid claims such as “baseline restored,” “lungs clear,” or “sleep patterns normalize” unless appropriately qualified. 7. Add escalation guidance directing users to qualified healthcare services for severe, worsening, or persistent symptoms, significant mental-health effects, or concerns about safely stopping substance use. 8. Include warnings that users with kidney, heart, electrolyte, or fluid-management conditions should not materially increase fluid intake without medical advice.
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The example triggers "Help me get through this" and "What should I do about this urge?" are generic natural-language phrases that could arise in many unrelated conversations. The file does not provide narrowing constraints or exclusion conditions to distinguish cannabis-craving support from ordinary help-seeking requests.

Static analysis

No suspicious patterns detected.