Security audit

Health Report

Security checks for vulnerabilities and agentic risk

Overview

This is a simple health-report writing skill with no executable code, but users should treat exported reports as sensitive medical information.

Before installing or using this skill, remember that generated reports may contain sensitive health details. Review the report, remove anything unnecessary, and only export or share it to a destination you explicitly choose.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly offers to export or share a health report, which may contain highly sensitive personal health information, but it provides no warning, consent step, or privacy guidance. In a health-focused skill, this omission is more dangerous because users may reasonably assume the sharing flow is safe and may disclose regulated or sensitive data to unintended recipients.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.