Security audit

GymBuddy

Security checks for vulnerabilities and agentic risk

Overview

GymBuddy is a coherent fitness-coaching skill with local reference files and simple Python helpers, with no evidence of hidden persistence, exfiltration, or destructive behavior.

Install only if you want a mostly Chinese-language fitness coaching assistant. Treat its training, posture, and nutrition outputs as educational, not medical advice, and seek qualified professional help for pain, injury, chronic disease, pregnancy, neurological symptoms, or cardiovascular concerns.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents an end-user fitness coaching skill, but the supplied code is an offline content indexing tool. Its sole purpose is to read markdown knowledge files, split them into chunks by '##' headings, and write a JSONL lookup index. It does not analyze training data, assess posture, estimate TDEE, generate workout plans, or interact with gym-related user triggers. This is a clear primary-purpose mismatch.

Ae1

High

Category: analysis-evasion
Content: **执行根目录**：所有相对路径以本 `SKILL.md` 所在目录为准；运行 Bash 时不要随意 `cd` 到猜测的全局路径。
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: **执行根目录**：所有相对路径以本 `SKILL.md` 所在目录为准；运行 Bash 时不要随意 `cd` 到猜测的全局路径。
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The skill description and user-facing positioning are entirely in Chinese, including the core usage description, with no indication that users may interact in other languages or opt into Chinese. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the locale constraint is explicit and justified.

Natural-Language Policy Violations

Medium

Confidence: 85% confidence
Finding: The natural-language description and operating instructions are written as a Chinese-only persona/skill presentation, with no indication that users may choose another language. Under the policy, forcing a specific language without opt-in is a locale/language policy issue unless the constraint is explicitly justified.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger text says to activate not only when the user explicitly calls '健身搭子' or 'GymBuddy', but also whenever the user is 'deeply discussing' training, posture correction, body data, or nutrition/energy estimation. These topics are broad and common enough that the skill could be invoked unintentionally, and the file does not provide exclusion conditions or negative examples to clarify boundaries.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The file gives posture-correction and exercise intervention guidance, including stretches and training recommendations, while only stating it is for discussion and not a book excerpt. It does not clearly warn that this is not medical advice or that people with pain, injury, or structural conditions should seek qualified evaluation first, which could lead users to self-treat potentially harmful conditions.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: This markdown skill file presents all operational instructions in Chinese and does not indicate that users may choose another language. Under the policy rule for natural-language violations, forcing a specific language without user opt-in is a reportable issue unless the locale restriction is clearly documented and justified.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The persona content is written entirely in Chinese and prescribes a fixed response style without indicating that the assistant should adapt to the user's preferred language. This can override user expectations or platform language settings, causing accessibility, usability, and policy-compliance issues when users interact in other languages.

Natural-Language Policy Violations

Low

Confidence: 82% confidence
Finding: The comment at L1 is written entirely in Chinese and presents the skill information in a single language without any indication that users may choose another language. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation when no justification is provided.

Natural-Language Policy Violations

Low

Confidence: 93% confidence
Finding: The docstring and argument descriptions use Chinese exclusively, while the file provides no indication that the skill is intentionally region-specific or that users can choose another language. This can violate language/locale policy if the broader environment expects neutral or user-selectable language behavior.

Static analysis

No suspicious patterns detected.