Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly describes read-only parenting evidence retrieval, but it also points agents to an operational crawler playbook that can run scrapers and write database/local content outside that stated scope.
Install only after reviewing whether you want this as a read-only parenting retrieval skill or an operator crawler/ingestion skill. The public API retrieval behavior is coherent, but the bundled crawler playbook should be removed or split into a separately reviewed admin skill with explicit write access, browser automation, domain limits, and user confirmation. Users should also avoid sending names, contact details, exact addresses, or unnecessary medical history in parenting questions forwarded to the external service.
references/current-site-deep-search-playbook.md:332Operational crawler instructions exceed the Skill's declared read-only privilege boundary
SKILL.md:48Sensitive parenting and health questions may be transmitted through external URL query parameters without data minimization
MANIFEST.yaml:7Behavior-changing operational reference is omitted from the declared bundle manifest
The file describes direct recursive crawling, source-specific extraction, and browser-assisted scraping of third-party sites rather than use of a fixed public Mom AI evidence API. That creates an undeclared network and content-acquisition surface, increasing risk of policy bypass, legal/compliance issues, and unpredictable behavior under a skill that is supposed to be a constrained retrieval interface.
The playbook documents writing scraped content to local snapshots and database tables, which materially exceeds the skill's declared read-only evidence retrieval scope. In an agent environment, this scope mismatch can enable unauthorized data persistence, side effects, and hidden ingestion workflows that users and policy layers would not expect from a retrieval-only skill.
The statement that this is an operational crawl/search playbook and not a public evidence-answering spec directly conflicts with the manifest's user-facing purpose. That mismatch is dangerous because operators and security controls may trust the manifest while the included material guides the agent toward broader internal ingestion behavior.
Line L137 instructs operators to reject non-English paths such as /espanol, which is a natural-language locale policy embedded in the skill guidance. The document does not provide user opt-in, multilingual alternatives, or a clear compliance-based justification for this language restriction.
The documented browser-assisted Mayo workflow introduces automation capability beyond normal read-only API retrieval, including opening live third-party search pages. Browser automation expands the attack surface through dynamic content handling, anti-bot workarounds, and possible execution of untrusted page logic, which is unnecessary for a narrowly scoped evidence retrieval skill.
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
Current coverage note:
- `foods`, `rules`, `guides`, `faqs`, `topics`, and `insights` are the current public skill surfaces.
- The strongest coverage is not limited to `kb_*` tables alone; `insights` is one of the main public coverage layers.
- Do not treat missing coverage as permission to invent evidence beyond those surfaces.
## Endpoint Choice