Security audit
Security checks for vulnerabilities and agentic risk
This is a fitness-coaching skill with disclosed local database setup and query scripts; it has ordinary setup and privacy considerations but no evidence of hidden, destructive, or deceptive behavior.
Before installing, be aware that the setup script downloads or clones an exercise database from Gitee and can update it later without pinned integrity checks. Only run setup/update when you trust that source, and avoid storing injury, body, or diet details persistently unless you are comfortable with how your agent environment handles that data.
The skill is presented as a fitness advisory tool, but its documented behavior includes network retrieval, git command execution, and filesystem modification for database installation and updates. That hidden operational behavior can cause users or operators to authorize a benign-seeming skill that actually performs code-adjacent system actions, increasing supply-chain and local-environment risk.
The skill is presented as a fitness advisory tool, but its documented behavior includes network retrieval, git command execution, and filesystem modification for database installation and updates. That hidden operational behavior can cause users or operators to authorize a benign-seeming skill that actually performs code-adjacent system actions, increasing supply-chain and local-environment risk.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
python query_exercises.py --muscle chest --equipment dumbbell
# 查询推类动作
python query_exercises.py --force push --equipment dumbbell
# 查询单个动作详情
python query_exercises.py --id "Incline_Dumbbell_Press" --detailed
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
python query_exercises.py --muscle chest --equipment dumbbell
# 查询推类动作
python query_exercises.py --force push --equipment dumbbell
# 查询单个动作详情
python query_exercises.py --id "Incline_Dumbbell_Press" --detailed
The skill advertises shell, network, and file-read capabilities in its operational instructions but does not declare any explicit tool scope or permission boundaries. That creates a least-privilege failure: if the runtime grants broad defaults, the skill may clone remote content, read local files, and execute commands without clear user or platform controls.
All user-facing trigger descriptions and operating guidance are written as Chinese-only instructions, and the file does not state that language support is optional or region-specific. This can constitute a language/locale policy issue because it implicitly constrains interaction language without user opt-in.
The trigger phrases are broad and overlap with ordinary conversation, which can cause the skill to activate in contexts where the user did not intend to invoke it. When combined with documented setup/query actions and undeclared capability breadth, ambiguous invocation increases the chance of unintended tool use or data access.
The trigger phrases are broad enough to match many ordinary fitness-related requests, which can cause this skill to activate when the user did not specifically ask for training-data analysis. In an agent environment, over-broad activation can misroute conversations, cause inappropriate tool/skill selection, and lead to lower-quality or unintended guidance based on incomplete user context.
The trigger conditions are broad and ambiguous, matching both specific exercise-teaching requests and vague statements like users being unable to name the movement. In an agentic system, this can cause the skill to activate outside its intended scope, leading to inappropriate guidance, conflict with other skills, or unsafe fitness advice being given without sufficient context.
The trigger examples include very broad everyday phrases such as asking what to eat or how to gain muscle/fat-loss advice, which can cause the skill to activate in contexts the user did not intend. In a nutrition and fitness skill, unintended invocation can lead to overconfident generic health guidance being presented where more personalized or medically appropriate advice is needed.
The listed trigger phrases include broad everyday expressions such as「帮我分析一下我的情况」and「我该从哪开始」, which could match many general conversations beyond fitness onboarding. The file does not provide exclusion conditions or narrower activation constraints to distinguish when this skill should or should not activate.
The skill explicitly instructs collection and structured storage of personal profile data, including health-adjacent information like injuries, age, height, and weight, without any user-facing notice, consent flow, minimization policy, or retention guidance. In a coaching context this creates privacy and compliance risk because sensitive personal data may be stored and reused across later interactions without the user understanding how it is handled.
The trigger phrases are broad enough to activate on ordinary fitness-related conversation, which can cause the subskill to take over in contexts where the user did not explicitly request plan generation. In this skill, that matters because the subskill contains strong behavioral constraints such as mandatory tool-driven plan generation and rigid output handling, so accidental invocation can produce unintended actions or responses.
The trigger guidance uses broad natural-language phrases such as '怎么进阶' and '平台期怎么办', which can overlap with ordinary fitness conversation and cause the skill to activate when the user did not explicitly request this specialized coach behavior. In an agent setting, over-broad activation can lead to misrouting, unintended instruction injection into unrelated conversations, or the model privileging this skill’s guidance when another tool or policy should apply.
The entire integration guide is written in Chinese and repeatedly instructs the model to follow Chinese App-generated prompts and output formats, but it does not provide any opt-in or alternative language path. Under the policy, forcing a specific language or locale without user choice is a natural-language policy violation unless clearly justified as region-specific.
This code file contains user-facing natural-language text entirely in Chinese in the module docstring and later CLI output/help, which effectively forces a specific language on users. The policy allows fixed locale behavior only when user choice or a clear justified locale constraint is provided, which is not present here.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def check_git_available():
"""检查 git 是否可用"""
try:
result = subprocess.run(
["git", "--version"],
capture_output=True,
text=True,
The script clones and later trusts code/data from a remote third-party repository without any integrity verification, commit pinning, or signature validation. In this fitness skill context, the cloned content is presented as a local database, so a compromised upstream repo or MITM at the hosting layer could silently replace the dataset with malicious or misleading content and poison downstream processing.
print(f"仓库: {DB_REPO_URL}")
try:
result = subprocess.run(
["git", "clone", DB_REPO_URL, str(db_path)],
capture_output=True,
text=True,
When --force is used and the target path exists, the script recursively deletes the existing database directory with shutil.rmtree(db_path). Although there is a brief print statement, there is no confirmation prompt or stronger user warning before this destructive operation.
git pull updates local content from the remote repository without validating the fetched revision or authenticity of the content. If the upstream repository is compromised, the local database can be silently altered on update, which is a supply-chain risk even though no shell injection is present.
if git_dir.exists():
print("正在更新数据库（git pull）...")
try:
result = subprocess.run(
["git", "-C", str(db_path), "pull"],
capture_output=True,
text=True,
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
if git_dir.exists():
print("数据源: git 仓库")
try:
result = subprocess.run(
["git", "-C", str(db_path), "log", "-1", "--format=%h %s"],
capture_output=True,
text=True,
The skill description and usage information are presented exclusively in Chinese, which can impose a language constraint on users without any explicit opt-in or justification. Under the policy, forcing a specific language without offering choice or documenting a justified locale limitation is a natural-language policy issue.
This JSON template includes natural-language strings only in Chinese, such as the comment and plan name placeholder, with no indication that the skill is intentionally region-specific or that users can select another language. That creates a locale-specific behavior embedded in the asset, which matches the policy concern for forced language without opt-in.
This markdown file contains a language-specific constraint in natural language: it states that the exercise descriptions are in English and need to be translated into Chinese for use. Under the policy, forcing a specific language without user opt-in can be a locale/language policy violation, and the document does not present this as optional or region-specific.
This markdown file contains only Chinese headings and content, which can amount to a language/locale restriction for users who do not read Chinese. The policy allows fixed-language content when the locale constraint is explicitly justified or users are given a choice, neither of which appears here.
No suspicious patterns detected.