BestYou Health Intelligence

• Outcome: Pass
• Latest audit: May 28, 2026 at 10:10 AM UTC
• Version:
  1.0.0

Overview

This is a disclosed BestYou health-data integration, with the main risk being careful handling of its API key and sensitive wellness insights.

Install only if you trust BestYou with processed health insights from your account. Treat BESTYOU_API_KEY like a password: avoid committing or syncing config files that contain it, restrict local file permissions where possible, and revoke or rotate the key in the BestYou app if it is exposed or no longer needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The setup guide instructs users to export a live API key in the shell and also shows putting the bearer token directly into a JSON config file, both of which can leave credentials exposed in shell history, dotfiles, backups, or readable local configuration. Because this skill handles health-related account access, a leaked token could allow unauthorized access to sensitive personal wellness data and permitted actions such as workout or nutrition plan changes.

VirusTotal

No VirusTotal findings