Cycle Sync Training

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:47 AM UTC
• Version: 0.1.2

Overview

The skill is purpose-aligned, but it handles sensitive menstrual-health data with broad activation rules and under-specified third-party storage and messaging controls.

Review before installing. Use this only if you are comfortable providing menstrual-cycle and symptom data to the configured backend and any messaging channels. Configure Supabase with per-user access controls, keep service credentials server-side, avoid sending health details through LINE or Facebook by default, require explicit user consent before logging cycle data, and pin dependencies before deployment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:206

Finding

Unpinned Third-Party Dependencies Permit Unreviewed Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:206
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code Snippet:

bash

pip install fastmcp supabase python-dateutil

Technical Analysis

The installation command does not constrain dependency versions or verify package integrity with cryptographic hashes. Consequently, installation results can change over time without any modification to the audited Skill.

The project also lacks a dependency lockfile or other reviewed dependency manifest. Users following the documented command will install whichever compatible releases the package index serves at that time, including potentially compromised or malicious future releases. Transitive dependencies are similarly unconstrained.

This finding establishes an unsafe supply-chain configuration. It does not establish that any of the named packages are currently malicious.

Attack Path

1. An attacker compromises a named dependency, one of its transitive dependencies, or the associated package-publishing account.
2. The attacker publishes a malicious package release to the package index used by pip.
3. A user follows the installation instructions in SKILL.md.
4. Because no versions or hashes are specified, pip resolves and downloads the affected release.
5. Malicious package behavior executes during installation, import, or application runtime with the privileges of the installing or server process.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user installing or running the MCP server. Depending on that account's permissions, this could expose environment variables, Supabase credentials, locally accessible files, cycle-history data, and other services reachable from the host.

The ultimate scope is limited by the operating-system privileges, network access, and secrets granted to the installation and runtime ...[truncated 13 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every direct dependency to an explicitly reviewed version.
• Generate and commit a lockfile that also constrains transitive dependencies.
• Require cryptographic hashes, such as through a hash-locked requirements file and pip install --require-hashes.
• Configure an approved package index explicitly and disable unintended fallback indexes to reduce dependency-confusion exposure.
• Perform automated dependency vulnerability and provenance scanning in CI.
• Review dependency updates before regenerating the lockfile.
• Install and run the service in an isolated, non-privileged environment with minimal filesystem, network, and secret access.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:50

Finding

Sensitive Menstrual Health Data Flow Lacks Required Privacy and Access-Control Safeguards

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:50-56, SKILL.md:105-114, SKILL.md:137-140, and SKILL.md:178-180
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Relevant Code Snippets:

json

{
  "user_id": "string",
  "phase": "menstrual | follicular | ovulatory | luteal",
  "cycle_day": 1,
  "symptoms": ["cramps", "bloating", "fatigue", "energetic"],
  "mood_score": 7,
  "energy_score": 6,
  "date": "2027-01-15"
}

text

Supabase (user data + cycle history)
    ↓
Response → LINE Notify / Facebook

Technical Analysis

The documented API handles identifiers, menstrual-cycle phases, cycle dates, symptoms, mood, and energy scores. In combination, these fields constitute sensitive health-related information. The architecture explicitly identifies Supabase as the storage destination for user data and cycle history and identifies LINE Notify and Facebook as outbound response channels.

The Skill does not document mandatory controls for:

• User consent and disclosure of third-party processing.
• Data minimization and pseudonymization.
• Supabase row-level authorization.
• Encryption requirements for storage and transport.
• Retention periods and user-requested deletion.
• Redaction of sensitive fields from notifications and logs.
• Prevention of account or recipient mix-ups.
• Restricting which response content may be sent through social platforms.

The repository contains no server implementation, database policy, or messaging integration that could demonstrate compensating controls. The vulnerability is therefore an insecurely specified sensitive-data workflow rather than proof that a particular deployed Supabase or messaging account is presently exposed.

Attack Path

1. A user submits a stable user_id together with cycle timing, symptoms, mood, or energy information.
2. The MCP workflow associates that information with ...[truncated 1404 chars]

Remediation

View remediation

Remediation Suggestions

• Obtain explicit, informed consent before collecting or forwarding cycle-related information.
• Collect only fields required for the requested feature and use pseudonymous, non-guessable internal identifiers.
• Enable and test Supabase row-level security on every affected table; deny access by default and bind records to the authenticated user.
• Keep service-role credentials server-side and grant integrations only the minimum required permissions.
• Require TLS for MCP, database, and notification traffic, and require encryption at rest where supported.
• Do not send cycle phase, symptoms, dates, mood, energy scores, or identifiers through LINE or Facebook by default.
• Use generic notifications that direct users to an authenticated interface rather than embedding health information.
• Verify outbound recipient ownership and require a separate opt-in for each messaging channel.
• Define retention limits, deletion procedures, access auditing, incident-response requirements, and user data-export controls.
• Redact health data and tokens from application, proxy, database, and messaging logs.
• Add privacy and authorization tests covering cross-user access, malformed identifiers, revoked consent, incorrect recipients, and compromised integration credentials.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly instructs activation even when the user did not mention cycle syncing directly, which creates an overly broad trigger surface for a domain handling sensitive reproductive-health information. This can cause the agent to route unrelated women's fitness conversations into a workflow that collects or infers intimate health data without clear user intent or consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This skill processes highly sensitive reproductive-health data (phase, symptoms, cycle history) and routes responses through external systems including Supabase and messaging platforms, yet the documentation provides no explicit privacy warning, consent flow, retention notice, or data-sharing disclosure. That omission is dangerous because users may unknowingly expose intimate health information to storage and third-party channels, creating privacy, compliance, and confidentiality risks.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 209)May include surrounding context.

md

pip install fastmcp supabase python-dateutil

# 2. Set environment variables
cp .env.example .env && nano .env

# 3. Run server
python server.py

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger keyword list includes broad terms like cycle, phase, and hormone equivalents that are likely to match ordinary conversation and invoke this skill unintentionally. In a health-sensitive workflow, accidental activation increases the chance of inappropriate data collection, misleading recommendations, or disclosure through downstream integrations.

Content

No source excerpt is available for this finding.

Rp1

Low

• Category: MCP Rug Pull
• Confidence: 60% confidence

Finding

pip install without ==version installs the latest release, which could include malicious changes.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.