Security audit

fitness-assistant

Security checks for vulnerabilities and agentic risk

Overview

This fitness skill is mostly coherent, but it asks agents to persist sensitive health/profile details and create recurring scheduled messages without clear user-facing consent, retention, or deletion controls.

Review this skill before installing if you are not comfortable with health, body, dietary, budget, routine, timezone, and workout-log details being saved in agent profile/memory and reused by scheduled automations. Only enable scheduled delivery after confirming the destination, timezone, and exact recurrence, and ask how to review or delete saved profile data if the platform supports it.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description promises a higher-level planning and automation skill: creating daily meals and workouts, customizing ingredients, and scheduling plans through OpenClaw. The supplied code does none of those things. It only computes fitness-related estimates and macro targets using standard formulas and prints the results. There is no evidence of meal construction, workout scheduling, user health-profile processing beyond basic biometric inputs, localization, or any external automation integration. This is a material description-behavior mismatch in primary purpose and advertised capabilities.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.
md
oad prompt references this skill so each run produces a fresh daily plan — see [references/scheduling.md](references/scheduling.md) for the exact tool/CLI calls

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.
md
oad prompt references this skill so each run produces a fresh daily plan — see [references/scheduling.md](references/scheduling.md) for the exact tool/CLI calls

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The invocation guidance covers generic requests such as 'a workout plan' and especially recurring-message phrases like 'daily plan', which can occur in many contexts outside this skill's intended domain. The file does not provide negative examples or tighter activation constraints to distinguish fitness-plan requests from other common planning requests.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The instructions require the response language to be chosen from a fixed set of 8 languages, and the boundaries prohibit using any others. This is a language-policy restriction that may deny service in the user's preferred language without an explicit opt-in or documented justification.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: Line L03 says to use this skill when the user gives a daily food budget, or asks what today's plan costs. The phrase "asks what today's plan costs" is relatively broad and the file does not provide exclusion conditions or clearer trigger boundaries, which could cause unintended invocation during ordinary meal-planning conversations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The dialogue explicitly asks users to provide health-related and personal profile data such as age, sex, height, weight, activity level, allergies, dietary restrictions, timezone, and scheduling preferences, but it gives no privacy notice, consent language, or explanation of how this sensitive data will be used, stored, or shared. In a fitness assistant that also schedules plans via automations, this increases the risk of users disclosing sensitive information without informed consent and may create compliance and trust issues if the data is retained or transmitted to downstream systems.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file sets a hard policy that delivered messages may only use eight languages, which can force a language choice on users who request another language. Although it says to confirm the user's choice when possible, it still denies unsupported languages rather than offering open user opt-in or a justified region-specific constraint.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instruction to save ingredient preferences for future runs creates a persistence/privacy risk because it directs retention of user data without notice, consent, retention limits, or controls on what exactly is stored. In this skill, those preferences can reveal sensitive health-related inferences when combined with dietary restrictions or condition-linked meal planning, making the data more sensitive than ordinary food likes/dislikes.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The instruction requires the agent to send dialogue verbatim from a matching language block and to 'never translate, paraphrase, or mix languages.' This is a natural-language policy concern because it enforces a strict language constraint rather than allowing user choice at response time or fallback behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This line imposes an absolute locale/language restriction for all dialogues. Under the policy, forcing a specific language without explicit opt-in flexibility can be a violation unless the constraint is clearly justified as region-specific or compliance-driven.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Line L28 states that the user's language must be 'one of the 8 in languages.md', which imposes a language constraint in the skill's natural-language specification. The file does not indicate that users may opt into this limitation or explain a region/compliance reason for restricting available languages.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: Requiring dialogue scripts to use fixed eight-language versions can prevent adaptation to a user's requested language outside that set. This is a natural-language policy concern because it operationalizes the language restriction across user-facing content.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.