Security audit

Healthcheck Local

Security checks for vulnerabilities and agentic risk

Overview

This health tracker is straightforward in purpose, but its water-count commands can turn user input into executable JavaScript, so it needs review before installation.

Review this skill before installing. It stores water and sleep history locally in `{baseDir}/health-data.json`, and its update/delete commands change that file. The main security issue is the inline Node.js command pattern for cup counts; it should validate the count as a bounded number and pass it as an argument instead of inserting it into JavaScript source.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:27
Finding: Unsanitized Numeric Input Is Interpolated into Executable JavaScript
Content: View full analysis
Remediation: View remediation
100) { throw new Error('Invalid cup count'); } let data = { water: [], sleep: [] }; try { data = JSON.parse(fs.readFileSync(file, 'utf8')); } catch (error) { if (error.code !== 'ENOENT') { throw error; } } if (!Array.isArray(data.water) || !Array.isArray(data.sleep)) { throw new Error('Invalid health-data structure'); } data.water.push({ time: new Date().toISOString(), cups }); fs.writeFileSync(file, JSON.stringify(data)); ``` The update operation should use the same argument-based validation and should verify that a water record exists before attempting to modify the final entry. ]]>

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation phrases are specified only in Vietnamese (for example, 'uống X cốc', 'đi ngủ', 'thức dậy', 'thống kê') with no indication that the skill is intentionally locale-specific or that other languages are unsupported. This is a natural-language policy concern because it imposes a language constraint without user opt-in or justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown skill stores user health-related information such as water intake and sleep events in a local file, which affects user data/privacy. While the file path and format are documented, there is no explicit warning or disclosure that personal health data will be retained on disk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The markdown includes commands to update the last water entry and delete the last water entry, which directly modify persisted user data. Although the commands print 'Updated' and 'Deleted' after execution, the documentation does not warn users beforehand that these actions overwrite or remove existing records.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.