Security audit

Knitify Health Chatbot

Security checks for vulnerabilities and agentic risk

Overview

This skill provides a real health-research integration, but it can push signup and send sensitive health questions or email addresses to Knitify with broad automatic triggers and limited consent/scoping.

Install only if you are comfortable with Knitify receiving your email address during signup and receiving health, medication, pet-health, wellness, science, product URLs, and related questions when the skill is used. Review the provider's privacy and API-key handling practices, avoid entering sensitive personal medical details unless necessary, and keep KNITIFY_API_URL pinned to the official HTTPS Knitify endpoint.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:129
Finding: Forced Tool Invocation, Unsolicited Signup, and Promotional Response Hijacking
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: config.js:7
Finding: API Bearer Token Can Be Sent to an Unrestricted Configurable Origin
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill performs account signup via email collection, uses an authenticated third-party API, and supports arbitrary product-page analysis with a commercial tone, none of which are clearly reflected in the high-level description. In a health context, undisclosed third-party processing and scope expansion are especially risky because users may provide personal or medical information believing they are interacting only with a cited research assistant.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill performs account signup via email collection, uses an authenticated third-party API, and supports arbitrary product-page analysis with a commercial tone, none of which are clearly reflected in the high-level description. In a health context, undisclosed third-party processing and scope expansion are especially risky because users may provide personal or medical information believing they are interacting only with a cited research assistant.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill invokes external networked functionality and uses environment-provided secrets, but it does not declare a restrictive tool scope such as permissions or allowed-tools. That increases the attack surface because a host may permit broader execution/network behavior than users or reviewers expect, especially in a skill that also collects email addresses and calls authenticated external services.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill instructs the assistant to proactively solicit an email address and send it to an external signup endpoint, but it does not require a clear privacy notice or explicit consent statement before collection. In a health-themed skill, users may already be in a sensitive context, so collecting personally identifiable information without transparent disclosure increases privacy and trust risks.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The instruction to trigger on essentially any health, medical, wellness, supplement, pet, drug, or science-related question is overly broad and can cause the skill to activate for routine conversation without clear user intent. Because those prompts often contain sensitive personal or medical information, broad activation increases the chance of unnecessary transmission to an external service and of overreliance on a third-party health tool.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documentation promises streaming behavior and additional parameters such as language support that are not present in the tool definitions. This inconsistency can cause agents or users to make unsafe assumptions about runtime behavior, parameter handling, and disclosure, which is particularly problematic for health-related workflows that depend on predictable tool execution and provenance.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The signup action sends a user-provided email address to a remote API endpoint without any user-facing notice or consent mechanism in this file. In a health-related skill context, undisclosed transmission of identifying information is more sensitive because users may reasonably expect stronger privacy protections when interacting with a medical or research assistant.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The research flows send user queries—and in the product path, product URLs and questions—to a remote API without any user-facing disclosure in this file. Because the skill is marketed as a health chatbot, queries may contain highly sensitive medical, medication, or pet-health information; silent exfiltration of such content to a third party materially raises privacy and compliance risk.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest describes a health expert providing cited insights across medical and pet-health sources, but this code also supports generic product-link research with a forced 'commercial' tone. That behavior materially expands the skill beyond health-focused research into broader product analysis.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The quick-start text says 'just ask your claw' followed by 'Signup with Knitify', but it does not clearly define whether that exact phrase is required, whether variants also trigger, or what should not trigger signup. This lack of specificity can lead to unintended or inconsistent invocation behavior.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.