Security audit

减肥打卡记录

Security checks for vulnerabilities and agentic risk

Overview

This is a local weight-tracking skill that stores and displays body-weight data, with privacy and process-management cautions but no evidence of hidden exfiltration or malicious behavior.

Install only if you are comfortable storing weight history and goals in local JSON files. Run setup.sh without administrator privileges, keep the folder private, prefer localhost-only viewing, do not use the LAN sharing suggestion for personal data unless you understand the exposure, and verify the exact server process before using any port-based kill command.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The skill’s declared purpose is narrow and user-facing, but the documentation introduces additional behaviors such as local port selection/scanning, HTTP server operation, and manual file mutation that are not clearly disclosed in the description. This mismatch is dangerous because users and calling agents may grant trust or trigger the skill expecting simple weight logging, while the actual workflow requires broader local-system interaction than advertised.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The instructions tell the agent to start a local HTTP server and later kill processes by port, which expands the skill from simple data tracking into host process management. That is risky because port-based termination can affect unrelated local services if the wrong port/PID is targeted, and exposing files over a local server increases attack surface unnecessarily for a basic tracking task.

Context-Inappropriate Capability

Medium

Confidence: 81% confidence
Finding: The setup flow instructs users or agents to execute a cross-platform shell script for initialization, which is broader than necessary for a weight tracker and introduces arbitrary script-execution risk. Even if intended for convenience, shell execution on the host is sensitive because it can perform filesystem, environment, and process actions outside the user’s expectation of a simple tracking skill.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The advertised auto-trigger phrases are broad everyday expressions such as asking about weight, which can cause accidental invocation in unrelated conversations. In this skill, unintended triggering is more dangerous because activation may lead to local file writes or launching setup/view workflows without sufficiently explicit user intent.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The documentation describes reading and writing `weight_history.json` but does not prominently warn users that personal health-related records are stored locally and that same-day entries may be overwritten. This is a privacy and integrity issue because users may not realize sensitive data persists on disk or that existing records can be silently modified.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The README states that telling the AI a weight will automatically update stored data, but it does not clearly warn users that sensitive health information is persisted in local JSON files. Weight data is personal health-related information, and undisclosed storage increases the risk of accidental exposure through shared folders, backups, local HTTP serving, or other users on the same machine.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The page binds exporting sensitive weight-history data to a global single-key shortcut ('W') with no confirmation, visible warning, or focus check. In an embedded skill/webview context, accidental keypresses can silently trigger a download of health-related personal data, which is a privacy issue even though the file is written locally rather than exfiltrated remotely.

Static analysis

No suspicious patterns detected.