Security audit

Health Buddy Pro

Security checks for vulnerabilities and agentic risk

Overview

This health tracker is mostly purpose-aligned, but it handles sensitive wellness data while giving users incomplete and partly conflicting privacy and storage disclosures.

Install only if you are comfortable with this skill storing sensitive wellness information locally and potentially being used with a dashboard that stores similar data in a database. Review the setup commands first, avoid relying on photo-based calorie estimates for medical decisions, and look for clear consent, deletion/export, retention, and cloud-storage controls before entering personal health data.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The script claims to detect the workspace root by searching upward, but the loop immediately assigns the current directory and breaks without checking any marker. This can cause the script to operate on an unintended path when run from the wrong directory, potentially changing permissions or creating files in an unexpected skills tree.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The activation phrase "Let's set up Health Buddy Pro" is broad and does not constrain what actions the skill may take during setup. In an agent context, vague invocation language can cause the agent to enter the skill unexpectedly or give the skill too much latitude, especially when handling sensitive health-related data and screenshots.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The setup prompt instructs users to run commands that copy files, create directories, and change permissions across the local workspace, but it does not begin with a clear warning that these actions will modify the filesystem. Even though the commands include some safety checks, the lack of explicit upfront disclosure increases the chance of users pasting and executing them without understanding the scope of changes.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The usage trigger is extremely broad and can activate on ordinary health- or nutrition-related conversation, causing the skill to collect, infer, or store sensitive health data in contexts where the user may not have intended to invoke it. Because this skill handles nutrition, body metrics, supplements, and possible medical-adjacent disclosures, over-triggering increases privacy and safety risk beyond a normal benign chat skill.

Natural-Language Policy Violations

Medium

Confidence: 84% confidence
Finding: The skill hard-codes calorie minimums based only on 'women' and 'men', while the schema separately treats sex as nullable and does not ensure a safe, inclusive, or clinically justified mapping. This can lead to unsafe or inappropriate guidance for users who do not fit the binary rule, whose physiology differs from the assumption, or who never provided sex information.

Missing User Warnings

Medium

Confidence: 72% confidence
Finding: The spec explicitly proposes persistent cloud-backed storage for detailed health-related data in Supabase, including nutrition, hydration, supplements, activity, custom metrics, and meal photos, yet provides no privacy, data-classification, retention, or secure-handling requirements. In this context, that omission is dangerous because implementers may treat sensitive user health information as ordinary app data, increasing the chance of over-collection, over-retention, misconfigured access, or insecure sharing despite RLS being mentioned.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The manifest clearly defines collection and storage of sensitive health-related data, including nutrition, hydration, supplements, activity, and custom health metrics, but provides no user-facing disclosure about privacy, retention, sharing, or handling of that data. In a health-tracking context, this omission increases the risk of users submitting sensitive personal information without informed consent, and can create compliance, trust, and misuse risks even if no explicit exfiltration is shown in the manifest.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: SKILL.md:35