T09 · Insecure Skill Coding Practices
Warning
- Location
data/profile.json:1- Finding
Bundled and Persisted Sensitive Health Data in Plaintext
- Content
View full analysis
- Remediation
View remediation
Security audit
Half Full
Security checks for vulnerabilities and agentic risk
Overview
The skill has a coherent meal-tracking core, but it also stores sensitive health data and directs hidden reproductive-health inference without clear user consent.
Review carefully before installing. The core food logging behavior is understandable, but the publisher should remove bundled personal-looking data, add clear opt-in and deletion controls for health data, store records in a protected user data location, and remove hidden menstrual-cycle inference unless it is a transparent user-requested feature.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
other
Warning
- Location
AGENT_GUIDE.md:40- Finding
Undisclosed Inference of Sensitive Reproductive-Health Information
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (21)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The guide directs automatic parsing and storage of Apple Health data when a tagged message is received, but there is no user-facing disclosure in the skill description or interaction flow. This is dangerous because it collects and retains sensitive health information without transparent notice, undermining informed consent and increasing privacy and compliance risk.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The guide explicitly instructs the agent to infer menstrual-cycle status from eating behavior and weight fluctuations, which creates sensitive health profiling without explicit user disclosure or consent. In a mindful-eating companion, this goes beyond the stated purpose and could expose highly sensitive reproductive-health inferences if stored, surfaced, or used in personalization.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The instructions direct the agent to infer menstrual-cycle information from food cravings and weight patterns without any privacy warning or consent step. This is especially risky because it derives sensitive health information from indirect signals, which users may not reasonably expect from a meal-tracking companion.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This section instructs the agent to infer and effectively retain a highly sensitive reproductive-health attribute from user behavior, then use it to silently alter responses. In the context of a consumer mindful-eating skill, hidden profiling of menstrual-cycle status is particularly dangerous because it creates covert sensitive-state inference without user knowledge or consent.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill claims to help users understand bodily needs through mindful eating, but the detected behavior centers on persistent profile storage and metabolic calculations via CLI commands. For a health-oriented skill, undisclosed profile persistence and derived health calculations can expose sensitive personal information and erode user trust when they are not clearly communicated.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The skill claims to help users understand bodily needs through mindful eating, but the detected behavior centers on persistent profile storage and metabolic calculations via CLI commands. For a health-oriented skill, undisclosed profile persistence and derived health calculations can expose sensitive personal information and erode user trust when they are not clearly communicated.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The skill claims to help users understand bodily needs through mindful eating, but the detected behavior centers on persistent profile storage and metabolic calculations via CLI commands. For a health-oriented skill, undisclosed profile persistence and derived health calculations can expose sensitive personal information and erode user trust when they are not clearly communicated.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Any message containing the generic tag
[半饱数据]triggers automatic parsing and storage, creating a broad activation condition that may process content unintentionally or when inserted by another party. Because the trigger is simple and not clearly authenticated or confirmed, the agent may ingest sensitive data in contexts the user did not intend.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill instructs the agent to ask for zodiac sign and use it in ongoing interactions, which is unrelated to meal tracking and mindful eating. While not highly sensitive on its own, it is unnecessary data collection and weakens purpose limitation by normalizing collection of irrelevant personal attributes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README explicitly asks users to provide height, weight, and health-related goals, which are sensitive body/health data, but it gives no indication of how that data will be stored, processed, retained, or protected. In a wellness-tracking skill, this omission increases privacy risk because users may disclose personal health information without informed consent or clear safeguards.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill declares executable scripts that can read and write local files, but the manifest does not declare any tool scope or permissions boundary. This creates a transparency and containment problem: users and hosting platforms cannot easily assess or restrict the data access the skill needs, increasing the chance of unintended file access or persistence.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The module docstring, usage examples, CLI help text, and user-facing summaries are written entirely in Chinese, which imposes a specific language on users and agents. The file does not present any option to select another language or document that the locale restriction is intentional and justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The natural-language title and all user-facing strings in this file are written in Chinese, and the CLI help/outputs do not provide any option to choose another language. That creates a language-policy issue because the skill implicitly forces a specific language without user opt-in or justification.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest describes a mindful eating companion focused on tracking meals with photos and understanding bodily needs around eating. In contrast, this file adds a separate weight-recording subsystem (
weightandweight-trend) that stores and analyzes body-weight history, which is a broader wellness/weight-management capability not indicated by the manifest wording.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
User-facing strings, help text, and messages throughout the script are exclusively in Chinese, with no indication that the user can select another language. Under the stated policy, forcing a specific language without opt-in is a natural-language policy issue unless the locale restriction is explicitly documented and justified.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script stores personal health-related profile data such as height, weight, age, gender, and eating habits to a local JSON file without any user-facing notice, consent flow, or retention explanation. In the context of a mindful eating/health companion, this is sensitive personal data, and silent persistence increases privacy risk if the device is shared, backed up, or compromised.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The natural-language content of the skill is presented exclusively in Chinese, and the README does not indicate that the skill supports other languages or that Chinese-only operation is an intentional, justified locale constraint. This can violate language/locale policy when users are not given an explicit language choice or opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The file presents core descriptive text, tags, and command examples in both Chinese and English, but does not state whether the skill supports multiple languages by choice or is intended for a specific locale. Under the policy rule for language or locale constraints, this can create an implicit language expectation without user opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
This JSON file contains user-facing natural-language values such as food names and notes exclusively in Chinese. Under the stated policy, forcing a specific language without user opt-in or documented regional justification can be a locale-policy issue.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This code file contains user-facing natural language entirely in Chinese in the module description and command help text, presenting the tool as Chinese-first without any visible opt-in or language-selection mechanism. Under the policy rule for language/locale handling, forcing a specific language without user choice can be a natural-language policy violation.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The manifest frames the skill around meal tracking and understanding eating/body needs via food photos, but this file implements parsing, storing, and summarizing Apple Health metrics such as steps, active calories, resting calories, and stand hours. While body-related data can be adjacent to the product theme, the code materially expands the behavior into general activity tracking beyond the manifest's stated meal-centric scope.
- Content
Static analysis
No suspicious patterns detected.