WHO Growth Charts

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 5:31 AM UTC
• Version: 1.2.3

Overview

This skill coherently generates local WHO growth charts, with disclosed network downloads and local chart/cache files, but users should handle child health data and installation steps carefully.

Install in a virtual environment, prefer pinned dependencies, keep child measurement JSON and generated charts in a private directory, and avoid the documented /tmp/withings.json pattern unless replaced with a secure temporary file or direct pipe. Expect the skill to download WHO reference files and cache them locally.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:66

Finding

Predictable Temporary File Used for Sensitive Child Health Data

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 66
Vulnerability Type: Unsafe temporary file handling and plaintext storage of sensitive health data
Risk Level: Medium

Vulnerable Code Snippet:

bash

# Get Withings weight data (assuming withings-family skill is installed)
python3 ../withings-family/scripts/withings.py emma body > /tmp/withings.json

# Parse and generate charts
# (The growth chart script handles Withings JSON format if implemented, otherwise transform it)

Technical Analysis

The documented integration redirects child body-measurement data to the fixed, globally predictable path /tmp/withings.json. Shell output redirection does not securely create a unique temporary file. It can follow an existing symbolic link, truncate an existing target, and create the file using permissions determined by the invoking user's current umask.

Because /tmp is commonly shared among local users, another user may be able to predict and monitor this path. If permissions are permissive, the resulting JSON can disclose sensitive child health information. A pre-created symbolic link may also cause the shell to truncate or overwrite another file writable by the victim.

Attack Path

1. A local attacker observes that the documented workflow always uses /tmp/withings.json.
2. Before the victim runs the command, the attacker creates that path or places a symbolic link there pointing to a file writable by the victim.
3. The victim invokes the documented command.
4. Shell redirection follows the existing path and writes the exported Withings body data to it.
5. Depending on local filesystem protections and permissions, the attacker reads the sensitive measurements or causes a victim-writable symlink target to be truncated and replaced with JSON data.

Exploitation requires local access and is constrained by operating-system protections such as protected symlinks, directory permissions, and ...[truncated 590 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the predictable filename with a securely created temporary file:

  bash

  tmp_file="$(mktemp "${TMPDIR:-/tmp}/withings.XXXXXX.json")" || exit 1
  chmod 600 "$tmp_file"
  trap 'rm -f "$tmp_file"' EXIT
  python3 ../withings-family/scripts/withings.py emma body > "$tmp_file"
  

• Prefer piping data directly between processes when the chart importer supports standard input, avoiding persistent plaintext storage.
• Ensure temporary files are created atomically with owner-only permissions rather than relying solely on the current umask.
• Delete temporary health data immediately after successful processing.
• Do not reuse an existing temporary path, and verify that any persistent destination is a regular file in a private directory.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:29

Finding

Unpinned Third-Party Python Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 29–32
Vulnerability Type: Unpinned dependency installation from a mutable package source
Risk Level: Low

Vulnerable Code Snippet:

bash

Install Python dependencies:
```bash
pip install pandas matplotlib scipy openpyxl

text

### Technical Analysis

The installation command identifies dependencies only by package name. It provides no reviewed version constraints, cryptographic hashes, lockfile, or explicit trusted package index. Consequently, the artifacts installed can change over time even though the Skill package itself has not changed.

Python package installation may execute package build logic, and the installed packages are later imported by `scripts/growth_chart.py`. A compromised package release, malicious artifact served through a configured index, or unsafe local package-index configuration could therefore introduce code that executes with the permissions of the installing or invoking user.

The listed package names are established packages and there is no evidence in the project that any of them is currently malicious. The issue is the absence of reproducible and integrity-verified dependency controls, rather than a confirmed malicious dependency.

### Attack Path

1. An attacker compromises an upstream package release or a package repository selected by the user's `pip` configuration.
2. The user follows the documented `pip install` command.
3. `pip` resolves an attacker-controlled or compromised artifact because no exact version or hash is required.
4. Malicious build or installation logic may run during installation, or malicious module code runs when `growth_chart.py` imports the dependency.
5. The payload executes with the permissions of the user running the installation or chart generator.

Exploitation depends on a compromised dependency source, package release, network/package-index configuration, or equivalent supply-chain
...[truncated 498 chars]

Remediation

View remediation

Remediation Suggestions

• Define reviewed, exact dependency versions in a requirements or lock file.
• Generate and verify cryptographic hashes for all packages and transitive dependencies, for example by installing with --require-hashes.
• Use python3 -m pip to ensure dependencies are installed for the intended interpreter.
• Install dependencies inside a dedicated virtual environment rather than the system Python environment.
• Configure an explicit trusted package index or approved internal mirror.
• Add an automated dependency-review process for vulnerability scanning, controlled upgrades, and lockfile regeneration.
• Document a reproducible installation workflow, such as:

  bash

  python3 -m venv .venv
  . .venv/bin/activate
  python3 -m pip install --require-hashes -r requirements.txt
  

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill documentation advertises capabilities that involve network access, local file writes, and likely environment-dependent behavior, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates a least-privilege failure: an agent may invoke the skill with broader-than-necessary access, enabling unintended downloads, filesystem modification, or access to sensitive workspace context without clear operator review.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.