Security audit

FitBuddy

Security checks for vulnerabilities and agentic risk

Overview

FitBuddy is a coherent fitness-tracking skill that stores local health and diet logs, with optional reminder and restaurant integrations users should enable carefully.

Install only if you are comfortable keeping fitness, diet, weight, and health-condition data in the skill's local fitbuddy-data folder. Review any cron reminders before enabling them, avoid third-party messaging channels if you do not want reminder content sent externally, and keep optional MCP or messaging tokens out of screenshots, logs, and version control.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The guide explicitly promises that sensitive health information stays only on the local device, but later instructs the agent to configure external messaging channels and send test messages. That creates a misleading privacy guarantee and a real risk that health-related data or metadata could be transmitted to third-party services without informed user consent.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The README explicitly instructs users to provide and store sensitive health and profile data such as height, weight, age, gender, goals, and training schedule, and later documents local persistence in profile and records files, but it does not clearly warn about privacy, retention, or access risks. In a fitness-tracking skill, this omission matters because health-related data is sensitive, may reveal habits and conditions, and could be exposed through shared devices, backups, or repositories if users do not understand where it is stored.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The activation text is broad enough to match ordinary fitness or diet conversation, which can cause the skill to run in contexts where the user did not intend persistent logging or file updates. In this skill, accidental activation is more dangerous because the skill can write records, modify profiles, and launch scripts, so a simple conversational mention could trigger state-changing operations.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The recommendation trigger includes very broad everyday phrases like asking what to eat, which can cause the skill to activate in casual conversation without clear user intent to use the restaurant integration. In this fitness context, that increases the chance of unsolicited meal guidance or restaurant-linked suggestions being injected into normal chat, creating unwanted behavioral influence and reducing user control.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The setup guide instructs users to copy and place an Authorization token into CLI commands and JSON config without warning that the token is sensitive. This can lead to credential leakage through shell history, screenshots, shared workspaces, committed config files, or logs, potentially allowing unauthorized access to the McDonald's MCP account or linked services.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The file is entirely written in Chinese and does not indicate any mechanism to detect or respect the user's preferred language or locale. In a fitness assistant, this can cause misunderstanding of training, injury-related guidance, and nutrition instructions, reducing usability and potentially leading to unsafe user actions if important guidance is misread.

Static analysis

No suspicious patterns detected.