Security audit

Peer Reviewed Parent

Security checks for vulnerabilities and agentic risk

Overview

This skill has no code-execution or persistence behavior, but it overstates the quality of its evidence for infant-care guidance and could make weak sources sound medically vetted.

Review this skill carefully before installing. It appears technically low-risk, but do not treat its responses as strictly peer-reviewed medical evidence, especially for feeding, supplements, allergies, sleep safety, symptoms, or developmental concerns; verify claims with a pediatrician or authoritative clinical guidance.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

other

Warning

Location: SKILL.md:7
Finding: Non-Peer-Reviewed Sources Misrepresented as Peer-Reviewed Evidence
Content: View full analysis
RCTs > cohort studies > expert opinion. State which tier you're drawing from. ``` `README.md:5-10` makes a similar representation: ```markdown ## What it does - Answers parenting questions using only evidence-based research (not mommy blogs) - Cites specific studies with authors, journals, and years - Covers: cognitive, language, motor, social-emotional, sleep, nutrition, sensory play, screen time, and discipline - Distinguishes between consensus findings, debated areas, and outdated advice ``` However, `references/all-sources.md` includes secondary, commercial, news, blog, AI-generated, and repository-hosted sources alongside peer-reviewed publications: ```markdown 1. ACE Physical Therapy. (n.d.). *SHOES VS BAREFOOT FOR YOUR CHILD?* https://ace-pt.org/ace-physical-therapy-and-sports-medicine-institute-shoes-vs-barefoot-for-your-child/ 8. Babies Form Memories. Why Do Adults Forget Them? *The Scientist*. https://www.the-scientist.com/babies-form-memories-why-do-adults-forget-them-72826 9. Baby Sleep Science. (n.d.). *Navigating the 2-to-1 Nap Transition*. https://www.babysleepscience.com/single-post/navigating-the-2-to-1-nap-transition-what-to-expect-and-how-to-manage-it 12. Brill, A. (n.d.). *The Discipline Approach That Helps Babies and Toddlers Thrive*. ...[truncated 4064 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill description promises answers based only on peer-reviewed research from top medical journals, but the source list includes blogs, news sites, commercial organizations, ResearchGate mirrors, and advocacy pages. In a parenting/infant-health context, this provenance mismatch can mislead users into treating lower-quality or non-peer-reviewed guidance as medically vetted evidence, increasing the risk of unsafe feeding, sleep, development, or discipline advice.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README states the skill activates automatically on broad categories like parenting, child development, or infant care topics, which can cause the skill to engage in conversations the user did not explicitly intend for this specific tool. While this is not directly malicious and the subject matter is relatively low risk, broad auto-triggering can create consent, privacy, and inappropriate-routing issues by pulling sensitive family or child-health discussions into the skill unnecessarily.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger description ends with a broad catch-all phrase ('...or any parenting question for children under 2'), which can cause the skill to activate for a very wide range of prompts. In a routing system, this overreach can overshadow more appropriate specialized or safety-focused skills, increasing the chance of misrouting and lower-quality or unsafe advice in edge cases such as medical symptoms or emergencies.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The header presents the file as a complete APA-formatted source list, but the entries are inconsistent in format and include non-scholarly materials, suggesting weak source-governance controls. While formatting inconsistency alone is not a security issue, here it reinforces misleading trust signals about rigor and completeness in a safety-sensitive domain involving children under 2.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.