Healthcheck Rose

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:37 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent local health tracker, but its inline Node commands use user-derived values in executable JavaScript without clear validation, creating a material review concern.

Review this skill before installing. It appears intended to keep a local health log and does not show exfiltration or hidden persistence, but it should be tightened so cup counts are parsed and validated as data rather than inserted into inline JavaScript source. Treat the JSON file as personal health data and review or remove it when no longer needed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:25

Finding

JavaScript Code Injection Through Unvalidated Water Intake Value

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 25
Vulnerability Type: User-controlled JavaScript code injection
Risk Level: High

Vulnerable Code

bash

node -e "const fs=require('fs');const f='{baseDir}/health-data.json';let d={water:[],sleep:[]};try{d=JSON.parse(fs.readFileSync(f))}catch(e){}d.water.push({time:new Date().toISOString(),cups:CUPS});fs.writeFileSync(f,JSON.stringify(d));console.log('Da ghi: '+CUPS+' coc')"

The Skill instructs the agent to replace CUPS with a number extracted from user input. The value is inserted directly into JavaScript source passed to node -e. The instructions do not require strict numeric parsing, range validation, safe quoting, or passing the value as a command-line argument.

Technical Analysis

Because CUPS appears as executable JavaScript rather than as a data value, verbatim or insufficiently validated substitution can alter the syntax and behavior of the generated program. A malicious input that is accepted as the replacement value could close or extend the intended expression and introduce arbitrary JavaScript.

This is source-code injection rather than ordinary JSON manipulation. Once the constructed command is invoked, Node.js evaluates the injected content with the same operating-system identity, environment, filesystem access, and process-launching capabilities available to the agent.

Exploitation depends on the invoking agent substituting attacker-controlled content instead of enforcing a strict numeric grammar. The Skill itself supplies no safeguard that would prevent this behavior.

Attack Path

1. An attacker submits a water-record request whose purported cup count contains JavaScript syntax rather than a plain numeric value.
2. The agent follows the instruction to replace CUPS and inserts the attacker-controlled content into the node -e source.
3. The agent invokes the generated shell command.
4. Node.js evaluates the injecte ...[truncated 593 chars]

Remediation

View remediation

Remediation Suggestions

Do not construct executable JavaScript by replacing tokens with user input.

• Pass the cup count as a separate process argument or through a controlled environment variable.
• Parse it inside the fixed program with Number() or a similarly strict conversion.
• Require the complete input to match an explicitly permitted numeric format.
• Reject non-finite, negative, fractional, or unreasonably large values according to the application's requirements.
• Keep the JavaScript source constant so user input is handled only as data.
• Pass baseDir as a separate data argument and resolve the path against an approved storage directory rather than embedding it in source code.
• Consider using a dedicated script file and a structured invocation API that does not involve a shell.

A safe implementation should validate the argument before modifying data, for example:

js

const cups = Number(process.argv[1]);
if (!Number.isInteger(cups) || cups < 0 || cups > 100) {
  throw new Error('Invalid cup count');
}

The invoking process should provide the value as an argument without interpolating it into the JavaScript program.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:63

Finding

JavaScript Code Injection Through Unvalidated Updated Cup Count

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 63
Vulnerability Type: User-controlled JavaScript code injection
Risk Level: High

Vulnerable Code

bash

node -e "const fs=require('fs');const f='{baseDir}/health-data.json';let d=JSON.parse(fs.readFileSync(f));d.water[d.water.length-1].cups=NEW_CUPS;fs.writeFileSync(f,JSON.stringify(d));console.log('Updated')"

The update command places NEW_CUPS directly inside JavaScript source evaluated by node -e. No instruction constrains the replacement to a validated numeric literal or requires it to be passed separately from executable code.

Technical Analysis

If an agent derives NEW_CUPS from user input and performs direct textual replacement, attacker-controlled JavaScript syntax can change the generated program. The assignment context does not make interpolation safe: a crafted expression can introduce side effects or escape the intended statement.

Node.js inline evaluation gives injected code access to built-in modules and other capabilities granted to the running process. The absence of third-party dependencies does not mitigate this issue because exploitation relies on the Node.js runtime itself.

Exploitation depends on unsafe substitution by the invoking agent, but the Skill explicitly recommends replacement without defining validation or safe argument handling.

Attack Path

1. An attacker requests an update to the latest water record and supplies a crafted value as the new cup count.
2. The agent replaces NEW_CUPS with that value in the inline JavaScript.
3. The generated node -e command is executed.
4. Node.js interprets the injected syntax as executable code.
5. The attacker's code runs with the same permissions and local access as the Skill process.

Impact Assessment

Successful exploitation can result in arbitrary local code execution. Potential consequences include unauthorized reading or modification of accessib ...[truncated 220 chars]

Remediation

View remediation

Remediation Suggestions

Replace textual source substitution with data-only argument handling.

• Keep the node -e source fixed and retrieve the new value from process.argv or a validated input file.
• Convert the value with Number() and reject it unless it is finite and satisfies the intended integer and range constraints.
• Validate that the water array exists and contains an entry before updating it.
• Pass the storage path as a separate argument and restrict it to an approved directory.
• Avoid invoking a shell where possible; use a process API with an explicit argument array.
• Prefer a reviewed script file over dynamically assembled inline source.

For example, validate the separate argument before assignment:

js

const newCups = Number(process.argv[1]);
if (!Number.isInteger(newCups) || newCups < 0 || newCups > 100) {
  throw new Error('Invalid cup count');
}
if (!Array.isArray(d.water) || d.water.length === 0) {
  throw new Error('No water record to update');
}
d.water[d.water.length - 1].cups = newCups;

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill writes, updates, and deletes persistent health-related records in a local JSON file, but the description does not clearly warn users that data will be stored and modified on disk. This can mislead users about privacy and persistence, increasing the chance of unintended retention or alteration of sensitive personal habit data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The activation phrases are specified only in Vietnamese, such as "uống X cốc", "đi ngủ", and "thống kê", with no indication that this is optional or limited to a Vietnamese-language deployment. Under SQP-3, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.