Security audit

Calorie Tracker

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent calorie tracker, but it silently keeps sensitive food, goal, and behavior history in a persistent local file without clear opt-in, retention, or deletion controls.

Review before installing. This skill does not appear malicious, but it is designed to remember calorie goals, meal history, preferences, and eating patterns across sessions. Install only if you are comfortable with that data being saved in a plaintext file at ~/calories/memory.md, and consider manually reviewing or deleting that file when you no longer want the history kept.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:34
Finding: Sensitive Dietary and Health-Related Data Persisted in a Predictable Plaintext File
Content: View full analysis
## Goal ## Targets ## Patterns ## Preferences ## Library ``` *Empty sections = no data yet. Observe and fill.* ``` ### Technical Analysis The skill instructs the agent to persist calorie targets, weight-related goals, eating patterns, tracking preferences, and food history in the predictable file `~/calories/memory.md`. These records may reveal sensitive health and behavioral information. No instruction requires encryption, owner-only file permissions, explicit user consent, data minimization, retention limits, or secure deletion. Consequently, the file's protection depends entirely on the runtime environment and its default file-creation permissions. If those defaults permit access by other local identities or processes, the stored profile can be disclosed. The predictable location also makes discovery straightforward for any actor that already has access to the user's home directory. The finding does not establish remote access or privilege escalation; exploitation requires an existing local proce ...[truncated 1098 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill instructs persistent storage of health-related and behavior-related user data in a local memory file without an explicit user-facing privacy notice, retention policy, or consent step. Because the stored data includes goals, eating patterns, and preferences, this creates meaningful privacy risk if users are unaware that sensitive wellness information is being retained across sessions.
Content: No source excerpt is available for this finding.

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.
md
# Calorie Tracker Memory ## Sources  ## Goal

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 85% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Content: Scanner excerpt · goals.md (reported line 50)May include surrounding context.
md
- User weighs food → precision mode - User says "roughly" → estimation mode - User asks "is this bad?" → educate, don't moralize - User logs <1200 consistently → concern check

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill is framed with broad, open-ended conversational behavior and minimal activation boundaries, which can cause the agent to engage in health-related guidance outside a narrowly scoped calorie-logging function. In a nutrition context, this increases the chance of unsafe advice, especially given the sensitive populations explicitly mentioned elsewhere in the file.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instruction to 'build library silently' indicates retention of a user's food history and potentially sensitive health-related behavioral data without clear notice or consent. In a calorie-tracking context, this creates a privacy risk because meal patterns, restaurant habits, and packaged-food history can reveal health status, routines, and other sensitive inferences if stored or reused unexpectedly.
Content: No source excerpt is available for this finding.