Security audit

Calorie Tracker

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent calorie tracker, but it silently keeps sensitive food, goal, and behavior history in a persistent local file without clear opt-in, retention, or deletion controls.

Review before installing. This skill does not appear malicious, but it is designed to remember calorie goals, meal history, preferences, and eating patterns across sessions. Install only if you are comfortable with that data being saved in a plaintext file at ~/calories/memory.md, and consider manually reviewing or deleting that file when you no longer want the history kept.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:34
Finding: Sensitive Dietary and Health-Related Data Persisted in a Predictable Plaintext File<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:34-62` **Vulnerability Type**: Plaintext storage of sensitive user data **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown ## Memory Storage User data persists in `~/calories/memory.md`. Create on first use if it doesn't exist. **Format:** ```markdown # Calorie Tracker Memory ## Sources  ## Goal   ## Targets   ## Patterns  ## Preferences   ## Library   ``` *Empty sections = no data yet. Observe and fill.* ``` ### Technical Analysis The skill instructs the agent to persist calorie targets, weight-related goals, eating patterns, tracking preferences, and food history in the predictable file `~/calories/memory.md`. These records may reveal sensitive health and behavioral information. No instruction requires encryption, owner-only file permissions, explicit user consent, data minimization, retention limits, or secure deletion. Consequently, the file's protection depends entirely on the runtime environment and its default file-creation permissions. If those defaults permit access by other local identities or processes, the stored profile can be disclosed. The predictable location also makes discovery straightforward for any actor that already has access to the user's home directory. The finding does not establish remote access or privilege escalation; exploitation requires an existing local proce ...[truncated 1098 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit, informed user consent before enabling persistent storage. 2. Default to session-only storage and make persistence opt-in. 3. Store only fields required for the requested functionality; avoid retaining unnecessary meal history or health-related context. 4. Create the storage directory and file with owner-only permissions, such as directory mode `0700` and file mode `0600`, without relying on the ambient `umask`. 5. Use an approved encrypted storage mechanism when the execution environment supports secure key management. 6. Define a retention period and automatically delete stale records. 7. Provide commands or documented procedures that allow users to view, export, correct, and permanently delete stored information. 8. Avoid recording contraindication screening answers or other medical details unless strictly necessary and separately consented to. 9. Clearly disclose the storage path, stored fields, retention behavior, and potential backup or synchronization exposure before writing data. 10. Handle symbolic links and unexpected existing files safely so that writes cannot be redirected to unintended locations. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

High

Confidence: 98% confidence
Finding: The skill instructs persistent storage of health-related and behavior-related user data in a local memory file without an explicit user-facing privacy notice, retention policy, or consent step. Because the stored data includes goals, eating patterns, and preferences, this creates meaningful privacy risk if users are unaware that sensitive wellness information is being retained across sessions.

Hidden Instructions

High

Category: Prompt Injection
Content: # Calorie Tracker Memory ## Sources  ## Goal
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Anti-Refusal Statement

High

Category: Anti-Refusal
Content: - User weighs food → precision mode - User says "roughly" → estimation mode - User asks "is this bad?" → educate, don't moralize - User logs <1200 consistently → concern check
Confidence: 85% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The skill is framed with broad, open-ended conversational behavior and minimal activation boundaries, which can cause the agent to engage in health-related guidance outside a narrowly scoped calorie-logging function. In a nutrition context, this increases the chance of unsafe advice, especially given the sensitive populations explicitly mentioned elsewhere in the file.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The instruction to 'build library silently' indicates retention of a user's food history and potentially sensitive health-related behavioral data without clear notice or consent. In a calorie-tracking context, this creates a privacy risk because meal patterns, restaurant habits, and packaged-food history can reveal health status, routines, and other sensitive inferences if stored or reused unexpectedly.

Static analysis

No suspicious patterns detected.