Security audit

Fat Loss Coach

Security checks across malware telemetry and agentic risk

Overview

This is a transparent fat-loss coaching skill, but it handles sensitive body and health information and should be used carefully.

Install only if you are comfortable with the agent storing weight, body measurements, diet, exercise, and health-status notes in memory. Avoid entering unnecessary medical details, and consult a qualified clinician or dietitian before following calorie restriction, fasting, HIIT, or strength plans if you are pregnant, under 18, have diabetes, an eating-disorder history, cardiovascular risk, injuries, medications that affect diet or exercise, or other medical conditions.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill directs storage of sensitive health and body metrics in persistent per-user memory without any retention notice, consent flow, minimization rule, or deletion guidance. This creates privacy risk because weight, body fat, health status, and related profile data can accumulate over time and be exposed, misused, or retained longer than users expect.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The file presents concrete weight-loss meal plans with gendered calorie framing such as '1200 kcal（女性减脂下限）' and '2000 kcal（男性标准减脂）' but provides no safety notice that calorie needs vary widely by body size, age, medical conditions, activity level, pregnancy, lactation, or eating-disorder risk. In a fat-loss coaching skill, users are likely to treat these examples as authoritative guidance, which can encourage unsafe restriction or inappropriate dieting for vulnerable users.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The template explicitly asks users to record sensitive health-related data including body weight, diet, exercise patterns, and subjective condition without any notice about privacy, storage, minimization, or sharing risks. In a coaching skill context, this can lead users to disclose regulated or highly personal data unnecessarily, increasing privacy and misuse risk if the data is logged, retained, or exposed elsewhere in the system.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: This file gives progressively strenuous exercise prescriptions, including HIIT, weighted movements, and heart-rate targets, but does not include clear user-facing safety guidance to stop if pain, dizziness, chest discomfort, or medical limitations apply, nor does it advise consultation with a clinician for users with chronic disease, injury, pregnancy, or low fitness. In a fat-loss coaching skill, users may rely on the plan as actionable health guidance, so omission of safety screening increases the risk of injury or aggravation of underlying conditions.

Ssd 3

Medium

Confidence: 97% confidence
Finding: Persistent storage of per-user health profiles without privacy guardrails increases the blast radius of any memory leakage, cross-session access bug, or operator misuse. The context makes this more sensitive because the stored fields include health condition, body metrics, and progress history, which are personal and potentially regulated in some environments.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.