Security audit

healthcheck

Security checks for vulnerabilities and agentic risk

Overview

This health tracker is not deceptive, but it needs review because its command snippets can run unintended local code if a water amount is not strictly validated.

Install only if you are comfortable with a local health log being kept in the skill directory and with the current implementation running shell/Node snippets. The publisher should change the snippets to pass cup counts as separate validated arguments, reject non-numeric values, and add confirmation for update/delete actions before this is treated as routine.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:26
Finding: Arbitrary Code Execution Through Unvalidated Water-Cup Input
Content: View full analysis
Remediation: View remediation
100) { throw new Error('Invalid cup count'); } d.water.push({ time: new Date().toISOString(), cups }); ``` The argument must be passed separately without interpolating it into the script source. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:60
Finding: Arbitrary Code Execution Through Unsafe Update-Value Interpolation
Content: View full analysis
Remediation: View remediation
100) { throw new Error('Invalid cup count'); } if (!Array.isArray(d.water) || d.water.length === 0) { throw new Error('No water record to update'); } d.water[d.water.length - 1].cups = newCups; ``` ]]>

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill persists health-related data to a local JSON file but does not clearly warn the user that this information will be stored across sessions. Because the data includes sleep and water intake history, the omission can lead to unintended retention of sensitive personal wellness data and surprise the user about where it is kept.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The invocation examples are written as fixed Vietnamese phrases such as "uống X cốc", "đi ngủ", and "thống kê" with no indication that the skill is intentionally locale-specific or that other languages are supported. This can violate language/locale policy when a skill imposes one language without user opt-in or justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The update and delete commands directly modify or remove existing records without an explicit warning or confirmation step. This creates a realistic risk of accidental data loss or silent tampering with a user's health log, especially in an assistant workflow where commands may be inferred or triggered from natural language.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.