Security audit

Health Assistant

Security checks for vulnerabilities and agentic risk

Overview

This health assistant mostly fits its stated purpose, but it handles sensitive medical data with weak storage safeguards and includes broad emergency, legal, and veterinary guidance that needs review.

Review this before installing if you plan to enter real medical information. Avoid saving sensitive health records unless you are comfortable with plaintext local files, verify emergency numbers and crisis resources for your location, and treat medication-import, supplement, first-aid, mental-health, and pet-health responses as informational rather than professional advice.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The evals expand the skill into pet health advice even though the described skill purpose is a human health assistant. This scope drift is risky because it can cause the agent to present veterinary guidance without appropriate disclosure, safeguards, or domain-specific constraints, increasing the chance of unsafe or misleading medical-style advice for animals.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The evals include cross-border drug import, customs, and medication-regulation guidance that goes beyond ordinary wellness assistance and touches legally sensitive, potentially abuse-prone topics. In a health assistant context, this can facilitate circumvention of medication controls, unsafe self-medication, or legally incorrect advice about transporting regulated substances across borders.

Vague Triggers

Medium

Confidence: 76% confidence
Finding: The activation criteria are so broad that routine conversation topics could trigger a skill that collects and stores sensitive health, medication, and emergency-contact data. Over-broad triggering increases the chance of unintended invocation, privacy overcollection, and inappropriate medical-style responses in contexts where the user did not intend to engage a health workflow.

Missing User Warnings

High

Confidence: 93% confidence
Finding: The skill instructs collection and storage of highly sensitive health profile information and uploaded medical reports, but it does not clearly warn users at the point of collection that these artifacts may be persisted locally. In the medical context, silent or ambiguous persistence creates serious privacy risk, especially for diagnoses, medications, allergies, blood type, and emergency contacts.

Natural-Language Policy Violations

Medium

Confidence: 81% confidence
Finding: Hard-coding a China-specific crisis hotline without checking the user’s region can misdirect users during mental health emergencies, delaying access to appropriate local emergency services. In a crisis-support context, incorrect locale assumptions can materially increase harm because users may rely on unusable contact information when urgent help is needed.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: This first-aid reference gives actionable emergency medical instructions but does not prominently warn users to verify local emergency numbers or emphasize that trained/professional guidance should be sought immediately before or while acting. In a health-assistant skill, users may rely on the document under stress, and missing jurisdictional and training disclaimers increases the chance of delayed or inappropriate response.

Natural-Language Policy Violations

High

Confidence: 98% confidence
Finding: The file hard-codes 'Call Emergency (120)' without clarifying that 120 is region-specific, which can misdirect users in urgent situations. In a medical emergency context, providing the wrong emergency number can cause dangerous delays in contacting help, making this especially risky for a broadly deployed health assistant.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: This code creates a persistent local directory under the user's home folder and stores sensitive health information in plaintext JSON files without encryption, access controls, retention controls, or explicit user warning/consent. In a health-assistant context, this is more dangerous because the data includes medical profile, medications, reminders, and records, which could be exposed to other local users, malware, backups, or accidental sharing.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The module stores sensitive health information under the user's home directory in plaintext JSON without any warning, consent flow, or protection controls. In a health assistant context, these files can contain highly sensitive medical data, so local compromise, shared-user systems, backups, or malware could expose private health information.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: These functions persist health records, medications, reminders, and profiles directly to local JSON files with no confidentiality safeguards, access control, minimization, or runtime notice. Because this skill is specifically a health assistant handling medical and wellness data, the context makes the issue more dangerous: exposure of diagnoses, medications, and profile details can create serious privacy and compliance risks.

Static analysis

No suspicious patterns detected.