Security audit
Security checks for vulnerabilities and agentic risk
This skill is a public health data helper with some catalog-scope inconsistencies, but no hidden code, credential access, persistence, or destructive behavior was found.
Install only if you are comfortable using Pilot Protocol service agents for public data queries. Prefer /help and fresh list-agents discovery before sending requests, and avoid using this skill for private health records, medical advice, or food/exercise/tides tasks unless you intentionally choose those listed agents.
The file explicitly says not to use this skill for nutrition or food-product data, yet the catalogue advertises openfda-food-recall, which directly handles food-product recall information. This contradiction can cause policy bypass through documentation confusion, leading agents or users to invoke prohibited functionality despite the stated restriction.
The skill metadata and description scope this capability to public-health and biomedical APIs, but the embedded catalogue includes clearly out-of-scope services such as NOAA tides, exercise data, and food recall data. This mismatch can mislead downstream agents into invoking unrelated services under a trusted health label, weakening policy boundaries and enabling accidental data access or unsafe task routing.
No suspicious patterns detected.
