Security audit

健康指导助手

Security checks for vulnerabilities and agentic risk

Overview

This health guidance skill asks for broad agent powers and gives unclear privacy and execution boundaries for sensitive health information.

Review this before installing. It may be acceptable if limited to text-only wellness guidance, but the current artifact should clarify whether it can run commands, read or write files, call external services, use callback URLs, and retain health data. Avoid entering sensitive medical details unless the publisher narrows permissions and documents privacy controls.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The skill claims it will not store personal health data, yet elsewhere instructs building a 2–4 week personalized baseline and tracking ongoing health metrics. That contradiction can mislead users about privacy handling and consent, especially for sensitive health information, creating risk of inappropriate collection, retention, or sharing expectations.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The file describes the skill both as MD+EXEC and later as pure Markdown-only, while also advertising file, API, and command execution features. This mismatch obscures the real privilege level of the skill and can cause users or platforms to grant more trust or capability than intended.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The skill is presented as a health-guidance assistant, but it also claims broad automation powers such as file handling, external API integration, and command execution. Those capabilities are unnecessary for the stated purpose and materially expand the attack surface, enabling misuse of the agent environment or exfiltration of sensitive data if invoked loosely.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The invocation example uses a broad natural-language trigger without constraining allowed actions, inputs, or side effects. In a skill that elsewhere mentions file, API, and command capabilities, vague invocation semantics increase the chance of overbroad execution, prompt abuse, or unintended task expansion.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The documentation advertises command execution, file writes, and external API use, but it does not present a prominent, upfront warning that the skill may affect the host system or transmit data externally. That omission undermines informed consent and makes it easier for users to trigger impactful operations unknowingly, especially in a sensitive health-related context.

Static analysis

No suspicious patterns detected.