Health Toolkit Free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:21 AM UTC
• Version: 1.0.0

Overview

This health-tracking skill is coherent, but it should be reviewed because it stores and can back up sensitive health records in plaintext with limited warnings and broad activation wording.

Install only if you are comfortable keeping health, diet, sleep, and fitness records as local plaintext files. Use restrictive file permissions, avoid syncing `~/.health` or backup archives to cloud folders unless you intentionally accept that exposure, and require explicit confirmation before imports, exports, resets, or bulk changes.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:113

Finding

Plaintext Storage and Backup of Sensitive Health Data

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:113, SKILL.md:177, SKILL.md:264-265, and SKILL.md:387-390
Vulnerability Type: Plaintext sensitive-data storage and unprotected backup
Risk Level: Medium

Vulnerable Code

python

path.write_text(json.dumps(workout, ensure_ascii=False, indent=2))

python

path.write_text(json.dumps(record, ensure_ascii=False, indent=2))

bash

mkdir -p ~/.health/{workouts,sleep,diet,metrics,goals}
echo '{"version":"1.0","edition":"free"}' > ~/.health/config.json

bash

tar -czf health-backup-$(date +%Y%m%d).tar.gz ~/.health/
rsync -av ~/.health/ ~/cloud/health-backup/

Technical Analysis

The Skill stores workout, sleep, diet, profile, and other health information as plaintext JSON or YAML. It creates the health-data directories without explicitly enforcing restrictive permissions, and files created through Path.write_text() inherit permissions determined by the user's current umask.

The backup procedure produces an unencrypted archive in the current working directory. Its accessibility likewise depends on ambient directory permissions and umask. The optional rsync command copies the same plaintext records into a potentially cloud-synchronized directory without adding encryption.

Consequently, confidentiality depends on environmental defaults rather than security controls established by the Skill. This is particularly significant because the records may contain sensitive health measurements and personally identifying profile information.

Attack Path

1. A user follows the Skill instructions and records health information under ~/.health/.
2. The files are written in plaintext with permissions derived from the existing umask.
3. The user generates an unencrypted archive in the current directory or copies the records into a cloud-synchronized directory.
4. Another local account, an application with access to th ...[truncated 936 chars]

Remediation

View remediation

Remediation Suggestions

1. Create the root data directory with owner-only permissions, such as mode 0700.
2. Create health-record and configuration files with mode 0600 rather than relying on the ambient umask.
3. Use atomic file creation and explicitly set permissions after writing.
4. Store backup archives in a dedicated owner-only directory instead of the current working directory.
5. Encrypt backup archives with an authenticated encryption mechanism before storage or synchronization.
6. Require clear user confirmation before copying health records into any cloud-synchronized location.
7. Document the cloud provider's retention, sharing, and account-security implications.
8. Avoid placing secrets or encryption keys in the same directory as the encrypted health records.
9. Provide secure deletion, retention, and backup-restoration procedures for sensitive records.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:429

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:429
Vulnerability Type: Unpinned package installation and supply-chain exposure
Risk Level: Low

Vulnerable Code

bash

pip install pyyaml

Technical Analysis

The installation instruction does not pin PyYAML to a reviewed version, verify a package hash, use a lock file, or identify a trusted package index. Package resolution therefore depends on the environment's current pip configuration and whatever release is considered current when the command is executed.

If the selected package index or upstream package is compromised, or if pip is configured to use an untrusted mirror, installation may retrieve an unexpected distribution. Python package installation can execute package build logic and subsequently exposes installed code to the application at import time.

The command refers to the legitimate PyYAML package and does not itself demonstrate a malicious dependency. The risk arises from the absence of integrity and version controls around dependency retrieval.

Attack Path

1. An attacker compromises a configured package source, controls an untrusted mirror, or causes the environment to resolve packages through an attacker-controlled index.
2. A user follows the documented pip install pyyaml instruction.
3. Pip resolves an unreviewed or compromised distribution because no version or hash constraint is present.
4. Malicious build-time code executes during installation, or malicious package code executes when imported.
5. The payload operates with the privileges of the user running pip.

This path requires control or compromise of the dependency source or resolution environment; the reviewed Skill does not itself configure such a source.

Impact Assessment

A compromised dependency could execute arbitrary code with the installing user's privileges. It could read or modify files accessible to that account, including the health records m ...[truncated 288 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin PyYAML to a specifically reviewed version.
2. Record cryptographic hashes in a requirements file and install with pip's hash-verification mode.
3. Use a lock file or reproducible dependency-management process.
4. Explicitly use a trusted package index and review any organization-level mirror configuration.
5. Install dependencies inside an isolated virtual environment without administrator privileges.
6. Regularly scan the pinned dependency for published vulnerabilities and update it through a controlled review process.
7. Prefer prebuilt, verified wheels where appropriate to reduce exposure to unexpected local build steps.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill describes create/query/export as well as modify/reset/import operations on local health data without prominent warnings or consent gates. Because the skill has write and exec capabilities and handles sensitive personal data, silent destructive or privacy-affecting actions could lead to data loss or unintended disclosure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger conditions are broad enough to overlap with generic requests for analysis, reporting, statistics, or visualization. In an agent environment with read/write/exec tools, overbroad activation can cause the skill to handle unrelated requests and operate on local data unexpectedly.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The skill instructs creation of persistent storage under ~/.health for sensitive health records and configuration data. Persistent local storage is not inherently malicious, but for personal health data it raises privacy risk if retention, file permissions, deletion behavior, and backup expectations are not clearly defined.

Content

Scanner excerpt · SKILL.md (reported line 264)May include surrounding context.

Step 1: 初始化健康数据目录

bash

mkdir -p ~/.health/{workouts,sleep,diet,metrics,goals}
echo '{"version":"1.0","edition":"free"}' > ~/.health/config.json

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill markets the free edition as local-only and privacy-preserving, but later instructs users to sync backups to cloud storage. This inconsistency can mislead users about where sensitive health data may end up and weakens informed consent around handling personal health information.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation states that the free version does not support device/data sync, yet it provides explicit commands to copy health data into cloud storage. Even if user-initiated, this contradicts the stated security and product boundaries and may cause users to expose sensitive health records to third-party storage without realizing the privacy implications.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

文件的显示名称、摘要、描述及主体说明均以中文编写，未说明可根据用户偏好切换语言，也未提供语言选择入口。按规则，若技能强制特定语言而无用户选择，属于自然语言层面的语言/地区策略风险。

Content

No source excerpt is available for this finding.