Security audit

健康指导助手

Security checks across malware telemetry and agentic risk

Overview

This health guidance skill asks for broad automation powers that do not fit its stated health-advice purpose, so it should be reviewed before installation.

Install only if you are comfortable granting this health-advice skill file access, command execution, and write capability. Avoid entering sensitive health details, do not configure callback URLs for health content unless you trust the destination, and prefer a version that removes exec/write or clearly documents exactly when those powers are used.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Intent-Code Divergence

Medium

Confidence: 87% confidence
Finding: The skill claims it will not store personal health data, yet the manifest grants write capability and elsewhere documents file-oriented automation behavior. In a health context, this creates a misleading privacy assurance that could cause users to disclose sensitive information under false assumptions, increasing the risk of local persistence or logging of health data.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The skill presents itself as a safety-bounded health advisor but also advertises generic automation abilities such as exec, write, and batch processing that are unrelated to that purpose. This mismatch obscures the real operational scope of the skill and can be used to obtain broad system actions under the guise of a benign health function.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: Broad command execution and file automation are excessive for a health-guidance assistant and violate least-privilege expectations. If invoked in an agent environment, these permissions could be leveraged to run arbitrary commands or manipulate files while users believe they are interacting with a low-risk advisory tool.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The example trigger phrase allows users to ask the skill to process arbitrary tasks without constraining them to health guidance. In an environment where the skill has read/exec/write capabilities, that broad phrasing increases the chance of overbroad invocation and accidental or unsafe system actions.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: Exposing read, exec, and write capabilities in a health skill without a prominent warning understates the possibility of system-impacting actions. Users may reasonably treat the skill as advisory-only and not realize it can access files or execute commands, increasing consent and misuse risks.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: Documenting a callback_url without warning about outbound transmission is especially risky in a health-related skill because user inputs may include sensitive health information. This can lead to unintended disclosure of regulated or highly personal data to third-party endpoints.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill instructs users to configure external API access but does not clearly warn that health-related prompts may be processed by third-party LLM/API services. In a medical-adjacent context, failing to disclose external data handling creates privacy and compliance risks beyond ordinary automation skills.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.