Security audit

hydration-hero

Security checks across malware telemetry and agentic risk

Overview

This is a coherent local hydration tracker, but users should treat its health guidance as general wellness information and protect the local data file it creates.

Before installing, understand that this tool stores hydration, weight, activity, caffeine, alcohol, and related wellness logs locally in ~/.hydration_hero.json. Use its targets as general guidance, especially if you are pregnant, ill, on fluid-affecting medication, or have kidney, heart, liver, electrolyte, or fluid-restriction concerns; follow clinician advice in those cases.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README presents individualized hydration targets, dynamic health-related adjustments, and self-assessment guidance in a way that can be interpreted as medical or wellness advice, but it does not clearly state that the output is informational only and not a substitute for professional medical guidance. In a health-adjacent skill, users may over-rely on these calculations despite important contraindications such as kidney disease, heart failure, pregnancy, medications, or electrolyte disorders, which makes omission of a clear safety disclaimer materially risky.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This health-tracking skill stores personal wellness data locally in ~/.hydration_hero.json but does not provide any privacy notice, sensitivity warning, or guidance on protecting that data. Even if stored only on-device, hydration logs, body weight, activity, alcohol, and caffeine intake can reveal sensitive health and lifestyle information to other local users, backups, or malware.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: This file provides concrete hydration formulas, adjustments for alcohol, caffeine, weather, and health conditions, plus emergency-adjacent symptom guidance, but does not clearly state that the material is general educational information and not individualized medical advice. Users may over-rely on the recommendations in situations involving pregnancy, illness, kidney issues, severe dehydration, or possible blood in urine, where incorrect self-management or delayed care could cause harm.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This guide gives broad, prescriptive hydration volumes and timing recommendations, including exercise, heat, alcohol, and wake/sleep scenarios, without a clear warning that needs vary substantially by age, pregnancy, kidney/heart disease, medications, or other medical conditions. In a consumer wellness skill, users may treat these amounts as medically appropriate defaults, which can contribute to underhydration or overhydration and delay seeking professional advice when guidance is not appropriate for them.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.