Security audit

supplement-stack-checker

Security checks for vulnerabilities and agentic risk

Overview

The skill runs locally, but incomplete interaction checks, incorrect dose totals, and unreliable schedules could give false reassurance about supplement safety.

Treat this as an incomplete educational aid; a result with no flags does not establish safety. For example, it misses the [vitamin K–warfarin interaction documented by NIH](https://ods.od.nih.gov/factsheets/VitaminK-Consumer/). Have a pharmacist review medicines, combined doses, and product timing before changing your routine.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The reported implementation gaps undermine safety-critical claims: missing interaction rules and incomplete ingredient normalization could leave dangerous combinations or excessive cumulative doses unflagged, while the scheduler could falsely imply that conflicts have been resolved. The health context increases the consequences of false reassurance; the educational disclaimer and exclusion of comprehensive prescription checking do not resolve the explicitly advertised drug-interaction highlights or scheduling guarantees. This assessment relies on the supplied static-analysis evidence because the underlying script was not provided for independent verification.
Content: No source excerpt is available for this finding.

The interaction checker does not implement the advertised medication interactions or 60+ ingredient coverage.

High

Category: Excessive Agency
Confidence: 99% confidence
Finding: The checker implements only supplement-pair rules and substantially fewer than 60 distinct ingredients, with no medication-interaction rules for advertised hazards such as vitamin K–warfarin or St. John's Wort–drug interactions. Unrecognized medications receive no meaningful interaction assessment, yet the output can report no danger pairs and doses within ULs; in a health decision-support skill, this creates potentially harmful false reassurance despite the medical disclaimer.
Content: No source excerpt is available for this finding.

Recognized aliases remain separate ingredients, undermining advertised overlap detection and aggregate dose checks.

High

Category: Excessive Agency
Confidence: 99% confidence
Finding: canon() returns recognized dictionary keys unchanged, so aliases such as vitamin D/vitamin D3 and folate/folic acid accumulate separately rather than contributing to a shared total. This can hide excessive combined doses and duplicate sources, while aliases such as omega-3 versus fish oil can also bypass interaction rules; these failures directly undermine the skill's health-safety purpose.
Content: No source excerpt is available for this finding.

The timing scheduler separates ingredient names without respecting which ingredients are inseparable within a product.

High

Category: Excessive Agency
Confidence: 99% confidence
Finding: The scheduler assigns times to aggregated ingredients independently and loses the constraint that ingredients in a combination product must be taken together. For example, a tablet containing calcium and iron cannot follow separate lunch and breakfast assignments, so the claim that the scheduler applies the two-hour rule can falsely imply an absorption conflict has been resolved.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.