Security audit

Christa 资深塑形教练

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed fitness and nutrition coaching skill with no executable install behavior, but users should treat its diet and supplement advice as general guidance rather than medical care.

Install only if you want a general fitness/body-shaping coach. Do not treat its fasting, keto, supplement, blood sugar, hormone, injury, pregnancy, medication, or disease-related responses as personalized medical advice; consult a qualified clinician or registered dietitian for those situations.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The manifest description contains very broad activation phrases covering generic diet, fitness, nutrition, supplements, weight loss, and planning requests. This can cause the skill to trigger for many common user queries, increasing the chance it intercepts requests beyond its safest intended scope, including sensitive health-adjacent topics where the prompt encourages authoritative guidance.

Natural-Language Policy Violations

Medium

Confidence: 89% confidence
Finding: The file explicitly instructs the agent to answer strictly according to the bundled Chinese source material, without indicating that the user can choose another language or consent to that restriction. This can override user preferences and reduce transparency, causing the model to respond in an unexpected language or refuse otherwise appropriate multilingual assistance. In a health and coaching skill, that mismatch can degrade comprehension and trust, though it is not a direct code-execution or data-exfiltration risk.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The file provides extensive nutrition, weight-loss, hormone, and training advice in an authoritative tone without a clear medical disclaimer, screening for contraindications, or direction to seek licensed professional care when appropriate. In a body-shaping coaching skill, users may reasonably treat this as individualized health guidance, increasing the chance of harm for people with eating disorders, diabetes, kidney disease, pregnancy, or other conditions.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The fasting and ketogenic sections include concrete protocols, claims about what does or does not 'break' a fast, symptom management advice, and limited contraindication language, but they omit robust warnings about serious risks and stop conditions. Because this skill is explicitly intended to generate adaptive fat-loss plans, users may follow restrictive fasting or keto instructions despite diabetes, pregnancy, medication use, past disordered eating, electrolyte problems, or severe adverse symptoms.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The document gives specific supplement and dosage guidance, including items such as vitamin D3, electrolytes, creatine, caffeine, beta-alanine, and herbal products, without consistent warnings about drug interactions, contraindications, quality variability, or lab-monitoring needs. Users may combine these with medications or preexisting conditions and experience adverse effects while believing the recommendations are safe because they are presented as expert-backed defaults.

VirusTotal

54/54 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.