T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/health_manager.py:13- Finding
Sensitive health information stored in plaintext without enforced access permissions
- Content
View full analysis
- Remediation
View remediation
Security audit
personal health manager
Security checks for vulnerabilities and agentic risk
Overview
This health skill is mostly coherent, but it stores sensitive medical information locally with under-disclosed scope and weak storage protections, and includes some risky medical/emergency guidance.
Review before installing. This skill does not appear to exfiltrate data or install a backdoor, but it can persist highly sensitive health details on disk in plaintext under ~/.health_data and the documentation inaccurately says workspace storage. Use it only if you are comfortable with local retention of medical information, and do not rely on its emergency number or medication guidance without local emergency services and professional medical advice.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (18)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
This mismatch is more dangerous because the undeclared local filesystem storage concerns health data, while the advertised health-analysis and recommendation features are absent. Users may disclose sensitive data believing they are receiving meaningful personalized support, when the main effective behavior is storing that data locally without clearly disclosed permissions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
This mismatch is more dangerous because the undeclared local filesystem storage concerns health data, while the advertised health-analysis and recommendation features are absent. Users may disclose sensitive data believing they are receiving meaningful personalized support, when the main effective behavior is storing that data locally without clearly disclosed permissions.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill states that data is stored locally in JSON files and may be exported, but it does not provide a strong, upfront warning that this includes highly sensitive health information. In context, local workspace storage can expose protected personal data to other tools, users of the same environment, backups, or accidental sharing, making this especially serious for medical records.
- Content
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file hard-codes 'Call Emergency (120)' as if it were universally applicable. In a travel and personal health assistant context, this can misdirect users in a real emergency, causing critical delays in contacting help if they are in a region where 120 is not the correct number.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The initialization logic creates medications.json and reminders.json as JSON objects ({}), but add_medication and add_reminder later treat them as lists and call append(). This causes runtime failures and can break core health-tracking workflows, potentially preventing medication or reminder data from being saved when needed.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill handles highly sensitive health data and explicitly describes local JSON/CSV storage, but it declares no tool scope or file permissions. This creates a hidden capability boundary issue: a caller or reviewer cannot tell from metadata that the skill may read and write files containing medical conditions, medications, allergies, and emergency contacts.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The activation triggers are so broad that the skill may engage in many ordinary conversations involving wellness, travel, or general questions and start soliciting age, gender, medications, allergies, and medical history. Over-triggering increases unnecessary collection of sensitive health information and raises the chance of the model giving quasi-medical guidance outside an appropriate context.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The document provides emergency and medication-related first-aid guidance without sufficiently warning that emergency numbers vary by country and that advice such as giving aspirin or using OTC medications may be unsafe for some users. In a health-management skill, users may rely on this content during urgent situations, so missing safety qualifiers can lead to delayed emergency contact or harmful self-medication.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The checklist includes medication and prophylaxis recommendations such as altitude sickness medication, malaria prevention, anti-diarrheals, and rehydration salts without any warning to consult a clinician or verify destination-specific requirements. In a personal health management skill that offers personalized advice, users may treat this as authoritative medical guidance and self-medicate inappropriately, leading to missed contraindications, dosage errors, or failure to obtain correct vaccines or prescriptions before travel.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This code initializes persistent storage for highly sensitive health information under the user's home directory without any notice, consent, encryption, or access-control hardening. In a health-management skill, silent local persistence increases the chance of privacy leakage through other local users, backups, malware, or unexpected retention of medical data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The delete_medication function permanently rewrites the medications file after removing matching entries, and there is no confirmation prompt, warning, or audit message indicating that deletion is irreversible. The same pattern appears for reminders, making user data loss possible without explicit disclosure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This function removes reminder entries and overwrites the backing JSON file without any confirmation, warning, or disclosure that data will be lost. Because reminder data is user-managed content, irreversible deletion should be surfaced clearly to the user.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This code creates a persistent storage directory under the user's home folder for personal health data, which is safety-sensitive information. While the module docstring describes storage behavior, there is no user-facing disclosure, confirmation, or warning in the code near initialization that sensitive health records will be stored locally on disk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The function persists user health records, including timestamps and arbitrary record data, to a local JSON file. Although the function name and docstring describe the action for developers, there is no visible user disclosure such as a prompt, warning, or log message indicating that sensitive medical information is being written to persistent storage.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This function writes medication information to a file in the user's home directory, which can reveal sensitive health conditions or treatments. The code lacks any confirmation prompt, warning, or user-visible disclosure about this persistence behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The function stores reminder information in persistent local files under the user's home directory. Because these reminders may contain health-related details, the absence of any user-visible warning or confirmation means users may not realize sensitive data is being retained.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This function writes the user's health profile directly to profile.json in persistent local storage. The operation handles especially sensitive personal data but provides no user-facing disclosure, prompt, or warning that the profile will be stored or overwritten on disk.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This file presents medical thresholds and condition categories that users may treat as diagnostic or triage guidance, but the warning is minimal and only appears at the end as a generic disclaimer. In a personal health management skill that offers symptom screening and personalized advice, insufficiently prominent escalation guidance can delay urgent care or encourage self-diagnosis in emergencies.
- Content
Static analysis
No suspicious patterns detected.