Security audit

Postpartum Care 坐月子全流程助手

Security checks for vulnerabilities and agentic risk

Overview

The skill does not appear to steal data or run code, but it gives high-stakes postpartum, breastfeeding, and newborn-care guidance without enough medical boundaries.

Review before installing or publishing from this skill. It is technically low-risk because it is Markdown-only and does not request data or privileges, but users may treat its postpartum and newborn-care content as medical advice. Add a clear educational-use disclaimer, require users to follow their OB, midwife, pediatrician, and lactation consultant guidance, cite current clinical sources, and strengthen urgent-care warnings for fever, heavy bleeding, wound infection, mastitis symptoms, poor infant feeding, jaundice, dehydration, and thoughts of harming self or baby. CDC treats postpartum fever, heavy bleeding, and thoughts of harming self or baby as urgent warning signs requiring medical care. ([cdc.gov](https://www.cdc.gov/hearher/maternal-warning-signs/index.html))

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill provides detailed postpartum, wound-care, breastfeeding, and newborn-care instructions without a clear warning that it is not a substitute for professional medical advice. In a maternal/newborn context, users may rely on incomplete or generalized guidance for conditions that can deteriorate quickly, leading to delayed care, harm to the mother or infant, or unsafe self-treatment.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The template gives specific postpartum hygiene, activity, recovery, and care guidance in a medical-adjacent, prescriptive way without a visible disclaimer that recovery timelines and restrictions vary by delivery type, complications, infection risk, bleeding, wound healing, and clinician advice. A user could rely on this as generalized medical instruction and delay appropriate care or follow advice that is unsafe for their individual condition.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The content recommends specific foods, herbs, and iron supplementation for postpartum users as if broadly appropriate, but postpartum anemia, gestational conditions, hemorrhage history, medication use, allergies, breastfeeding issues, and cultural diet practices can materially change what is safe or useful. Presenting supplement and diet recommendations without warning to individualize with medical advice creates a risk of misuse and false reassurance.

Missing User Warnings

High

Confidence: 97% confidence
Finding: This section provides treatment-like instructions for blocked ducts, nipple injury, mastitis, milk supply, and weaning, including medication and topical product suggestions, while lacking a strong boundary that diagnosis may be uncertain and professional assessment may be needed promptly. In the breastfeeding context, users may self-treat infection, pain, low supply, or breast inflammation incorrectly, potentially worsening illness, exposing infants to inappropriate products, or delaying urgent care.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: This file provides postpartum and breastfeeding dietary guidance, including herbal/TCM-style ingredients such as 当归、黄芪、通草 and organ meats, without any warning that recommendations may be unsuitable for users with allergies, hypertension, diabetes, postpartum hemorrhage, C-section recovery issues, medication interactions, or breastfeeding complications. Because postpartum users are a medically vulnerable population, presenting generalized health-benefit claims as broad guidance can lead to inappropriate self-management or delayed consultation with a clinician.

Static analysis

No suspicious patterns detected.