sleep-health-assistant

• Outcome: Pass
• Latest audit: May 27, 2026, 10:51 PM
• Version:
  1.0.0

Overview

This skill appears to be a local-only sleep and stress guidance tool with disclosed in-memory handling of user-provided health data and no evidence of exfiltration or hidden system access.

Reasonable to install if you want a local wellness helper. Before using health monitoring, understand that sleep and stress details may remain in the running process memory until cleanup or restart, and the skill may not provide religious, traditional, or culture-specific practices.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The documentation explicitly imposes blanket exclusions on religious and culture-specific content without describing user consent, contextual justification, or configurable policy controls. In a wellness/sleep skill, this can create discriminatory or unnecessarily restrictive behavior that excludes user needs and may encode biased policy decisions into the product experience.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The later policy section repeats the same broad exclusion of culture-specific content, reinforcing a non-contextual restriction that may result in unequal treatment of users or denial of relevant wellness practices. Repetition in multiple sections suggests the restriction is intentional product policy rather than incidental wording, increasing the likelihood it affects runtime behavior or moderation decisions.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The changelog explicitly states that the skill excludes religion-specific and culture-specific methods, which indicates a built-in content restriction that may inappropriately limit responses for users with different cultural or spiritual preferences. While this is not a code-execution risk, it is a genuine policy and inclusivity vulnerability because it can cause discriminatory or unnecessarily narrow behavior without user opt-in or a documented safety justification.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: The skill stores health-related user data and derived recommendations in process memory during health monitoring, but there is no clear consent flow or point-of-collection notice before that storage occurs. Even though the code avoids disk and network access, sleep and stress data are sensitive, and undisclosed retention in memory can expose private information to other components in the same runtime, debugging tools, crashes, or delayed cleanup.

VirusTotal

No VirusTotal findings