apple-health-skills

• Outcome: Review
• Latest audit: May 28, 2026 · 12:42 PM UTC
• Version: 1.0.0

Overview

This skill is read-only and health-focused, but it handles very sensitive health data and includes under-scoped Whoop credential/sync guidance that users should review before installing.

Install only if you are comfortable with an agent reading and displaying local Apple Health, live heart-rate, and Whoop-style wearable data. Keep query windows narrow, avoid sharing transcripts/logs, protect .env and database files, and do not run the referenced Whoop setup/sync or cron steps until you have reviewed those missing scripts and know where tokens and synced data will be stored.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill invokes local scripts that read configuration from `.env` and access local data, but it does not declare corresponding permissions or clearly scope those capabilities. Hidden file/environment access increases the chance that an agent or reviewer underestimates the data exposure and executes the skill with broader access than intended.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The documented behavior says the skill validates a local collector over HTTP and fetches fresh data, but the actual described behavior reaches into local SQLite, loads `.env`, and analyzes additional datasets such as live heart rate and Whoop metrics. This mismatch is dangerous because it can mislead operators and users about what data sources are accessed, causing sensitive health data to be queried beyond the stated scope.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The script automatically loads a repo-root .env file at import time, expanding its access to locally stored configuration and secrets beyond what is necessary for a simple SQLite query utility. In this health-data context, implicit secret ingestion is risky because it silently broadens the data sources the script can consume and may pull in sensitive identifiers without explicit operator intent.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill directs the agent to execute shell commands and contact a collector host over HTTP/HTTPS without clear trust boundaries, host restrictions, or operator confirmation. In a security-sensitive agent environment, this can lead to unintended local command execution or network access against attacker-influenced hosts or parameters, especially if placeholders like `<collector-host>` are filled from untrusted input.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill instructs users to place OAuth client credentials in `.env` and store access tokens locally, but provides no guidance on protecting those secrets or the privacy-sensitive health data being synced. In a health-data skill, missing secret-handling and data-protection guidance increases the risk of credential leakage, token theft, unauthorized API access, and exposure of sensitive biometric information through misconfigured files, logs, backups, or shared environments.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script parses .env and consumes AHB_USER_ID/AHB_DB_PATH without any explicit disclosure to the user that sensitive identifiers may be read from local secret files. Because this skill handles Apple Health data, silently sourcing identity and database configuration increases privacy risk and can lead to unintended access to another person's dataset or accidental exposure during agent execution.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The script prints raw health samples and derived summaries, including heart, glucose, sleep, device/source, and user_id information, directly to stdout. In an agent skill, stdout is often logged, surfaced to orchestration layers, or included in transcripts, so this behavior can expose highly sensitive medical data far beyond the immediate local user session.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script prints raw live heart-rate events and associated identifiers such as session_id, device_id, source vendor, and device name directly to stdout. In the context of an agent skill for Apple Health summaries, this exposes sensitive health and device-linked data more broadly than necessary and can leak into logs, tool transcripts, or downstream consumers without consent or minimization.

Credential Access

High

• Category: Privilege Escalation

Content

os.environ[key] = value


# Load .env from repo root so the script works without manually exporting vars.
_repo_root = Path(__file__).resolve().parent.parent
_load_dotenv(_repo_root / ".env")

• Confidence: 84% confidence
• Finding: Automatically loading .env from the repo root causes the process to ingest whatever secrets or identifiers are present there, which is a form of unnecessary credential/configuration access for this utility. In a health-data skill, that implicit access is more dangerous because it can combine local secrets with sensitive medical records under agent control.

Static analysis

No suspicious patterns detected.