T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:20- Finding
Mutable Remote Application Is Downloaded and Executed Without Integrity Pinning
- Content
View full analysis
- Remediation
View remediation
Security audit
Wellness Coach AI
Security checks for vulnerabilities and agentic risk
Overview
The skill has a coherent wellness-coach purpose, but it asks users to run unpinned external code, persist daily automation, and share sensitive health and calendar data with multiple services.
Review this skill carefully before installing. Use only a pinned, verified version of the external repository, run it in an isolated environment, confirm every recipient and provider, avoid storing tokens in the project directory when possible, and do not enable the daily cron or HEARTBEAT forwarding rule unless you understand how to disable them and are comfortable with recurring health/calendar summaries being sent externally.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T06 · System Persistence
Warning
- Location
references/openclaw-cron.md:8- Finding
Daily Main-Session Scheduled Task Creates Cross-Session Persistence
- Content
View full analysis
- Remediation
View remediation
T02 · Agent Memory Poisoning
Warning
- Location
references/openclaw-cron.md:21- Finding
Persistent Heartbeat Rule Blindly Forwards Event-Controlled Content
- Content
View full analysis
- Remediation
View remediation
other
Warning
- Location
SKILL.md:12- Finding
Sensitive Health and Calendar Data Is Routed Through Multiple External Services Without Documented Minimization Controls
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (17)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The description omits a clear warning that sensitive health metrics, calendar contents, and possibly identifiers are sent to third-party services including Tavus, Anthropic, Google, and Telegram. In this context, lack of explicit disclosure undermines informed user consent and can expose highly sensitive personal data to multiple processors.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md 1. Go to https://console.cloud.google.com → create a new project 2. Enable **Google Calendar API** 3. APIs & Services → Credentials → Create **OAuth 2.0 Client ID** (Desktop app type) 4. Download JSON → save as `credentials.json` in project root 5. Run: `python3 setup_gcal.py` 6. Browser opens → sign in → allow Calendar access 7. `token.pickle` is saved automatically
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md 1. Go to https://console.cloud.google.com → create a new project 2. Enable **Google Calendar API** 3. APIs & Services → Credentials → Create **OAuth 2.0 Client ID** (Desktop app type) 4. Download JSON → save as `credentials.json` in project root 5. Run: `python3 setup_gcal.py` 6. Browser opens → sign in → allow Calendar access 7. `token.pickle` is saved automatically
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md 1. Go to https://console.cloud.google.com → create a new project 2. Enable **Google Calendar API** 3. APIs & Services → Credentials → Create **OAuth 2.0 Client ID** (Desktop app type) 4. Download JSON → save as `credentials.json` in project root 5. Run: `python3 setup_gcal.py` 6. Browser opens → sign in → allow Calendar access 7. `token.pickle` is saved automatically
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
- Browser opens → sign in → allow Calendar access
token.pickleis saved automatically
.env Config
text GOOGLE_CREDENTIALS_PATH=../credentials.json GOOGLE_TOKEN_PATH=../token.pickle
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
- Browser opens → sign in → allow Calendar access
token.pickleis saved automatically
.env Config
text GOOGLE_CREDENTIALS_PATH=../credentials.json GOOGLE_TOKEN_PATH=../token.pickle
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The activation text is broad enough to match ordinary wellness or morning-routine requests, which could trigger the skill unexpectedly. Because this skill transmits sensitive health and calendar context to external services and can create live video sessions, accidental invocation materially increases privacy and consent risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The setup guide tells users to generate and store OAuth client and token artifacts, but only says not to commit them. It does not clearly warn that these files grant ongoing Google Calendar access, should be tightly permissioned, and must be revoked/rotated if exposed. In a skill that processes personal health and schedule data, compromise of these artifacts could expose sensitive calendar information and enable unauthorized access until revoked.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The document sets up an automated 7AM workflow that culminates in sending a Telegram message, but it does not include any user-facing disclosure, approval step, or guardrail around outbound messaging. In this skill, the message content is derived from health and calendar data, so silent automatic transmission increases the risk of privacy leakage and unexpected external actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The HEARTBEAT instruction tells the agent to forward system-event content to Telegram "as-is," which creates a direct unreviewed path from internal/generated content to an external messaging channel. That is especially dangerous here because the upstream pipeline uses personal wellness and calendar context, and any prompt injection, formatting bug, or malicious event content could exfiltrate sensitive data or send unintended messages without validation.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
import requests def get_oura_health_data(api_token: str) -> dict: headers = {"Authorization": f"Bearer {api_token}"} sleep = requests.get("https://api.ouraring.com/v2/usercollection/daily_sleep", headers=headers).json() readiness = requests.get("https://api.ouraring.com/v2/usercollection/daily_readiness", headers=headers).json() # Map to standard format: sleep_score, hrv_ms, recovery_score etc.
text
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
import requests def get_oura_health_data(api_token: str) -> dict: headers = {"Authorization": f"Bearer {api_token}"} sleep = requests.get("https://api.ouraring.com/v2/usercollection/daily_sleep", headers=headers).json() readiness = requests.get("https://api.ouraring.com/v2/usercollection/daily_readiness", headers=headers).json() # Map to standard format: sleep_score, hrv_ms, recovery_score etc.
text
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The guidance shows how to use personal access/OAuth tokens to pull sensitive wearable health data, but it provides no warnings about consent, secure storage, least-privilege scopes, retention, or downstream sharing. In the context of a wellness coach that personalizes prompts and delivers briefings through third-party services, this omission increases the risk of mishandling regulated or highly sensitive personal data.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python def get_fitbit_health_data(access_token: str) -> dict: headers = {"Authorization": f"Bearer {access_token}"} sleep = requests.get("https://api.fitbit.com/1.2/user/-/sleep/date/today.json", headers=headers).json() hrv = requests.get("https://api.fitbit.com/1/user/-/hrv/date/today.json", headers=headers).json()Get token: https://dev.fitbit.com (OAuth2 flow)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python def get_fitbit_health_data(access_token: str) -> dict: headers = {"Authorization": f"Bearer {access_token}"} sleep = requests.get("https://api.fitbit.com/1.2/user/-/sleep/date/today.json", headers=headers).json() hrv = requests.get("https://api.fitbit.com/1/user/-/hrv/date/today.json", headers=headers).json()Get token: https://dev.fitbit.com (OAuth2 flow)
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest says the skill requires only Tavus and Anthropic keys, but the documentation also depends on Google Calendar OAuth files and environment variables. This mismatch can cause administrators to enable the skill without realizing calendar access and token storage are involved, reducing informed consent and increasing the chance of insecure setup.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manifest says the skill requires only Tavus and Anthropic keys, but the documentation also depends on Google Calendar OAuth files and environment variables. This mismatch can cause administrators to enable the skill without realizing calendar access and token storage are involved, reducing informed consent and increasing the chance of insecure setup.
- Content
Static analysis
No suspicious patterns detected.