Wellness Coach AI

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:43 AM UTC
• Version: 1.0.0

Overview

The skill has a coherent wellness-coach purpose, but it asks users to run unpinned external code, persist daily automation, and share sensitive health and calendar data with multiple services.

Review this skill carefully before installing. Use only a pinned, verified version of the external repository, run it in an isolated environment, confirm every recipient and provider, avoid storing tokens in the project directory when possible, and do not enable the daily cron or HEARTBEAT forwarding rule unless you understand how to disable them and are comfortable with recurring health/calendar summaries being sent externally.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:20
• Finding: Mutable Remote Application Is Downloaded and Executed Without Integrity Pinning<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:20-24` **Vulnerability Type**: `T03: Remote Payload Retrieval and Execution` **Risk Level**: High ### Vulnerable Code ```bash git clone https://github.com/AndreChuabio/wellness-coach cd wellness-coach pip install -r backend/requirements.txt cp .env.example .env # fill in API keys ``` ### Technical Analysis The Skill instructs the user to clone the mutable default branch of an external Git repository and install its Python dependencies. The downloaded source code, requirements file, backend, and cron scripts are not included in the audited artifact. No commit hash, signed release, checksum, dependency lock file, or hash verification is specified. Consequently, the code that users execute can change after this Skill has been reviewed. Installing the requirements may also execute package installation logic under the current user's privileges. This is best classified as remote payload retrieval and execution rather than merely a dependency issue because the Skill delegates its principal implementation to an unaudited remote repository. ### Attack Path 1. A user follows the documented setup procedure. 2. Git retrieves the current contents of the external repository's default branch. 3. An upstream account compromise, repository takeover, or later malicious update changes the downloaded application or requirements. 4. The user installs the remote dependencies and runs the backend or cron scripts. 5. The modified code executes with the user's filesystem, environment-variable, credential, health-data, calendar, and network access. 6. If the daily cron is also installed, the altered code continues to execute automatically. ### Impact Assessment A compromised remote payload could obtain arbitrary code execution with the privileges of the user running the commands. Its practical scope may include: - API keys stored in `.env` - Google Calendar OAuth credentials and refresh tokens - Wearable-provider ...[truncated 440 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the external application to a reviewed commit hash rather than cloning a mutable default branch. 2. Publish a signed release and verify its signature or cryptographic checksum before execution. 3. Include the executable source in the Skill artifact so it can be audited together with the instructions. 4. Pin every Python dependency to an exact version and require package hashes. 5. Install dependencies in a dedicated virtual environment or restricted container. 6. Run the application under a separate, least-privilege account with narrowly scoped filesystem and network access. 7. Require a new security review before updating the pinned application revision. 8. Clearly document how users can verify the checked-out commit before installing or running anything. ]]>

T06 · System Persistence

Warning

• Location: references/openclaw-cron.md:8
• Finding: Daily Main-Session Scheduled Task Creates Cross-Session Persistence<![CDATA[ ## Vulnerability Details **File Location**: `references/openclaw-cron.md:8-19` **Vulnerability Type**: `T06: System Persistence` **Risk Level**: Medium ### Vulnerable Code ```json { "name": "wellness-morning-briefing", "schedule": { "kind": "cron", "expr": "0 7 * * *", "tz": "America/New_York" }, "sessionTarget": "main", "payload": { "kind": "systemEvent", "text": "WELLNESS_BRIEFING_SEND: Run the morning wellness briefing pipeline: cd ~/wellness-coach && python3 cron/morning_context.py && python3 cron/send_briefing.py. Then send the formatted Telegram message to Andre." } } ``` ### Technical Analysis The instructions create a scheduled task that survives the current Skill invocation and runs every day in the agent's main session. The event directs the agent to execute two local Python scripts and send output through Telegram. Daily automation is an optional declared feature, so the persistence is not concealed. Nevertheless, targeting the main agent session gives the downloaded application recurring access in a comparatively privileged context. This exceeds the minimum privileges needed merely to start an on-demand wellness session. The configuration also lacks an expiration time, isolation boundary, output-validation policy, failure limit, and removal procedure. ### Attack Path 1. The user registers the supplied OpenClaw cron configuration. 2. The scheduled task persists after the original interaction ends. 3. At 7:00 AM each day, a system event is delivered to the main agent session. 4. The agent runs scripts from the externally downloaded `~/wellness-coach` directory. 5. If those scripts or their dependencies are subsequently modified or compromised, the modified payload runs automatically. 6. The payload can repeatedly process private data and communicate over the network without a fresh per-run user decision. ### Impact Assessment The scheduled task grants durable daily execution of local scripts with the permissions av ...[truncated 369 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make scheduled automation separately opt-in and explain its persistent nature before registration. 2. Use an isolated, least-privilege session instead of `sessionTarget: "main"`. 3. Execute only a pinned and verified application revision. 4. Restrict the scheduled process to the minimum required files, credentials, and network destinations. 5. Add an expiration date or require periodic renewal of the scheduled task. 6. Validate generated output before sending it to Telegram. 7. Provide exact commands for listing, disabling, and permanently removing the job. 8. Record execution results without logging health details, calendar contents, tokens, or session URLs. 9. Consider local notifications or an on-demand workflow instead of recurring external delivery. ]]>

T02 · Agent Memory Poisoning

Warning

• Location: references/openclaw-cron.md:21
• Finding: Persistent Heartbeat Rule Blindly Forwards Event-Controlled Content<![CDATA[ ## Vulnerability Details **File Location**: `references/openclaw-cron.md:21-30` **Vulnerability Type**: `T02: Agent Memory Poisoning` **Risk Level**: Medium ### Vulnerable Code ```markdown ## Wellness Briefing Delivery If a system event arrives with text starting with `WELLNESS_BRIEFING_SEND:` — extract everything after the prefix and send it as a Telegram message to the user. Do not add any extra commentary — just forward the formatted message as-is. ``` ### Technical Analysis The Skill instructs the user to write a durable behavioral rule into `HEARTBEAT.md`. The rule applies to future events and causes content following a string prefix to be forwarded without semantic review. A static prefix is not authentication. Any integration or component able to generate an accepted system event could potentially supply the suffix. The instruction to forward the message “as-is” suppresses agent review and makes the external message dependent on event-controlled text. There is also a semantic inconsistency: the example cron event places operational instructions after the prefix, while the heartbeat rule says to forward everything after that prefix as the Telegram message. This may cause command-like text to be sent to the recipient rather than executing the intended pipeline. ### Attack Path 1. The user adds the supplied rule to persistent `HEARTBEAT.md` state. 2. The rule remains active across future agent sessions. 3. An attacker, compromised plugin, or faulty integration with system-event creation capability emits an event beginning with `WELLNESS_BRIEFING_SEND:`. 4. The persistent rule treats the prefix as sufficient authorization. 5. The attacker-controlled suffix is forwarded through Telegram without contextual review or confirmation. 6. The recipient receives misleading, socially engineered, or privacy-sensitive content appearing to originate from the wellness workflow. This attack path requires access to a component capable of producing system e ...[truncated 646 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not encode generic message-forwarding behavior in persistent agent memory. 2. Replace free-form event text with a typed, structured payload containing only required fields. 3. Authenticate the job identity and verify the event source rather than relying on a string prefix. 4. Use a dedicated handler scoped to the specific scheduled-job identifier. 5. Generate the Telegram message from validated health and calendar fields instead of forwarding arbitrary suffix text. 6. Enforce length limits and reject commands, links, unexpected markup, and unknown fields. 7. Require user confirmation before sending externally unless the user has explicitly approved a narrowly defined template. 8. Remove the “forward as-is” instruction and permit the agent to reject malformed or unsafe content. 9. Document how to remove the persistent `HEARTBEAT.md` entry. ]]>

other

Warning

• Location: SKILL.md:12
• Finding: Sensitive Health and Calendar Data Is Routed Through Multiple External Services Without Documented Minimization Controls<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:12-16` and `SKILL.md:61-73` **Vulnerability Type**: `other: Sensitive Health Data Exposure` **Risk Level**: Medium ### Vulnerable Code ```markdown 1. Reads wearable health data (mock or real: Oura/Fitbit/Apple Health) 2. Fetches today's Google Calendar events 3. Calls Claude to generate a Baymax system prompt + wellness recommendations 4. Creates a live Tavus CVI session (interactive video avatar) 5. Optionally delivers a Telegram morning briefing with the session link ``` ```markdown ## Morning Briefing Pipeline (Telegram) Run both scripts back-to-back — always together so the Tavus link is fresh: ```bash python3 cron/morning_context.py && python3 cron/send_briefing.py ``` This builds context, pre-warms a Tavus session, and sends a Telegram message with: - Sleep score, HRV, recovery score - Today's calendar summary - Top wellness recommendation - Live Tavus session link (valid ~10 min after creation) ``` ### Technical Analysis The declared workflow aggregates wearable health metrics and calendar data, uses external AI and video-session providers, and optionally sends a summary through Telegram. Sleep, HRV, recovery, and calendar information can reveal medical, behavioral, location, employment, and availability patterns. This transmission is disclosed and directly related to the Skill's declared functionality; it is not hidden exfiltration. However, the documentation does not define: - Which exact fields are sent to Claude or Tavus - Whether event titles, participants, descriptions, or locations are redacted - Provider retention and training policies - A per-run consent or preview step - Recipient verification for Telegram - Data deletion or revocation procedures - Local-only or minimum-data operating modes Because the executable implementation is hosted in an external repository, this artifact cannot verify whether the actual data flow is limited to the documented fields. ### Attack Pat ...[truncated 1180 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Default to mock data and require explicit informed consent before enabling real health or calendar integrations. 2. Display an exact preview of the fields and destinations before the first transmission. 3. Send only derived indicators needed for the recommendation; avoid transmitting raw records. 4. Redact calendar descriptions, attendees, conferencing links, locations, and unrelated event titles. 5. Allow users to disable Claude, Tavus, or Telegram independently. 6. Verify the Telegram destination during setup and require confirmation before sending the first briefing. 7. Use narrowly scoped, read-only OAuth permissions and document the requested Google Calendar and wearable scopes. 8. Encrypt stored tokens, apply restrictive file permissions, and provide revocation and deletion instructions. 9. Document each provider's retention, model-training, regional-processing, and deletion policies. 10. Avoid logging prompts, calendar contents, health records, tokens, or live Tavus session URLs. 11. Offer an on-demand or local-only mode that does not persist or transmit sensitive data. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (17)

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The description omits a clear warning that sensitive health metrics, calendar contents, and possibly identifiers are sent to third-party services including Tavus, Anthropic, Google, and Telegram. In this context, lack of explicit disclosure undermines informed user consent and can expose highly sensitive personal data to multiple processors.

Credential Access

High

• Category: Privilege Escalation

Content

1. Go to https://console.cloud.google.com → create a new project
2. Enable **Google Calendar API**
3. APIs & Services → Credentials → Create **OAuth 2.0 Client ID** (Desktop app type)
4. Download JSON → save as `credentials.json` in project root
5. Run: `python3 setup_gcal.py`
6. Browser opens → sign in → allow Calendar access
7. `token.pickle` is saved automatically

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

1. Go to https://console.cloud.google.com → create a new project
2. Enable **Google Calendar API**
3. APIs & Services → Credentials → Create **OAuth 2.0 Client ID** (Desktop app type)
4. Download JSON → save as `credentials.json` in project root
5. Run: `python3 setup_gcal.py`
6. Browser opens → sign in → allow Calendar access
7. `token.pickle` is saved automatically

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

1. Go to https://console.cloud.google.com → create a new project
2. Enable **Google Calendar API**
3. APIs & Services → Credentials → Create **OAuth 2.0 Client ID** (Desktop app type)
4. Download JSON → save as `credentials.json` in project root
5. Run: `python3 setup_gcal.py`
6. Browser opens → sign in → allow Calendar access
7. `token.pickle` is saved automatically

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

6. Browser opens → sign in → allow Calendar access
7. `token.pickle` is saved automatically

## .env Config
```
GOOGLE_CREDENTIALS_PATH=../credentials.json
GOOGLE_TOKEN_PATH=../token.pickle

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

6. Browser opens → sign in → allow Calendar access
7. `token.pickle` is saved automatically

## .env Config
```
GOOGLE_CREDENTIALS_PATH=../credentials.json
GOOGLE_TOKEN_PATH=../token.pickle

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The activation text is broad enough to match ordinary wellness or morning-routine requests, which could trigger the skill unexpectedly. Because this skill transmits sensitive health and calendar context to external services and can create live video sessions, accidental invocation materially increases privacy and consent risk.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The setup guide tells users to generate and store OAuth client and token artifacts, but only says not to commit them. It does not clearly warn that these files grant ongoing Google Calendar access, should be tightly permissioned, and must be revoked/rotated if exposed. In a skill that processes personal health and schedule data, compromise of these artifacts could expose sensitive calendar information and enable unauthorized access until revoked.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The document sets up an automated 7AM workflow that culminates in sending a Telegram message, but it does not include any user-facing disclosure, approval step, or guardrail around outbound messaging. In this skill, the message content is derived from health and calendar data, so silent automatic transmission increases the risk of privacy leakage and unexpected external actions.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The HEARTBEAT instruction tells the agent to forward system-event content to Telegram "as-is," which creates a direct unreviewed path from internal/generated content to an external messaging channel. That is especially dangerous here because the upstream pipeline uses personal wellness and calendar context, and any prompt injection, formatting bug, or malicious event content could exfiltrate sensitive data or send unintended messages without validation.

External Transmission

Medium

• Category: Data Exfiltration

Content

import requests
def get_oura_health_data(api_token: str) -> dict:
    headers = {"Authorization": f"Bearer {api_token}"}
    sleep = requests.get("https://api.ouraring.com/v2/usercollection/daily_sleep", headers=headers).json()
    readiness = requests.get("https://api.ouraring.com/v2/usercollection/daily_readiness", headers=headers).json()
    # Map to standard format: sleep_score, hrv_ms, recovery_score etc.
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

import requests
def get_oura_health_data(api_token: str) -> dict:
    headers = {"Authorization": f"Bearer {api_token}"}
    sleep = requests.get("https://api.ouraring.com/v2/usercollection/daily_sleep", headers=headers).json()
    readiness = requests.get("https://api.ouraring.com/v2/usercollection/daily_readiness", headers=headers).json()
    # Map to standard format: sleep_score, hrv_ms, recovery_score etc.
```

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The guidance shows how to use personal access/OAuth tokens to pull sensitive wearable health data, but it provides no warnings about consent, secure storage, least-privilege scopes, retention, or downstream sharing. In the context of a wellness coach that personalizes prompts and delivers briefings through third-party services, this omission increases the risk of mishandling regulated or highly sensitive personal data.

External Transmission

Medium

• Category: Data Exfiltration

Content

```python
def get_fitbit_health_data(access_token: str) -> dict:
    headers = {"Authorization": f"Bearer {access_token}"}
    sleep = requests.get("https://api.fitbit.com/1.2/user/-/sleep/date/today.json", headers=headers).json()
    hrv = requests.get("https://api.fitbit.com/1/user/-/hrv/date/today.json", headers=headers).json()
```
Get token: https://dev.fitbit.com (OAuth2 flow)

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

```python
def get_fitbit_health_data(access_token: str) -> dict:
    headers = {"Authorization": f"Bearer {access_token}"}
    sleep = requests.get("https://api.fitbit.com/1.2/user/-/sleep/date/today.json", headers=headers).json()
    hrv = requests.get("https://api.fitbit.com/1/user/-/hrv/date/today.json", headers=headers).json()
```
Get token: https://dev.fitbit.com (OAuth2 flow)

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Description-Behavior Mismatch

Low

• Confidence: 92% confidence
• Finding: The manifest says the skill requires only Tavus and Anthropic keys, but the documentation also depends on Google Calendar OAuth files and environment variables. This mismatch can cause administrators to enable the skill without realizing calendar access and token storage are involved, reducing informed consent and increasing the chance of insecure setup.

Description-Behavior Mismatch

Low

• Confidence: 91% confidence
• Finding: The manifest says the skill requires only Tavus and Anthropic keys, but the documentation also depends on Google Calendar OAuth files and environment variables. This mismatch can cause administrators to enable the skill without realizing calendar access and token storage are involved, reducing informed consent and increasing the chance of insecure setup.

Static analysis

No suspicious patterns detected.