ClawHub
Back to skill

Security audit

Health Metrics

Security checks across malware telemetry and agentic risk

Overview

This skill does what it claims: it locally turns Apple Health exports into dashboards and summaries, with some disclosed privacy-sensitive outputs and online map viewing behavior.

Install only if you are comfortable storing Apple Health-derived data in local plaintext DuckDB, HTML, and Markdown files. Use explicit output directories outside shared or synced locations when possible, and avoid opening workout map pages if you do not want your browser to contact Leaflet/CDN and Esri tile services for route display.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Tp4

High
Category
MCP Tool Poisoning
Confidence
86% confidence
Finding
The skill presents itself as 'offline-first' and says internet is needed only to view workout route maps, but the behavior still introduces external network dependencies and telemetry exposure when map pages are opened. Loading Leaflet assets from a CDN and remote tile servers can leak sensitive metadata such as viewing time, IP address, and potentially workout-location context; invoking `brctl` also adds platform-specific behavior not obvious from a strictly local-processing description.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The chart() function emits inline HTML and JavaScript that interpolate chart_id and y_fmt_js directly into attributes and a <script> block without escaping or validation. If any of these values can be influenced by imported health-export content or other upstream inputs, an attacker could break out of the string/context and execute arbitrary script in the generated dashboard HTML, turning an offline report into an XSS-capable document.

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
The generated HTML loads Leaflet CSS/JS from a third-party CDN, which creates an external network dependency in a skill handling sensitive health and location data. When the user opens the report, the browser will contact external services, leaking metadata such as IP address, access time, and potentially referrer/path information despite the skill's local-processing framing.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The workout detail page fetches remote map tiles from Esri for route display, introducing third-party network access into a local health-reporting workflow. Because these reports visualize precise workout routes, opening the page can expose sensitive location-related usage patterns to an external provider and weakens the user's expectation of offline/private processing.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
This script generates Markdown summaries containing highly sensitive health data, including sleep, vitals, workouts, and readiness signals, and writes them to disk by default without any explicit user warning, consent step, or privacy guardrail. In the context of a health-processing skill, silent persistence increases the risk of unintended retention, backup/sync exposure, local multi-user access, and accidental sharing of reports to other tools or LLM workflows.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.