Vitavault

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:00 PM UTC
• Version: 1.3.0

Overview

This skill has a coherent health-sync purpose, but its setup can expose sensitive health data through an unsafe public webhook and persistent host changes.

Only install after reviewing the setup carefully. Do not let an agent automatically publish this webhook or install the systemd service; require a strong token, localhost binding by default, HTTPS through infrastructure you trust, private file permissions, request limits, date validation, retention/deletion controls, and separate trusted credentials for any cloud API querying.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (6)

T06 · System Persistence

Error

• Location: SKILL.md:96

Finding

Privileged System-Wide Persistence Through a Systemd Service

Content

View full analysis

/tmp/vitavault-webhook.service << 'EOF' [Unit] Description=VitaVault Webhook Receiver After=network.target [Service] Type=simple User=$USER Environment=VITAVAULT_SYNC_TOKEN= ExecStart=/usr/bin/python3 /path/to/skills/vitavault/scripts/webhook.py --host 127.0.0.1 --port 8787 Restart=on-failure RestartSec=5 [Install] WantedBy=multi-user.target EOF # Adjust paths and token, then: sudo cp /tmp/vitavault-webhook.service /etc/systemd/system/ sudo systemctl daemon-reload sudo systemctl enable --now vitavault-webhook ``` ### Technical Analysis The setup instructions direct the Agent to use `sudo` to copy a service definition into `/etc/systemd/system/` and enable it at boot. This creates cross-session, reboot-persistent execution of the Python script. Continuous webhook operation is relevant to automatic health synchronization, but a root-authorized, system-wide service is not the minimum privilege necessary. An on-demand process or per-user service could provide the same functionality without modifying global startup configuration. The configured executable is also a Python script under a potentially mutable Skill installation path. If that script is replaced after service installation, the replacement code will run automatically under the configured service account. The service definition provides no meaningful systemd sandboxing or write restrictions. ### Attack Path 1. A user asks the Agent to configure VitaVault synchronization. 2. The Agent creates the service definition in `/tmp`. 3. The Agent uses `sudo` to install it into the system-wide systemd directory. 4. The service is enabled and starts automatically after subsequent reboots. 5. If the configured script path ...[truncated 585 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:24

Finding

Setup Failure Can Publish an Unauthenticated Health-Data Webhook

Content

View full analysis

~/.config/vitavault/sync-token mkdir -p ~/.config/vitavault TOKEN=$(cat ~/.config/vitavault/sync-token) echo "Token: $TOKEN" ``` ```bash VITAVAULT_SYNC_TOKEN="$TOKEN" nohup python3 scripts/webhook.py --host 0.0.0.0 --port 8787 > /tmp/vitavault-webhook.log 2>&1 & ``` The receiver explicitly fails open when no token is available: ```python token = getattr(self.server, "sync_token", "") if token: auth = self.headers.get("Authorization", "") if auth != f"Bearer {token}": self._respond(401, {"success": False, "error": "unauthorized"}) return ``` ```python token = os.environ.get("VITAVAULT_SYNC_TOKEN", "").strip() DATA_DIR.mkdir(parents=True, exist_ok=True) srv = ThreadedServer((args.host, args.port), Handler) srv.sync_token = token auth_status = "AUTH ENABLED" if token else "NO AUTH (open)" print(f"VitaVault webhook on http://{args.host}:{args.port} [{auth_status}]") ``` ### Technical Analysis Shell redirection occurs before command execution. On a fresh system where `~/.config/vitavault` does not exist, the first command cannot create `sync-token` because its parent directory has not yet been created. The instructions do not enable shell fail-fast behavior or verify that token generation succeeded. As a result, `TOKEN` may be empty. The webhook treats an empty token as a valid configuration that disables authentication. The setup then binds the receiver to all network interfaces and instructs the Agent to publish it through Tailscale Funnel, Cloudflare Tunnel, nginx/Caddy, or ngrok. This combines a deterministic setup-order defect with an authentication fail-open design. ### Attack Path 1. The setup is run on a host wit ...[truncated 1059 chars]

Remediation

View remediation

"$HOME/.config/vitavault/sync-token" TOKEN="$(cat "$HOME/.config/vitavault/sync-token")" test -n "$TOKEN" ``` - Make the webhook refuse startup when the token is absent or too short. - Permit unauthenticated operation only behind an explicit development flag and only on loopback. - Bind to `127.0.0.1` by default. - Verify authentication through the public tunnel before reporting setup as complete. - Avoid printing the complete token to logs or terminal history unnecessarily. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/webhook.py:17

Finding

Client-Controlled Date Enables Arbitrary File Path Construction

Content

View full analysis

Path: DATA_DIR.mkdir(parents=True, exist_ok=True) ts = datetime.now(timezone.utc).strftime("%Y-%m-%dT%H-%M-%SZ") date = payload.get("date", datetime.now(timezone.utc).strftime("%Y-%m-%d")) name = f"{date}_{ts}.json" dest = DATA_DIR / name with open(dest, "w") as f: json.dump(payload, f, indent=2) f.write("\n") if LATEST.exists() or LATEST.is_symlink(): LATEST.unlink() try: LATEST.symlink_to(dest.name) except OSError: shutil.copy2(dest, LATEST) return dest ``` ### Technical Analysis The request payload's `date` field is inserted directly into a filesystem path without parsing, normalization, or validation. `pathlib` discards the left operand when the right operand is absolute. Directory separators and traversal components are also not rejected. The `.json` suffix and timestamp limit the exact target filename, but they do not ensure that the write remains inside `~/vitavault/data`. The process writes attacker-controlled JSON content to any reachable constructed path for which the service account has permission. The behavior is remotely reachable through the POST handler and becomes unauthenticated if the token is missing. ### Attack Path 1. An attacker obtains a valid token, or reaches a receiver running without authentication. 2. The attacker submits a JSON object whose `date` contains an absolute path or path components. 3. The server concatenates that value with the timestamp and `.json` suffix. 4. `DATA_DIR / name` resolves to an attacker-influenced location outside the intended directory. 5. The service writes the submitted JSON using the receiver account's filesystem privileges. 6. `latest.json` is then updated to reference or copy the resulting ...[truncated 518 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/webhook.py:47

Finding

Unbounded Request Processing and Snapshot Retention Permit Denial of Service

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/query.py:21

Finding

Bearer Token Can Be Sent to an Arbitrary or Plaintext API Endpoint

Content

View full analysis

dict: url = f"{API_URL}{path}" req = Request(url) req.add_header("User-Agent", "VitaVault-OpenClaw/1.0") if TOKEN: req.add_header("Authorization", f"Bearer {TOKEN}") try: with urlopen(req, timeout=15) as resp: return json.loads(resp.read()) ``` ### Technical Analysis `VITAVAULT_API_URL` is accepted without validating its scheme or destination. The query function unconditionally adds the bearer token whenever one is configured. Consequently, an `http://` URL transmits the credential without transport encryption, while an attacker-controlled HTTPS URL receives the token directly. The code performs GET requests for health information; it does not itself upload locally stored health snapshots. The confirmed sensitive network flow is disclosure of the bearer credential to the configured endpoint. Because `urllib` follows standard HTTP behavior, redirect handling should also be constrained and tested so credentials cannot cross trust boundaries unexpectedly. ### Attack Path 1. An attacker or configuration error changes `VITAVAULT_API_URL` to an untrusted or plaintext endpoint. 2. The user or Agent executes a documented query command. 3. `api_get()` constructs a request to that endpoint. 4. The script adds `Authorization: Bearer `. 5. The remote endpoint—or a network observer for plaintext HTTP—captures the token. 6. The captured credential is used to submit forged health data or access any API ac ...[truncated 465 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:24

Finding

Health Records and Authentication Tokens Are Stored Without Enforced Restrictive Permissions

Content

View full analysis

~/.config/vitavault/sync-token mkdir -p ~/.config/vitavault TOKEN=$(cat ~/.config/vitavault/sync-token) echo "Token: $TOKEN" ``` The token is embedded directly in the systemd unit: ```ini [Service] Type=simple User=$USER Environment=VITAVAULT_SYNC_TOKEN= ExecStart=/usr/bin/python3 /path/to/skills/vitavault/scripts/webhook.py --host 127.0.0.1 --port 8787 ``` Health data is created using process-default permissions: ```python DATA_DIR.mkdir(parents=True, exist_ok=True) ts = datetime.now(timezone.utc).strftime("%Y-%m-%dT%H-%M-%SZ") date = payload.get("date", datetime.now(timezone.utc).strftime("%Y-%m-%d")) name = f"{date}_{ts}.json" dest = DATA_DIR / name with open(dest, "w") as f: json.dump(payload, f, indent=2) ``` The importer behaves similarly: ```python def ensure_dirs(): DATA_DIR.mkdir(parents=True, exist_ok=True) ``` ```python dest = DATA_DIR / f"{ts}.json" with open(dest, "w", encoding="utf-8") as f: json.dump(data, f, indent=2) ``` ### Technical Analysis Neither the shell instructions nor the Python scripts explicitly enforce private permissions on the token, health-data directories, or JSON snapshots. Security therefore depends on the invoking process's umask and preexisting directory modes. With a common `022` umask, newly created files are typically mode `0644` and directories mode `0755`, potentially allowing other local accounts to read sensitive medical information. The synchronization token is also placed directly in a service unit under `/etc/systemd/system`, where service definitions are commonly readable by unprivileged local users. The data schema includes highly sensitive information such as heart rat ...[truncated 910 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (26)

Tainted flow: 'req' from os.environ.get (line 31, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/query.py (reported line 36)May include surrounding context.

python

if TOKEN:
        req.add_header("Authorization", f"Bearer {TOKEN}")
    try:
        with urlopen(req, timeout=15) as resp:
            return json.loads(resp.read())
    except HTTPError as e:
        body = e.read().decode()

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The description presents this skill as an integration layer for importing Apple Health data from an iPhone into an AI agent, with networking/setup features such as webhooks, token generation, and HTTPS exposure. The supplied code instead only loads a local JSON file from the user's home directory, aggregates previously imported health records, calculates metrics like steps, heart rate, sleep, weight, HRV, SpO2, calories, exercise, and simple weekly trends, then outputs a compact briefing. There is no network communication, no webhook creation, no authentication/token handling, no HTTPS tunneling or exposure, and no code interacting with an iPhone or Apple Health APIs. This is a material mismatch in primary purpose and claimed capabilities.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The code is purely a local filesystem import script. It parses JSON/CSV export files, optionally merges them with previously imported data, writes timestamped JSON files to a local directory, and updates a symlink. There is no network communication, no webhook provisioning, no authentication/token handling, no HTTPS tunneling/exposure, and no iOS-device integration. The declared description therefore materially overstates and misrepresents the skill's actual behavior and primary purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The code does not implement the setup/integration behavior described. It only performs read-only GET requests against a pre-existing VitaVault API using configured environment variables. There is no code for creating webhooks, generating tokens, exposing an HTTPS endpoint, pairing with an iPhone, or syncing Apple Health data directly from the device. The actual purpose is querying already-synced health data from a cloud API, which is materially narrower and different from the declared integration/setup functionality.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description emphasizes infrastructure and integration features: direct Apple Health sync to an AI agent, automatic webhook setup, token generation, and HTTPS exposure. The supplied code does none of these things. It only loads an existing local JSON file, parses health records, computes averages/min/max for metrics, summarizes sleep, and prints results in text or JSON. This is a materially different primary purpose. While it operates on VitaVault health data, it does not implement the advertised integration capabilities or any network/auth/setup behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The description overstates the implementation. The code does implement part of the declared theme—a webhook receiver for health data snapshots—but it does not provide several core advertised capabilities. There is no automatic setup, no token generation, no HTTPS support, no mechanism to expose the service publicly, and no forwarding or integration with an AI agent beyond local file storage. The primary behavior is a basic local HTTP ingestion endpoint that writes JSON files to disk, which is materially narrower than the declared end-to-end iOS integration.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill tells the agent to expose a health-data webhook publicly over HTTPS but does not prominently warn about the implications of opening inbound access to a service that receives sensitive medical data. Even with a token, public exposure increases the risk of credential leakage, endpoint probing, denial-of-service, and accidental disclosure through logs or misconfiguration.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The privacy statement says data flows only from the iPhone to the user's agent with no third-party storage, yet the setup recommends Cloudflare Tunnel and ngrok, and even Tailscale Funnel involves third-party infrastructure. This can mislead users about who can observe metadata or transport traffic and causes underestimation of privacy risk for sensitive health information.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill contains instructions to generate tokens, write files, start a network listener, and expose it externally, but it declares no explicit tool or permission scope. That mismatch increases the chance an agent will perform sensitive filesystem and network actions without clear user visibility or policy gating.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 86% confidence

Finding

The instruction to perform the technical setup automatically and not ask the user removes an important consent checkpoint before privileged actions like file creation, background process launch, network exposure, and persistence. In a security-sensitive context involving health data, reducing user confirmation increases the chance of unsafe or surprising system modifications.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md

## Agent Setup Guide (DO THIS WHEN USER SAYS "set up VitaVault")

When your user asks to set up VitaVault sync, follow these steps automatically. Don't ask the user to do the technical parts - handle it yourself and hand them the URL + token at the end.

### Step 1: Generate a sync token

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The generated sync token is treated as a simple setup value, but it is effectively a bearer credential authorizing submission of sensitive health data to the webhook. Failing to warn users about its sensitivity increases the chance it will be copied into insecure channels, shell history, logs, screenshots, or shared chats.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

bash

# Generate a secure random token
python3 -c "import secrets; print(secrets.token_hex(32))" > ~/.config/vitavault/sync-token
mkdir -p ~/.config/vitavault
TOKEN=$(cat ~/.config/vitavault/sync-token)
echo "Token: $TOKEN"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

Using nohup to launch the webhook in the background creates session persistence and leaves a long-running network-reachable process active after the initiating interaction ends. That is particularly risky here because the process handles sensitive health data and may be publicly exposed through a tunnel.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

Step 2: Start the webhook

bash

VITAVAULT_SYNC_TOKEN="$TOKEN" nohup python3 scripts/webhook.py --host 0.0.0.0 --port 8787 > /tmp/vitavault-webhook.log 2>&1 &

The webhook listens for health data POSTs and saves snapshots to ~/vitavault/data/.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The use of sudo for Tailscale Funnel asks the agent to perform privileged network configuration on the host. Privileged execution is dangerous because mistakes or abuse can modify trusted networking state and expose local services beyond the user's intended scope.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

Check if Tailscale is available

tailscale status 2>/dev/null

If yes, expose via Funnel:

sudo tailscale funnel --bg --set-path /vitavault http://127.0.0.1:8787

Your URL will be: https:///vitavault

tailscale funnel status # to see the URL

text

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The instructions direct the agent to use sudo and host-level networking features to publish a local service externally, which exceeds the minimum scope needed for simple data import. Broad system administration actions materially increase attack surface and can alter host security posture in ways the user may not expect.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Installing and enabling a persistent systemd service is a host-administration action that survives the current session and changes system state beyond transient data sync. In a skill context, this is risky because it normalizes persistence and background execution for code that handles sensitive health data and network ingress.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

Copying a unit file into /etc/systemd/system with sudo is a privileged host modification that establishes trust for future execution. In a skill ecosystem, asking the agent to make such changes can be abused to plant persistent services or normalize elevated operations users did not explicitly review.

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

WantedBy=multi-user.target EOF

Adjust paths and token, then:

sudo cp /tmp/vitavault-webhook.service /etc/systemd/system/ sudo systemctl daemon-reload sudo systemctl enable --now vitavault-webhook

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

Running systemctl daemon-reload with sudo applies privileged service configuration changes system-wide. This is not required for basic health-data analysis and unnecessarily expands the skill from application logic into system administration.

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

EOF

Adjust paths and token, then:

sudo cp /tmp/vitavault-webhook.service /etc/systemd/system/ sudo systemctl daemon-reload sudo systemctl enable --now vitavault-webhook

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

Enabling and starting the service with sudo creates persistent privileged execution at boot, which materially raises risk if the script is flawed, replaced, or later compromised. Combined with a public webhook and health-data handling, this enlarges both exposure duration and attack surface.

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

Adjust paths and token, then:

sudo cp /tmp/vitavault-webhook.service /etc/systemd/system/ sudo systemctl daemon-reload sudo systemctl enable --now vitavault-webhook

text

## Querying Health Data

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 93% confidence

Finding

systemctl enable establishes reboot persistence, causing the service to continue running and accepting inbound traffic long after the setup interaction ends. Persistence is risky because it can outlive user awareness, preserve insecure configurations, and create a standing target handling sensitive data.

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

Adjust paths and token, then:

sudo cp /tmp/vitavault-webhook.service /etc/systemd/system/ sudo systemctl daemon-reload sudo systemctl enable --now vitavault-webhook

text

## Querying Health Data

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file documents a broad set of highly sensitive health data types, including heart rate, blood glucose, blood pressure, sleep, body metrics, and nutrition, but provides no privacy, consent, retention, or secure-handling guidance. In the context of a skill that syncs Apple Health data to an AI agent and auto-configures webhooks and HTTPS exposure, this omission increases the risk that implementers will collect, transmit, or store regulated health data insecurely or more broadly than intended.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This schema documents export of highly sensitive health, device, and source-application data, including sleep, heart rate, device identifiers, bundle identifiers, and metadata, but provides no privacy warning, consent guidance, data minimization guidance, or handling restrictions. In the context of a skill whose purpose is to sync Apple Health data directly to an AI agent and expose webhooks/HTTPS endpoints, omission of privacy and sharing warnings materially increases the risk of over-collection, inadvertent disclosure, and unsafe downstream processing of regulated or intimate personal data.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill metadata and docstring imply secure HTTPS exposure and token generation, but the implementation actually starts a plain HTTP server and only consumes a preexisting environment token. In this health-data context, that mismatch is security-relevant because operators may assume transport security and authentication setup exist when sensitive Apple Health data is in fact exposed over cleartext and potentially unauthenticated.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Authentication is described as optional and the server binds to 0.0.0.0 by default, making the webhook openly reachable on all interfaces unless the operator manually sets a token. Because the endpoint ingests and stores health snapshots, an unauthenticated default permits arbitrary parties on the reachable network to inject fake medical data and collect information about service availability.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.