healthsync

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:59 AM UTC
• Version: 1.0.0

Overview

The skill’s health-data query purpose is coherent, but its recommended installer executes mutable remote code and its alternate Go install is unpinned.

Review the installer before installing. Prefer a pinned, versioned release with checksum or signature verification, and avoid running the curl-to-bash command as written. Only query the minimum Apple Health fields needed, since results may be stored in transcripts or logs.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:16
• Finding: Unverified Remote Installer Is Piped Directly to a Shell## Vulnerability Details **File Location**: `SKILL.md:16` **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: High **Vulnerable Code**: ```bash curl -fsSL https://healthsync.sidv.dev/install | bash ``` ### Technical Analysis The installation command downloads content from an external URL and immediately executes it with `bash`. The payload is not stored for inspection, pinned to an immutable version, verified against a cryptographic checksum, or authenticated using a release signature. Consequently, the code ultimately executed can change after the Skill has been reviewed. The installer is not included in the audited project, so its actual behavior and requested privileges could not be verified. Installing the required binary is relevant to the declared functionality, but executing a mutable remote response directly in a shell is not the minimum safe mechanism necessary to perform that installation. ### Attack Path 1. A user or agent follows the installation instructions in `SKILL.md`. 2. The system requests the installer from `https://healthsync.sidv.dev/install`. 3. An attacker compromises the domain, hosting environment, deployment pipeline, or installer content. 4. The endpoint returns attacker-controlled shell commands. 5. The pipe sends those commands directly to `bash` without inspection or integrity verification. 6. The payload executes with all permissions held by the invoking user. ### Impact Assessment Successful exploitation permits arbitrary command execution under the invoking user's account. This could allow access to files and credentials readable by that user, modification or deletion of user-owned data, installation of persistence mechanisms where permitted, or execution of additional payloads. The Skill handles particularly sensitive Apple Health information stored in `~/.healthsync/healthsync.db` and Apple Health export archives. A malicious installer runnin ...[truncated 254 chars]
• Remediation: ## Remediation Suggestions 1. Remove the `curl | bash` installation path. 2. Publish immutable, versioned release artifacts through an authenticated official release channel. 3. Pin the documentation to a reviewed version instead of a mutable endpoint. 4. Provide a SHA-256 checksum and require verification before execution or installation. 5. Sign release artifacts and document signature verification using a pinned publisher key. 6. Download the installer to a local file so users can inspect it before running it. 7. Prefer a reputable package manager that provides integrity verification and version pinning. 8. Ensure the installer does not request administrative privileges unless a documented operation strictly requires them. A safer pattern would separate retrieval, integrity verification, and execution: ```bash curl -fL -o healthsync-installer.sh \ https://example.invalid/releases/v1.1/healthsync-installer.sh echo '<EXPECTED_SHA256> healthsync-installer.sh' | shasum -a 256 -c - less healthsync-installer.sh bash healthsync-installer.sh ``` The placeholder URL and checksum must be replaced with an official immutable release and its independently published digest.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:19
• Finding: Unpinned Go Installation Uses a Mutable Latest Release## Vulnerability Details **File Location**: `SKILL.md:19` **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium **Vulnerable Code**: ```bash go install github.com/BRO3886/healthsync@latest ``` ### Technical Analysis The alternative installation procedure uses the mutable `@latest` selector. This makes installation non-reproducible and allows future upstream code to be built and installed without any corresponding update to, or re-audit of, this Skill. The upstream Go source and resulting binary are not part of the audited project. Therefore, this audit cannot verify their implementation or establish that a future release selected by `@latest` will preserve the documented read-only behavior. This is a supply-chain weakness rather than evidence that the current upstream project is malicious. ### Attack Path 1. An attacker compromises the upstream repository, maintainer account, release process, or relevant dependency chain. 2. A malicious version becomes the release resolved by `@latest`. 3. A user follows the documented command. 4. Go retrieves, builds, and installs the unreviewed version. 5. The user subsequently runs the installed binary to parse exports or query the health database. 6. Malicious code executes with the invoking user's permissions and can access resources available to that process. ### Impact Assessment Exploitation could result in arbitrary code execution with the invoking user's permissions. Because the installed application processes Apple Health export archives and accesses `~/.healthsync/healthsync.db`, malicious upstream code could potentially read or exfiltrate sensitive health records and other user-readable files. No command in the audited documentation uses `sudo`; therefore, root or administrator access is not directly demonstrated. The likely privilege boundary is the user account performing the installation and running the binary.
• Remediation: ## Remediation Suggestions 1. Replace `@latest` with an exact reviewed semantic version, such as `@vX.Y.Z`. 2. For stronger immutability, pin a reviewed commit where the installation workflow supports it. 3. Document the expected module version and source commit in the Skill. 4. Publish signed, versioned binary releases with SHA-256 checksums as the preferred installation method. 5. Re-audit the dependency before updating the pinned version. 6. Use automated dependency and provenance checks, including verification of repository ownership and release signatures. 7. Avoid automatically upgrading the binary to newer unreviewed releases.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

External Script Fetching

High

• Category: Supply Chain

Content

```bash
# macOS and Linux (recommended)
curl -fsSL https://healthsync.sidv.dev/install | bash

# Or via Go
go install github.com/BRO3886/healthsync@latest

• Confidence: 98% confidence
• Finding: The installation instructions recommend piping a remotely fetched script directly into bash, which executes unreviewed code from a network source with the user's privileges. If the hosting domain, transport path, or published installer is compromised, users could run arbitrary code leading to full system compromise, credential theft, or data exfiltration.

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
# macOS and Linux (recommended)
curl -fsSL https://healthsync.sidv.dev/install | bash

# Or via Go
go install github.com/BRO3886/healthsync@latest

• Confidence: 97% confidence
• Finding: The command chaining pattern here is dangerous because it combines remote content retrieval with immediate shell execution, eliminating an opportunity for verification and amplifying the blast radius of any compromise. In a skill meant for agent-assisted use, this is more dangerous because users may copy and run the command with elevated trust due to the skill's authoritative tone.

Session Persistence

Medium

• Category: Rogue Agent

Content

---
name: healthsync
description: Queries Apple Health data stored in a local SQLite database. Use this skill to read heart rate, steps, SpO2, VO2 Max, sleep, workouts, resting heart rate, HRV, blood pressure, active/basal energy, body metrics, mobility, running metrics, mindful sessions, wrist temperature, and more. Can query via the healthsync CLI or directly via SQLite. Read-only — never write to the database.
metadata:
  author: sidv
  version: "1.1"

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This skill is designed to access highly sensitive Apple Health data, including heart rate, sleep, blood pressure, and other medical-adjacent information, but it does not prominently warn that queries may expose personal health information in agent outputs, logs, transcripts, or downstream tooling. In an agent context, omission of a privacy warning increases the chance that sensitive data will be retrieved or shared without adequate user awareness or minimization.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Important Constraints

- **READ ONLY** — You must NEVER write to the database. No INSERT, UPDATE, DELETE, DROP, ALTER, or any write operations.
- **Two query methods**: CLI (`healthsync query`) or direct SQLite (`sqlite3 ~/.healthsync/healthsync.db`)
- **Prefer CLI** for simple queries. Use direct SQLite for complex aggregations, joins, or custom SQL.

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.