ClawHub
Back to skill

Security audit

healthsync

Security checks for vulnerabilities and agentic risk

Overview

The skill’s health-data query purpose is coherent, but its recommended installer executes mutable remote code and its alternate Go install is unpinned.

Review the installer before installing. Prefer a pinned, versioned release with checksum or signature verification, and avoid running the curl-to-bash command as written. Only query the minimum Apple Health fields needed, since results may be stored in transcripts or logs.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:16
Finding

Unverified Remote Installer Is Piped Directly to a Shell

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:16
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: High

Vulnerable Code:

bash
curl -fsSL https://healthsync.sidv.dev/install | bash

Technical Analysis

The installation command downloads content from an external URL and immediately executes it with bash. The payload is not stored for inspection, pinned to an immutable version, verified against a cryptographic checksum, or authenticated using a release signature.

Consequently, the code ultimately executed can change after the Skill has been reviewed. The installer is not included in the audited project, so its actual behavior and requested privileges could not be verified. Installing the required binary is relevant to the declared functionality, but executing a mutable remote response directly in a shell is not the minimum safe mechanism necessary to perform that installation.

Attack Path

  1. A user or agent follows the installation instructions in SKILL.md.
  2. The system requests the installer from https://healthsync.sidv.dev/install.
  3. An attacker compromises the domain, hosting environment, deployment pipeline, or installer content.
  4. The endpoint returns attacker-controlled shell commands.
  5. The pipe sends those commands directly to bash without inspection or integrity verification.
  6. The payload executes with all permissions held by the invoking user.

Impact Assessment

Successful exploitation permits arbitrary command execution under the invoking user's account. This could allow access to files and credentials readable by that user, modification or deletion of user-owned data, installation of persistence mechanisms where permitted, or execution of additional payloads.

The Skill handles particularly sensitive Apple Health information stored in ~/.healthsync/healthsync.db and Apple Health export archives. A malicious installer runnin ...[truncated 254 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the curl | bash installation path.
  2. Publish immutable, versioned release artifacts through an authenticated official release channel.
  3. Pin the documentation to a reviewed version instead of a mutable endpoint.
  4. Provide a SHA-256 checksum and require verification before execution or installation.
  5. Sign release artifacts and document signature verification using a pinned publisher key.
  6. Download the installer to a local file so users can inspect it before running it.
  7. Prefer a reputable package manager that provides integrity verification and version pinning.
  8. Ensure the installer does not request administrative privileges unless a documented operation strictly requires them.

A safer pattern would separate retrieval, integrity verification, and execution:

bash
curl -fL -o healthsync-installer.sh \
  https://example.invalid/releases/v1.1/healthsync-installer.sh
echo '<EXPECTED_SHA256>  healthsync-installer.sh' | shasum -a 256 -c -
less healthsync-installer.sh
bash healthsync-installer.sh

The placeholder URL and checksum must be replaced with an official immutable release and its independently published digest.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:19
Finding

Unpinned Go Installation Uses a Mutable Latest Release

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:19
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code:

bash
go install github.com/BRO3886/healthsync@latest

Technical Analysis

The alternative installation procedure uses the mutable @latest selector. This makes installation non-reproducible and allows future upstream code to be built and installed without any corresponding update to, or re-audit of, this Skill.

The upstream Go source and resulting binary are not part of the audited project. Therefore, this audit cannot verify their implementation or establish that a future release selected by @latest will preserve the documented read-only behavior. This is a supply-chain weakness rather than evidence that the current upstream project is malicious.

Attack Path

  1. An attacker compromises the upstream repository, maintainer account, release process, or relevant dependency chain.
  2. A malicious version becomes the release resolved by @latest.
  3. A user follows the documented command.
  4. Go retrieves, builds, and installs the unreviewed version.
  5. The user subsequently runs the installed binary to parse exports or query the health database.
  6. Malicious code executes with the invoking user's permissions and can access resources available to that process.

Impact Assessment

Exploitation could result in arbitrary code execution with the invoking user's permissions. Because the installed application processes Apple Health export archives and accesses ~/.healthsync/healthsync.db, malicious upstream code could potentially read or exfiltrate sensitive health records and other user-readable files.

No command in the audited documentation uses sudo; therefore, root or administrator access is not directly demonstrated. The likely privilege boundary is the user account performing the installation and running the binary.

Remediation
View remediation

Remediation Suggestions

  1. Replace @latest with an exact reviewed semantic version, such as @vX.Y.Z.
  2. For stronger immutability, pin a reviewed commit where the installation workflow supports it.
  3. Document the expected module version and source commit in the Skill.
  4. Publish signed, versioned binary releases with SHA-256 checksums as the preferred installation method.
  5. Re-audit the dependency before updating the pinned version.
  6. Use automated dependency and provenance checks, including verification of repository ownership and release signatures.
  7. Avoid automatically upgrading the binary to newer unreviewed releases.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The installation instructions recommend piping a remotely fetched script directly into bash, which executes unreviewed code from a network source with the user's privileges. If the hosting domain, transport path, or published installer is compromised, users could run arbitrary code leading to full system compromise, credential theft, or data exfiltration.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

bash
# macOS and Linux (recommended)
curl -fsSL https://healthsync.sidv.dev/install | bash

# Or via Go
go install github.com/BRO3886/healthsync@latest

Chaining Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

The command chaining pattern here is dangerous because it combines remote content retrieval with immediate shell execution, eliminating an opportunity for verification and amplifying the blast radius of any compromise. In a skill meant for agent-assisted use, this is more dangerous because users may copy and run the command with elevated trust due to the skill's authoritative tone.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

bash
# macOS and Linux (recommended)
curl -fsSL https://healthsync.sidv.dev/install | bash

# Or via Go
go install github.com/BRO3886/healthsync@latest

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: healthsync
description: Queries Apple Health data stored in a local SQLite database. Use this skill to read heart rate, steps, SpO2, VO2 Max, sleep, workouts, resting heart rate, HRV, blood pressure, active/basal energy, body metrics, mobility, running metrics, mindful sessions, wrist temperature, and more. Can query via the healthsync CLI or directly via SQLite. Read-only — never write to the database.
metadata:
  author: sidv
  version: "1.1"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This skill is designed to access highly sensitive Apple Health data, including heart rate, sleep, blood pressure, and other medical-adjacent information, but it does not prominently warn that queries may expose personal health information in agent outputs, logs, transcripts, or downstream tooling. In an agent context, omission of a privacy warning increases the chance that sensitive data will be retrieved or shared without adequate user awareness or minimization.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

md
## Important Constraints

- **READ ONLY** — You must NEVER write to the database. No INSERT, UPDATE, DELETE, DROP, ALTER, or any write operations.
- **Two query methods**: CLI (`healthsync query`) or direct SQLite (`sqlite3 ~/.healthsync/healthsync.db`)
- **Prefer CLI** for simple queries. Use direct SQLite for complex aggregations, joins, or custom SQL.

Static analysis

No suspicious patterns detected.