Skill

• Outcome: Review
• Latest audit: Sep 14, 2026 · 8:53 PM UTC
• Version: 1.0.0

Overview

This skill has a coherent health-data purpose, but it asks users to expose sensitive health-data services publicly with weak setup safeguards.

Review carefully before installing. Use a pinned, verified server release, require a strong ADMIN_TOKEN, avoid exposing admin routes publicly, restrict tunnels, protect the local health-data directory, and only enable Discord alerts or recurring jobs if you are comfortable sharing health-derived details there.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:39

Finding

Unpinned Third-Party Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 39–41
Vulnerability Type: Supply-chain exposure caused by executing an unpinned registry package
Risk Level: Medium

Vulnerable Code Snippet:

bash

npx healthclaw-webhook-server

Technical Analysis

The setup instructions direct users to execute healthclaw-webhook-server through npx without specifying an exact package version or integrity value. Depending on the local npm state, npx may download and execute the package currently published under that name.

The project contains no lockfile, vendored server source, integrity hash, or other mechanism that binds execution to an audited artifact. The webhook server implementation is also absent from the audited project, so its effective behavior cannot be verified from these files.

This creates a supply-chain risk: a compromised package release, package ownership transfer, or malicious update could change the code executed by future users without requiring any change to this Skill.

Attack Path

1. An attacker compromises the npm account, publication process, or upstream repository associated with healthclaw-webhook-server.
2. The attacker publishes a malicious version under the same package name.
3. A user follows the documented setup command without selecting a reviewed version.
4. npx retrieves and executes the malicious release.
5. The package runs with the invoking user's operating-system privileges and may access local files, environment variables, network resources, and health data available to that account.

Impact Assessment

Successful exploitation could result in arbitrary code execution with the privileges of the user running npx. The affected scope may include:

• Health records stored by the webhook service.
• Files readable or writable by the invoking account.
• Environment variables and locally accessible credentials.
• Network services reachable from ...[truncated 249 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the package to a reviewed, immutable version, for example:

  bash

  npx --yes healthclaw-webhook-server@1.2.3
  

• Publish and document the expected package integrity hash and provenance.
• Provide the webhook server source in the reviewed repository or link to a version-specific commit and release artifact.
• Use a lockfile and a controlled installation process instead of resolving the latest registry release at execution time.
• Enable npm provenance and signed release workflows where supported.
• Recommend running the service under a dedicated, unprivileged operating-system account with access only to its required data directory.
• Review every dependency update before changing the documented pinned version.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:48

Finding

Publicly Exposed Administrative Endpoints With Optional Authentication

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 48–55
Vulnerability Type: Unsafe access-control configuration for publicly exposed administration endpoints
Risk Level: High

Vulnerable Code Snippet:

bash

Optional environment variables:
```bash
PORT=3000                         # Server port
HEALTHCLAW_DATA_DIR=~/custom/path # Override data directory
ADMIN_TOKEN=your-secret           # Protect admin endpoints

text

The documented public-exposure and unauthenticated pairing-generation flow is:

```bash
tailscale funnel --bg 3000

bash

curl -X POST https://your-public-url/admin/generate-pairing

Technical Analysis

The documentation categorizes ADMIN_TOKEN as optional, then instructs users to expose the entire webhook server to the public internet through Tailscale Funnel, Cloudflare Tunnel, or ngrok. The example request to /admin/generate-pairing includes no authentication header.

Under the documented default flow, users may therefore deploy a public administrative endpoint without access-control protection. Pairing-token expiration limits the lifetime of an individual token but does not prevent an unauthenticated internet client from requesting new tokens if the generation endpoint itself remains exposed.

The server implementation is not included in the audited project. Consequently, this audit cannot confirm whether undocumented server-side controls mitigate the issue. The finding is based on the explicitly documented configuration and request flow.

Attack Path

1. A user starts the webhook server without setting ADMIN_TOKEN, as permitted by the documented optional configuration.
2. The user exposes port 3000 through a public tunnel.
3. An attacker discovers or obtains the public URL through scanning, logs, browser history, shared messages, or URL leakage.
4. The attacker submits a request to /admin/generate-pairing.
5. If the server follows t ...[truncated 1152 chars]

Remediation

View remediation

Remediation Suggestions

• Make ADMIN_TOKEN mandatory and refuse to start administrative routes when it is absent or weak.
• Generate a cryptographically random token rather than encouraging manually selected secrets.
• Update every administrative request example to include authentication:

  bash

  curl -X POST https://your-public-url/admin/generate-pairing \
    -H "x-admin-token: $ADMIN_TOKEN"
  

• Bind administrative endpoints to localhost or a private management interface and expose only the minimum required ingestion and pairing routes publicly.
• Use separate listeners or hostnames for public synchronization and administrative operations.
• Apply authentication consistently to all /admin/* endpoints.
• Add rate limiting, request-size restrictions, audit logging, and temporary lockouts for repeated unauthorized requests.
• Ensure pairing tokens are single-use, short-lived, cryptographically random, and invalidated after successful exchange.
• Avoid exposing the service until authentication has been configured and verified.
• Document a secure deployment validation step that confirms unauthenticated administrative requests receive 401 Unauthorized or 403 Forbidden.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 60% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.

md

Open `openUrl` on your iPhone, or paste `deepLink` into Safari. The page has a button
that opens the HealthClaw app directly.

> **Token expires in 2 minutes.** If it expires, run the curl command again.

### 4. Install the iOS app

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The skill instructs users to execute npx healthclaw-webhook-server without pinning an exact package version, which means future installs may fetch changed or compromised code from the registry. Because this service handles highly sensitive health data and is intended to run persistently and be internet-exposed, a malicious package update or dependency hijack could lead to remote code execution or data exfiltration.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

This repeated instruction again promotes running an unpinned package via npx, creating a supply-chain risk where users may execute unexpected code if the package or one of its dependencies changes. In context, the server receives private biometric data and may be exposed through tunnels, so compromise would have direct confidentiality and system-trust consequences.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill walks users through exposing a health-data ingestion service to the public internet and storing medical/fitness records locally, but it does not provide clear privacy and security warnings proportional to the sensitivity of the data. This increases the likelihood of unsafe deployment decisions, accidental overexposure, and mishandling of regulated or highly personal information.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 192)May include surrounding context.

Create a user

bash

curl -X POST https://your-public-url/admin/users \
  -H "Content-Type: application/json" \
  -H "x-admin-token: your-secret" \
  -d '{"name": "alice"}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to send health anomaly details, including metric values and baselines, to Discord without warning the user that sensitive health data will be transmitted to a third-party messaging platform. Even though the content is framed as a wellness notification feature, disclosure of heart rate, HRV, sleep, and possible arrhythmia indicators can expose private health information and create privacy, compliance, or account-compromise risks if the Discord server, channel, or integrations are not properly secured.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

The file directs users to create a persistent cron job that automatically processes last night's health data and messages the result every morning. Persistent automation over sensitive health data is risky because it continues operating without per-run confirmation, potentially exposing private information repeatedly or after circumstances change (shared accounts, misconfigured channels, forgotten jobs).

Content

Scanner excerpt · examples/recovery-score.md (reported line 54)May include surrounding context.

md

Ask your OpenClaw agent to create the cron job:

> "Add a cron job that runs every morning at 7 AM to calculate my recovery score from
> last night's health data and message me the result."

Or configure it manually:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill instructs the agent to access highly sensitive health data and send derived results over Discord, but it provides no warning about the sensitivity of the data, no consent/approval step, and no guidance on minimizing what is transmitted. In context, the score, component metrics, and baseline values can reveal personal health status and routines, so silent collection and external messaging increases privacy and disclosure risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest explicitly advertises streaming highly sensitive health data, including heart rate, HRV, sleep, workouts, and blood pressure, to an agent via a webhook, but provides no accompanying privacy warning, data handling disclosure, or consent/security caveat. Because health data is especially sensitive and the skill routes it through a self-hosted integration, users may underestimate the privacy and security risks, increasing the chance of inappropriate exposure or misuse.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.