Security audit

Health Guardian

Security checks for vulnerabilities and agentic risk

Overview

This health-monitoring skill is purpose-aligned but asks agents to handle sensitive health data and ongoing alerts with inadequate privacy, consent, and safety boundaries.

Review carefully before installing. Only use this with explicit consent from the person whose health data is being processed, keep alerts local unless you intentionally accept third-party messaging risk, and do not treat outputs as medical advice or emergency detection. Check and correct the data paths and missing/inconsistent scripts before relying on it.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The documented behavior claims proactive monitoring, anomaly detection, and alerting, but the file mainly describes importing and processing local health exports without a clearly bounded implementation or declared permissions. This mismatch is risky because users may trust the skill with safety-critical health monitoring assumptions while the actual behavior may be incomplete, unaudited, or broader than disclosed, especially given access to sensitive medical data.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill instructs the agent to access local iCloud/Apple Health export files and write health data into local storage, but it does not declare any tool scope or permissions. In an agent ecosystem, undeclared file read/write capabilities are dangerous because they bypass least-privilege expectations and can expose or modify highly sensitive health information without explicit operator approval.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill presents automated anomaly detection and alerting for human health, including fever, heart rate, sleep, medication inference, and disability-related conditions, without a clear warning that outputs are not medical advice and may affect decision-making. In a caregiving context this is more dangerous because false positives or false negatives could delay treatment, cause panic, or drive harmful self-management decisions.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The configuration example includes an alert_channel set to Telegram for health anomalies, but the skill does not warn that this may transmit protected or highly sensitive health information through a third-party messaging service. In the context of chronic-condition monitoring, that omission can lead to unintentional privacy breaches, metadata leakage, or insecure handling of medical alerts.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The manifest advertises Apple Health integration and proactive alerts, which implies access to highly sensitive health data, but it does not disclose any privacy, consent, or data-handling considerations. In a health-monitoring skill, omission of these warnings can mislead deployers or users about the sensitivity of the capability and increase the risk of unsafe adoption or inappropriate data access decisions.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This script automatically reads highly sensitive health data from local Apple Health export locations and persists it into the skill's own data store without any consent prompt, disclosure, retention control, or access restriction visible in the code. Because the skill is explicitly designed for chronic-condition monitoring, the data includes especially sensitive medical signals, increasing privacy and compliance risk if the data is stored unexpectedly, retained indefinitely, or exposed through other parts of the system.

Static analysis

No suspicious patterns detected.