Security audit

Health Guardian

Security checks for vulnerabilities and agentic risk

Overview

The skill’s health-monitoring purpose is coherent, but it needs review because it handles sensitive health data with misleading privacy language and persistent monitoring guidance.

Review this skill carefully before installing it for real health monitoring. Use it only with informed consent from the monitored person, limit which Apple Health files it can read, avoid third-party alerts unless you are comfortable sharing health-derived information through that channel, and treat alerts as informational rather than medical advice.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/import_health.py:130
Finding: Unbounded ZIP and CSV Processing Can Cause Resource Exhaustion<![CDATA[ ## Vulnerability Details **File Location**: `scripts/import_health.py`, lines 130–164 **Vulnerability Type**: Uncontrolled resource consumption during archive processing **Risk Level**: Medium ### Vulnerable Code ```python def parse_zip(zip_path): """Extract and parse CSVs from a ZIP export.""" data = {"vitals": []} try: with zipfile.ZipFile(zip_path, 'r') as z: for filename in z.namelist(): if not filename.endswith('.csv'): continue metric_name = None for key, val in METRIC_MAP.items(): if key in filename: metric_name = val break if not metric_name: continue with z.open(filename) as f: content = io.TextIOWrapper(f) reader = csv.DictReader(content) for row in reader: value = row.get("value") or row.get("qty") date = row.get("startDate") or row.get("date") unit = row.get("unit") or "" if value and date: try: val_float = float(value) if value.replace('.', '', 1).replace('-', '', 1).isdigit() else value except: val_float = value data["vitals"].append({ "metric": metric_name, "value": val_float, "date": date, "unit": unit, "source": "Apple Watch Ultra 2" }) except OSError as e: print(f"⚠️ ZIP file locked: {e}") return {"vitals": []} return data ``` ### ...[truncated 2248 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. **Set an archive size limit** - Reject ZIP files whose compressed size exceeds a configurable maximum before opening them. 2. **Validate ZIP metadata before processing** - Inspect each `ZipInfo` entry. - Enforce maximum entry count, per-entry uncompressed size, and total uncompressed size. - Reject suspicious compression ratios indicative of ZIP bombs. 3. **Limit imported records** - Define maximum rows per CSV and maximum total records per execution. - Stop processing and report a controlled error when a limit is reached. 4. **Process records incrementally** - Avoid retaining the complete archive contents in `data["vitals"]`. - Validate, deduplicate, and persist records in bounded batches. 5. **Apply execution limits** - Add an overall processing deadline or run the importer under operating-system CPU and memory limits. 6. **Harden exception handling** - Explicitly handle `zipfile.BadZipFile`, oversized-archive errors, decoding failures, CSV parsing errors, and resource-limit violations. - Fail closed without attempting partial processing of an archive that violates limits. 7. **Restrict the input directory** - Ensure only the expected user and trusted synchronization service can write to the Health Export directory. - Consider moving candidate archives into a controlled staging directory after validating ownership, type, and size. ]]>

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The privacy statement is materially inaccurate: the workflow depends on iCloud-synced Apple Health exports and recommends external alerting channels like Telegram, so health data or health-derived inferences may leave the local machine. For a health-monitoring skill, misleading privacy claims can cause users to expose highly sensitive medical information under false assumptions of local-only handling.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill documents file-based data ingestion and local data storage but does not declare any tool scope or permissions boundary. In an agent ecosystem, this creates ambiguous authority and can lead to overbroad file read/write access being granted implicitly, which is especially risky because the skill processes sensitive health data from synced directories and writes derived records locally.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The documentation promotes anomaly detection, missed medication inference, and condition-related alerts without warning that outputs are heuristic inferences and not medical advice. In a care setting, this can lead agents or caregivers to overtrust automated conclusions, potentially delaying proper clinical assessment or prompting harmful actions based on false positives or false negatives.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill handles highly sensitive health data and caregiver notification workflows without clearly warning about privacy risks from iCloud storage and third-party alert channels. In this context, users may enable monitoring and outbound notifications for vulnerable individuals without informed consent regarding where medical data and inferred conditions are exposed.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The script reads sensitive health readings from local storage and generates summaries/alerts without any explicit privacy notice, consent check, or output-safety control. In the context of a health-monitoring skill handling chronic-condition data, this increases the risk of exposing highly sensitive medical information to users, logs, terminals, or downstream agents without adequate disclosure.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This script automatically ingests highly sensitive health data from the user's iCloud Health export into the skill's local datastore without any explicit consent prompt, privacy notice, scope selection, or confirmation at runtime. In a health-monitoring skill, this behavior is especially risky because the imported data can include intimate medical indicators, and local persistence increases the chance of unintended retention, downstream access by other components, or disclosure if the skill environment is compromised.

Static analysis

No suspicious patterns detected.