T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/import_health.py:130- Finding
Unbounded ZIP and CSV Processing Can Cause Resource Exhaustion
- Content
View full analysis
- Remediation
View remediation
Security audit
Health Guardian
Security checks for vulnerabilities and agentic risk
Overview
The skill’s health-monitoring purpose is coherent, but it needs review because it handles sensitive health data with misleading privacy language and persistent monitoring guidance.
Review this skill carefully before installing it for real health monitoring. Use it only with informed consent from the monitored person, limit which Apple Health files it can read, avoid third-party alerts unless you are comfortable sharing health-derived information through that channel, and treat alerts as informational rather than medical advice.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The privacy statement is materially inaccurate: the workflow depends on iCloud-synced Apple Health exports and recommends external alerting channels like Telegram, so health data or health-derived inferences may leave the local machine. For a health-monitoring skill, misleading privacy claims can cause users to expose highly sensitive medical information under false assumptions of local-only handling.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill documents file-based data ingestion and local data storage but does not declare any tool scope or permissions boundary. In an agent ecosystem, this creates ambiguous authority and can lead to overbroad file read/write access being granted implicitly, which is especially risky because the skill processes sensitive health data from synced directories and writes derived records locally.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The documentation promotes anomaly detection, missed medication inference, and condition-related alerts without warning that outputs are heuristic inferences and not medical advice. In a care setting, this can lead agents or caregivers to overtrust automated conclusions, potentially delaying proper clinical assessment or prompting harmful actions based on false positives or false negatives.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill handles highly sensitive health data and caregiver notification workflows without clearly warning about privacy risks from iCloud storage and third-party alert channels. In this context, users may enable monitoring and outbound notifications for vulnerable individuals without informed consent regarding where medical data and inferred conditions are exposed.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The script reads sensitive health readings from local storage and generates summaries/alerts without any explicit privacy notice, consent check, or output-safety control. In the context of a health-monitoring skill handling chronic-condition data, this increases the risk of exposing highly sensitive medical information to users, logs, terminals, or downstream agents without adequate disclosure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This script automatically ingests highly sensitive health data from the user's iCloud Health export into the skill's local datastore without any explicit consent prompt, privacy notice, scope selection, or confirmation at runtime. In a health-monitoring skill, this behavior is especially risky because the imported data can include intimate medical indicators, and local persistence increases the chance of unintended retention, downstream access by other components, or disclosure if the skill environment is compromised.
- Content
Static analysis
No suspicious patterns detected.