ClawHub
Back to skill

Security audit

Health Guardian

Security checks for vulnerabilities and agentic risk

Overview

The skill is not clearly malicious, but it handles sensitive Apple Health data and its privacy and persistent monitoring instructions are under-scoped enough to require review.

Review before installing. Only use this if you are comfortable with an agent reading Apple Health exports, storing health readings locally, and potentially running on an hourly schedule. Do not enable Telegram or any external alert channel unless you understand what health information may be sent outside the machine.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
The code is narrowly an ingestion/import utility, not a monitoring or alerting system. It reads Apple Health export files from local filesystem paths under the user's iCloud HealthExport directory, parses metrics such as heart rate, HRV, blood oxygen, respiratory rate, temperature, sleep, wheelchair distance, and push count, then merges them into a local JSON file with deduplication. While this is consistent with part of the description's Apple Health integration, the declared primary purpose emphasizes proactive monitoring, pattern detection, and anomaly alerts for chronic-condition care, none of which are implemented in this code chunk. Additionally, the description declares no permissions, but the code clearly performs local filesystem reads and writes, including access to iCloud-backed export directories and writing to a skill data file. This is a material description-behavior mismatch.

Missing User Warnings

High
Confidence
97% confidence
Finding
The skill claims 'Nothing leaves your machine. No cloud. No telemetry,' yet the sample configuration includes an external alert channel ('telegram') and the workflow instructs the agent to alert a human when anomalies are detected. That contradiction can mislead users into exposing highly sensitive health data to third-party services without informed consent.

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill documents filesystem reads from an iCloud health export directory and writes to local data files, but it does not declare any tool scope or permissions. In an agent environment, undeclared file access reduces user visibility and consent around sensitive operations, especially because the data involved is medical information.

Natural-Language Policy Violations

Medium
Confidence
87% confidence
Finding
The setup instructions require configuring Health Auto Export to use "JSON format" without indicating alternatives or documenting why that format is required. This imposes a specific language/format choice in natural-language instructions rather than offering user opt-in or justification.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
This Python file processes highly sensitive health metrics from local Apple Health exports and later persists them into the skill's data store. While the script prints import status, it does not disclose to the user that personal health data will be ingested and stored locally, and there is no visible comment or docstring warning about that privacy-impacting behavior.

Static analysis

No suspicious patterns detected.