Security audit

Apple Health MCP

Security checks for vulnerabilities and agentic risk

Overview

The skill has a clear Apple Health purpose, but it asks users to run an automatically downloaded, unpinned npm package against sensitive health data.

Review the npm package and prefer a pinned, verified version before installing. Run it with the least access practical, provide only the intended Apple Health export, and avoid using it where sensitive health data could be exposed to tools or logs you do not control.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:22
Finding: Unpinned npm Package Is Automatically Downloaded and Executed
Content: View full analysis
Remediation: View remediation
setup --export-path /path/to/export.zip ``` 2. Use a lockfile containing integrity metadata and install dependencies through a reproducible workflow. 3. Verify the package's provenance, publisher identity, signatures or attestations, and integrity before execution. 4. Avoid automatically accepting installation with `-y` where an interactive confirmation is feasible. 5. Review direct and transitive dependencies and use automated dependency monitoring. 6. Run the MCP server under a dedicated, least-privileged account or sandbox. 7. Limit filesystem access to the required health export and application data directories. 8. Restrict outbound network access when remote connectivity is not required. 9. Document the exact reviewed package version and provide a controlled upgrade procedure. ]]>

T01 · Skill Instruction Hijacking

Note

Location: SKILL.md:58
Finding: Skill Injects Unrelated Promotional Instructions into Agent Responses
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The skill instructs users to run an MCP server via npx -y apple-health-mcp-unofficial without pinning an exact version or integrity-verified artifact. That causes every installation or execution to trust the latest package resolution from the registry, which creates a supply-chain risk: a compromised maintainer account, malicious new release, typo-squat replacement, or dependency takeover could execute arbitrary code on the user's machine.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.