ClawHub
Back to skill

Security audit

Garmin Health Analysis CN

Security checks for vulnerabilities and agentic risk

Overview

The scanners classify this Garmin health and activity analysis skill as benign because its main reported capabilities align with that purpose, while noting some extra account profile access and unclear activation and tool scope; confidence is medium.

The verdict is benign, but confidence is medium and the scan is marked partial because some configuration references could not be resolved. Before installing, consider whether you are comfortable with a skill that can output account identity details and whose guidance may apply to broad questions; the detected tool scope and runtime permissions are also unclear.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
86% confidence
Finding

Most visible behavior directly supports the declared health and running-data purpose. However, the standalone profile capability exposes account identity fields that are not described and are not needed for the implemented health summaries. The code outputs these fields locally as JSON; no unrelated external transmission is visible. Broader advertised features absent from this chunk are not treated as mismatches, and the unseen authentication helper cannot be assessed.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, shell.

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Activation conditions do not explicitly require a Garmin health-data context.

Medium
Category
Trigger Abuse
Confidence
91% confidence
Finding

The guide instructs activation whenever users ask about health, data trends, or health insights, without explicitly requiring Garmin data. Line L287 further directs fetching summary data for an everyday question equivalent to “How have I been doing lately?”, which could concern unrelated topics.

Content

No source excerpt is available for this finding.

The profile command retrieves and outputs account identity information unrelated to the declared health-analysis purpose.

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

The manifest describes health metrics, running analysis, and dashboards, but fetch_profile retrieves the user's full name and returns account identifiers, including email when available. This separately exposed capability is not needed to retrieve or analyze the declared health and activity data and unnecessarily places identity information in the agent's output.

Content

No source excerpt is available for this finding.