Health Sync

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:51 PM UTC
• Version: 0.3.5

Overview

The skill has a coherent health-data purpose, but it repeatedly runs an unpinned npm tool while handling health records and credentials, and it may collect related occupants' Eight Sleep data.

Review this skill before installing. Use only a pinned and verified `health-sync` version, run it under a restricted account or sandbox, protect the generated credential and SQLite files, and confirm whether any Eight Sleep data for other occupants will be collected with their consent.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:17
• Finding: Unpinned npm Package Is Executed Through npx on Bot and User Systems<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:17-21`, `SKILL.md:84-88`, `references/setup.md:19-29`, `references/setup.md:79-83`, `references/setup.md:113-142` **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: High ### Vulnerable Code `SKILL.md:17-21`: ```yaml install: - kind: node package: health-sync bins: - health-sync ``` `SKILL.md:84-88`: ```bash npx health-sync sync ``` `references/setup.md:19-29`: ```text Bot-side commands: 1. `npx health-sync init remote bootstrap --expires-in 24h` 2. `npx health-sync init remote finish <bootstrap-ref> <archive-path>` 3. `npx health-sync providers --verbose` 4. `npx health-sync sync` 5. `npx health-sync status` User-side command: 1. `npx health-sync init --remote <bootstrap-token>` ``` `references/setup.md:79-83`: ```bash npx health-sync init remote bootstrap --expires-in 24h ``` `references/setup.md:113-124`: ```bash npx health-sync init remote finish <TOKEN_OR_KEY_ID_OR_SESSION_ID> /path/to/archive.enc ``` ```bash npx health-sync init remote finish <REF> /path/to/archive.enc \ --target-config /path/to/health-sync.toml \ --target-creds /path/to/.health-sync.creds ``` `references/setup.md:139-142`: ```bash npx health-sync providers --verbose npx health-sync sync npx health-sync status ``` ### Technical Analysis The Skill repeatedly executes the `health-sync` npm package without specifying an exact version or verifying an integrity hash. No lockfile, vendored implementation, package checksum, or package-signing policy is included in the audited project. When an unversioned package is invoked through `npx`, the resolved package can change independently of the reviewed Skill. This creates a supply-chain trust boundary: future registry releases or a compromised publisher account can cause code that was never audited to run under the privileges of the invoking user. The exposure is particularly significant because the package is instruc ...[truncated 2135 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the package to an exact reviewed version in every command, for example: ```bash npx --yes health-sync@1.2.3 sync ``` 2. Record and verify the expected npm package integrity digest before execution. 3. Include a lockfile and use a deterministic installation process such as `npm ci`. 4. Prefer a vendored or locally installed reviewed CLI over implicit registry resolution during each invocation. 5. Verify package ownership, provenance, and registry metadata. Enable npm provenance or equivalent signed-build verification where available. 6. Prevent lifecycle scripts unless they are explicitly required and audited. 7. Run the CLI in a sandbox with: - A dedicated unprivileged operating-system account. - Access only to the required health-sync workspace. - Restricted outbound network destinations. - No access to unrelated SSH keys, cloud credentials, environment secrets, or home-directory files. 8. Separate archive decryption and credential storage from the synchronization process where practical. 9. Document an upgrade review procedure so that package versions change only after source and dependency inspection. 10. Apply restrictive filesystem permissions to credential and database files and ensure backups inherit equivalent protections. ]]>

other

Warning

• Location: references/eightsleep.md:72
• Finding: Eight Sleep Synchronization Collects Related Occupants' Personal and Sleep Data<![CDATA[ ## Vulnerability Details **File Location**: `references/eightsleep.md:72-103` **Vulnerability Type**: Privacy data overcollection **Risk Level**: Medium ### Vulnerable Code `references/eightsleep.md:72-87`: ```text ### `users` (Bed Occupants / Related Users) - Upstream endpoint: `GET /v1/users/{user_id}` - `record_id`: `{user_id}` gathered from: - current user id - `devices.result.leftUserId` - `devices.result.rightUserId` - `devices.result.awaySides.*` - `start_time`: NULL - `end_time`: NULL - `source_updated_at`: current sync timestamp (`utc_now_iso()`) Top-level `payload_json` keys commonly present: - `user` (object, same general shape as `users_me.user`) ``` `references/eightsleep.md:89-103`: ```text ### `trends` (Per-Day Sleep/Presence Metrics) - Upstream endpoint: `GET /v1/users/{user_id}/trends` - Request params used by this project: - `tz` - `from` - `to` - `include-main=false` - `include-all-sessions=true` - `model-version=v2` - Response parsing: - loops over `trend_resp.days[]` - stores one `records` row per day item - `record_id`: `{user_id}:{day}` (fallback: `{user_id}:{sha256(day_json)}`) ``` The related profile shape is documented at `references/eightsleep.md:29-40`: ```text `payload_json.user` keys commonly present: - `userId` - `firstName`, `lastName` - `email`, `emailVerified` - `dob`, `gender`, `zip` - `devices` (array) - `currentDevice` - `sleepTracking` - `autopilotEnabled` - `tempPreference` - `createdAt` - Additional account/app settings fields may appear. ``` ### Technical Analysis The Skill's declared purpose is to analyze the user's health data. The Eight Sleep synchronization model, however, gathers identifiers not only for the current user but also for left-side, right-side, and away-side occupants associated with the device. Those identifiers are then used to retrieve user profiles and per-day sleep trends. The records are stored as raw JSON in the shared SQLite cache. Documented profil ...[truncated 2210 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Default Eight Sleep synchronization to the authenticated current user only. 2. Do not automatically treat `leftUserId`, `rightUserId`, or `awaySides.*` identifiers as synchronization targets. 3. Require explicit, informed opt-in before retrieving another occupant's profile or trends. 4. Clearly identify each additional person and the categories of data that will be collected before consent. 5. Where another occupant's data is needed, require authorization attributable to that occupant rather than relying solely on the primary account holder. 6. Add a provider configuration allowlist of approved user IDs. 7. Minimize stored profile fields. Do not persist email, date of birth, gender, ZIP code, or account settings unless they are necessary for a specific requested analysis. 8. Separate records by subject and enforce subject-level authorization in all query and response paths. 9. Avoid returning another occupant's data unless the request is explicitly authorized and scoped to that person. 10. Encrypt the SQLite database and backups, apply restrictive file permissions, and define retention and deletion controls. 11. Provide a mechanism to identify and delete previously synchronized records for related occupants. 12. Add automated privacy tests verifying that the default synchronization stores records only for the authenticated user. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (36)

Chaining Abuse

High

• Category: Tool Misuse

Content

2. If npm/npx is missing, tell user to install Node.js LTS (which includes npm and npx):
   - macOS (Homebrew): `brew install node`
   - Ubuntu/Debian: `sudo apt update && sudo apt install -y nodejs npm`
   - Windows: install Node.js LTS from `https://nodejs.org/`

3. Ask user to close/reopen terminal and rerun:

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Credential Access

High

• Category: Privilege Escalation

Content

Do not ask users to:

1. paste `client_secret`, `api_key`, OAuth callback URLs, access tokens, or passwords into chat
2. run `health-sync auth <provider>` as onboarding
3. do manual same-machine setup (`health-sync init`) as the primary flow
4. globally install `health-sync` as a first step when `npx health-sync ...` is sufficient

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: The skill declares use of `npx`/Node-installed tooling without any version pinning, which allows execution of whatever package version resolves at runtime. In a security-sensitive skill that handles encrypted onboarding archives, local credential files, and health data, this creates a supply-chain risk where a compromised or newly published package version could execute arbitrary code or exfiltrate sensitive data.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The activation scope includes broad prompts such as questions about sleep, recovery, training, activity, or 'your health,' which can cause the skill to trigger in ordinary conversation without the user clearly intending to access synced provider data. In a skill with access to sensitive health records and local credential-backed tooling, over-broad activation raises the risk of unnecessary syncs, data access, or disclosure in the wrong context.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: The onboarding flow instructs the bot to run `npx health-sync init remote bootstrap` without pinning an exact package version. Because this command is part of the trust boundary for bootstrap token generation and credential onboarding, a malicious upstream package update could subvert setup, capture secrets, or alter the bootstrap flow.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: The user-facing setup step `npx health-sync init --remote <bootstrap-token>` is unpinned, so the package resolved at execution time may differ from the version the bot expects. Since this step handles remote bootstrap material and produces an encrypted archive, version drift or package compromise could result in credential theft, malformed archives, or an attacker-controlled onboarding flow.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: The command `npx health-sync init remote finish <ref> <archive>` is executed at the point where encrypted archives are processed and secrets are written locally, but it is not version pinned. That makes the most sensitive phase of onboarding dependent on mutable upstream package resolution, increasing the chance of arbitrary code execution or secret exfiltration if the package supply chain is compromised.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: The mandatory freshness step tells the agent to run `npx health-sync sync` before any analysis, again without version pinning. Because sync touches provider integrations, tokens, and the local health database, executing an unpinned package at analysis time creates repeated exposure to supply-chain compromise rather than a one-time installation risk.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: The analysis workflow repeats the instruction to run `npx health-sync sync` without fixing the package version, reinforcing insecure operational guidance. In this context, the skill processes sensitive health telemetry and local secret material, so repeatedly invoking a mutable package materially increases operational risk.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This markdown file explains that Eight Sleep data is stored in a local SQLite cache and then enumerates highly sensitive fields such as names, email, date of birth, gender, ZIP code, device linkage, and sleep metrics. Under SQP-2 for markdown files, descriptions that omit warnings about effects on user data or privacy should be flagged when they describe behavior affecting sensitive data.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: The document repeatedly instructs the bot and user to run `npx health-sync ...` without pinning an exact package version. `npx` may fetch the latest package from the registry at execution time, so a compromised maintainer account, malicious update, or dependency hijack could result in arbitrary code execution on both the bot host and the user's machine during onboarding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: This command uses `npx health-sync` without a pinned version in a bot-side setup flow. Because the package is resolved dynamically, the bot could execute unreviewed or newly published code when finishing import of sensitive health-sync archives and credentials.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The provider-verification command is also unpinned. Even seemingly read-only commands can execute attacker-controlled install scripts or package code if the upstream package or dependency tree is compromised.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The sync command is executed via unpinned `npx`, which expands the attack surface because it likely runs with access to imported provider credentials and synchronized health data. A malicious package update here could exfiltrate secrets or tamper with synchronized records.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The status command is also dynamically resolved from the package registry. Although lower impact than bootstrap or import, it still creates an avoidable arbitrary-code-execution path on the bot host.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: The user-side onboarding command instructs end users to run `npx health-sync init --remote <bootstrap-token>` without version pinning. That means users are told to execute whatever code is currently published under that package name, which is especially risky because it occurs on their local machine during provider authentication.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

2. If npm/npx is missing, tell user to install Node.js LTS (which includes npm and npx):
   - macOS (Homebrew): `brew install node`
   - Ubuntu/Debian: `sudo apt update && sudo apt install -y nodejs npm`
   - Windows: install Node.js LTS from `https://nodejs.org/`

3. Ask user to close/reopen terminal and rerun:

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: This continuation command again tells the user to run `npx health-sync` without pinning the package version. Because the onboarding flow is described as authoritative, repeated unpinned references increase the likelihood that operators will execute them verbatim in production.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

1. Run bootstrap on bot infrastructure.
2. Share only the single remote command with the user.
3. Never ask user for provider secrets in chat.
4. Receive user archive file.
5. Run finish locally and confirm import.
6. Run verification sync and status.

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

1. Run bootstrap on bot infrastructure.
2. Share only the single remote command with the user.
3. Never ask user for provider secrets in chat.
4. Receive user archive file.
5. Run finish locally and confirm import.
6. Run verification sync and status.

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: The bootstrap command on the bot machine is unpinned and initiates a sensitive enrollment process. In this context, the command runs on infrastructure that will later ingest encrypted archives and manage secret material, so dynamic package resolution is particularly dangerous.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: This user instruction pattern repeats the same unpinned `npx health-sync` risk in end-user copy. Because it is phrased as exact text the bot should send, it operationalizes unsafe execution at scale.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: The archive import command is unpinned despite handling sensitive encrypted onboarding artifacts. If the fetched package is malicious, it could steal decrypted credentials, alter imported configuration, or establish persistence on the bot host.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The optional target-path variant is also unpinned and may write secrets to specified config and credential files. A malicious package could exploit this elevated context to overwrite arbitrary files or exfiltrate secrets.

Static analysis

No suspicious patterns detected.