iwatch health data analysis

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:14 AM UTC
• Version: 1.0.0

Overview

The skill is mostly aligned with Apple Health report generation, but it handles highly sensitive health exports with under-disclosed privacy and browser-side risks that deserve review before installation.

Review this skill before installing if you care about health-data privacy. Only use it with Apple Health exports you are willing to process in the agent environment, delete export.zip and generated outputs when finished, and avoid opening generated reports while online unless Chart.js is bundled locally and user-supplied report text is properly escaped.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate_report.py:431

Finding

Stored HTML and JavaScript Injection Through an Unescaped Verdict

Content

View full analysis

{verdict} ``` The `verdict` value is supplied through the `--verdict` command-line argument and is interpolated directly into the generated HTML document without HTML escaping or sanitization. ### Technical Analysis The report generator constructs the complete document through a Python formatted string. The attacker-controlled `verdict` value is inserted into an HTML element as raw markup. Consequently, HTML metacharacters such as `<`, `>`, `"`, and `'` retain their syntactic meaning. For example, a verdict containing an event-handler payload can introduce a new HTML element whose JavaScript executes when the report is opened: ```text ``` The same underlying issue also affects other profile values inserted into the template without contextual escaping, including custom gender and condition values. The vulnerability is stored rather than reflected because the payload is written into the generated report and remains there until the report is deleted or regenerated. ### Attack Path 1. An attacker supplies a crafted verdict or persuades the user or an AI Agent to pass it through the `--verdict` option. 2. `generate_report.py` interpolates the value into the HTML template without escaping it. 3. The generated report is delivered to or opened by the user. 4. The browser interprets the injected value as active HTML. 5. An event handler or injected script executes in the report's browser context. 6. The payload can read or modify the report DOM, access the health data embedded in JavaScript variables, falsify displayed medical conclusions, or transmit accessible report data to an external endpoint. ### Impact Assessment ...[truncated 565 chars]

Remediation

View remediation

`. 4. Prefer a template engine with automatic escaping enabled rather than constructing the entire page with an f-string. 5. Add a restrictive Content Security Policy. Where possible, move inline JavaScript into a local static file and disallow inline event handlers. 6. Add regression tests with payloads containing `` sequences. ]]>

T08 · Insecure Dependencies

Warning

• Location: scripts/generate_report.py:356

Finding

Externally Hosted JavaScript Executes Without Integrity Verification

Content

View full analysis

``` ### Technical Analysis Every generated report loads and executes Chart.js from a third-party CDN when opened with network access. Although the package version is specified, the document does not provide a Subresource Integrity hash. The effective JavaScript payload is therefore outside the audited project and can be delivered or changed independently of the Skill package. This creates a browser-side supply-chain trust boundary. A compromise affecting the CDN, package publication process, account, or delivery path could cause arbitrary JavaScript to execute in every report that retrieves the affected resource. The external request also means report viewing is not completely local, despite the report containing sensitive health information. ### Attack Path 1. An attacker compromises or replaces the JavaScript artifact delivered through the external dependency path. 2. A user opens a generated health report while connected to the network. 3. The browser requests the script from the CDN. 4. Because no integrity hash is present, the browser accepts any successfully returned JavaScript from that URL. 5. The malicious script executes in the report's document context. 6. It can inspect the report DOM and JavaScript constants containing health metrics, modify the report, or transmit accessible data externally. ### Impact Assessment Successful exploitation grants arbitrary JavaScript execution within the generated report. The malicious dependency could: - Read health metrics displayed or embedded in the page. - Alter charts and conclusions. - Exfiltrate accessible report data through outbound requests. - Redirect users or display deceptive content. - Affect every ge ...[truncated 170 chars]

Remediation

View remediation

``` 3. Verify the integrity hash against the exact production artifact and update it only through a reviewed dependency-upgrade process. 4. Enforce a restrictive Content Security Policy that permits scripts only from explicitly approved locations. 5. Record and periodically review third-party dependency versions and checksums. 6. Consider generating a fully self-contained report so that opening sensitive health reports causes no external network traffic. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/parse_health.py:50

Finding

Unbounded ZIP Expansion and Record Retention Allow Resource Exhaustion

Content

View full analysis

= 0 else '' ``` The source contains the same control flow shown above; the exception text has been translated for report readability. The aggregation function also retains records before calculating monthly summaries: ```python raw[rtype].append((date, value, source)) ``` ### Technical Analysis Reading the XML in 512 KB chunks limits the size of each individual read, but it does not limit total work or total memory consumption. The parser does not validate: - The uncompressed size of `export.xml`. - The compressed-to-uncompressed size ratio. - The number of archive entries. - The number of matching health records. - Total processing time. - Total memory allocated to retained records. Every matching record is stored in the `raw` dictionary until parsing fini ...[truncated 1465 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The description overstates the code’s ingestion and extraction capabilities. This script is a report generator operating on preprocessed JSON, not a parser for Apple Health export.zip/XML data. It does accurately implement the personalized calibration logic and generates an interactive HTML report with six Chart.js charts, which aligns with part of the description. However, the declared primary workflow prominently includes streaming XML parsing and raw metric extraction from Apple Health exports, and those capabilities are absent from this code chunk. Therefore the description does not accurately represent what this supplied code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents a full analysis-and-reporting skill, including personalized calibration based on demographic/medical inputs and generation of an interactive HTML report with six charts. The supplied code chunk is narrower: it parses Apple Health export.xml from a zip file in chunks, extracts a set of health metrics, computes monthly means/sums, tracks HRV source metadata, and outputs chart_data.json. This matches the parsing/aggregation portion of the description, but materially omits the personalization and report-generation capabilities that are central to the declared purpose. Therefore the description overstates what this code chunk actually does.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The workflow explicitly instructs users to send export.zip from Apple Health to the AI without a prominent privacy warning at the point of upload, even though this archive contains comprehensive medical and biometric history. In the context of a health-analysis skill, this is especially dangerous because users may disclose large volumes of highly sensitive regulated-style data before understanding retention, exposure, or deletion risks.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md

根据 Step 0 收集的信息，调用 `scripts/generate_report.py` 中的 `build_reference()` 函数：

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

md

根据 Step 0 收集的信息，调用 `scripts/generate_report.py` 中的 `build_reference()` 函数：

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill uses broad natural-language trigger phrases like '帮我分析健康数据' and similar everyday requests, which can cause unintended invocation in contexts where the user did not specifically consent to this skill. Because the skill is designed to handle highly sensitive health exports, accidental routing increases the chance of unnecessary collection or processing of medical data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill description and all user-facing instructions are written in Chinese, including the mandatory prompt text the user is told to ask in Step 0. There is no indication that the user may choose another language or that the skill is intentionally limited to Chinese-speaking users for a justified regional purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This Python skill’s docstring, CLI help text, and generated report content are written in Chinese, and the HTML output is explicitly marked lang="zh-CN". There is no option for users to choose another language or any justification that this is a region-specific tool, which conflicts with the language/locale policy for natural-language behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The generated HTML loads Chart.js from a third-party CDN, which creates an unintended network dependency in a tool described as local Apple Health analysis. When the report is opened, sensitive health-derived data is rendered in a page that executes remote JavaScript, so a compromised CDN, MITM on an untrusted network, or future script change could execute attacker-controlled code in the report context and exfiltrate highly sensitive personal and medical information.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The module docstring, usage text, and all user-facing status/error messages are written only in Chinese. This creates a natural-language policy concern because the skill imposes a specific language on users without documenting an opt-in or offering an alternative locale.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/parse_health.py (reported line 216)May include surrounding context.

python

# 元数据
    meta = {
        'generated_at':  __import__('datetime').datetime.now().isoformat(),
        'months':        len(result),
        'date_range':    [min(result), max(result)] if result else [],
        'hrv_sources':   hrv_sources,

Static analysis

No suspicious patterns detected.