ClawHealth Data Skill

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:06 AM UTC
• Version: 0.5.1

Overview

This skill is a coherent ClawHealth integration, but users should understand it sends sensitive health information to a hosted service using a long-lived Agent token.

Install only if you intend your Agent to use ClawHealth's hosted service with your synced health, nutrition, profile, and mood data. Protect the Agent API token like a password, revoke it in the iOS app if exposed, and avoid sharing temporary panel links because anyone with the link may be able to open the panel until it expires.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:199

Finding

Temporary Health Panel Capability Token Exposed in URL and Chat History

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:305

Finding

Feedback Endpoint Is Documented Without Authentication and Trusts a Caller-Supplied Customer Identifier

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README explicitly states that a long-lived Agent API token is used and that sensitive health-related data is sent to a hosted third-party API, but it does not prominently warn users about privacy, retention, token handling, revocation, or the consequences of compromise. In a health-data context, unclear disclosure around persistent credentials and remote processing increases the risk of unauthorized access, overbroad agent permissions, and exposure of highly sensitive personal information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill handles highly sensitive health data plus long-lived API tokens, but it does not require an upfront privacy notice or explicit consent before transmitting that information to https://clawhealth.site. Because the skill encourages persistent storage and reuse of customer IDs and bearer tokens, a user may not understand that personal health information is being sent to a third-party hosted backend.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill says to use itself for broad categories like health-data analysis, readiness, nutrition, anomaly context, or visual panels, which can cause invocation on generic health questions rather than clearly ClawHealth-scoped requests. In a health context, over-broad triggering is risky because it may route sensitive user queries and identifiers to an external hosted service when the user did not explicitly intend to use that provider.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

md

- "今天适合训练吗？"
- "帮我设置减脂目标。"

After setup, keep using the stored `customer_id` and Agent API token. Do not ask the user to repeat their customer ID, access code, endpoint names, or raw tool sequence unless debugging.

## Setup Order

Static analysis

No suspicious patterns detected.