withings-health

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:04 AM UTC
• Version: 1.0.1

Overview

This Withings skill does what it says, but it handles sensitive health data and stores OAuth tokens in an under-protected local file.

Review this before installing, especially on shared systems. The skill can access sensitive Withings health data, stores OAuth tokens locally in plaintext, and may lead users to put client secrets in a .env file that is not actually ignored by this package. Use only if you are comfortable managing those secrets yourself, restrict file permissions, exclude .env and tokens.json from any repository or archive, and revoke Withings tokens if the token file is exposed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: wrapper.js:20

Finding

OAuth Tokens Stored in an Unprotected Plaintext File

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:64

Finding

Documentation Incorrectly Claims That the Credential File Is Ignored by Git

Content

View full analysis

{ const [key, value] = line.split('='); if (key && value) process.env[key.trim()] = value.trim().replace(/['"]/g, ''); }); } ``` ### Technical Analysis The project directory contains only `SKILL.md` and `wrapper.js`; no `.gitignore` is present. The documentation nevertheless states that a `.env` file placed in the Skill directory “will be ignored by git.” A user who trusts this statement may place the Withings client secret in `.env` and then commit, package, archive, or publish the directory. Git does not ignore `.env` automatically, so the claimed protection does not exist unless separately configured outside the audited project. Although the client secret alone does not provide access to a user's health data, disclosure weakens the OAuth application's security and may allow impersonation or abuse of the registered application. ### Attack Path 1. The user follows the documented setup instructions. 2. The user creates `.env` in the Skill directory and stores `WITHINGS_CLIENT_SECRET` in it. 3. The user relies on the statement that the file is ignored by Git. 4. The user stages, commits, uploads, packages, or shares the project directory. 5. An attacker retrieves `.env` from the repository, package, archive, or its history. 6. The attacker uses the exposed client credentials to impersonate or abuse th ...[truncated 546 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:82

Finding

OAuth Authorization Code Is Supplied Through Process Arguments

Content

View full analysis

`. 3. A local observer reads the process arguments while the command is running, or obtains the code from shell history or logs. 4. Before the victim successfully redeems the code, the attacker submits it to the Withings token endpoint using the corresponding client credentials and redirect URI. 5. If the provider accepts the attacker's request first, the attacker receives OAuth tokens carrying the authorized scopes. The attack depends on capturing an unredeemed code, possessing any additional credentials required by the provider, and winning the short redemption race. ### Impact Assessment Successful exploitation can grant the at ...[truncated 353 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · wrapper.js (reported line 7)May include surrounding context.

js

const querystring = require('querystring');

// CONFIGURATION
// Load from local .env file if present
try {
    const envPath = path.join(__dirname, '.env');
    if (fs.existsSync(envPath)) {

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · wrapper.js (reported line 9)May include surrounding context.

js

// CONFIGURATION
// Load from local .env file if present
try {
    const envPath = path.join(__dirname, '.env');
    if (fs.existsSync(envPath)) {
        const envContent = fs.readFileSync(envPath, 'utf8');
        envContent.split('\n').forEach(line => {

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill requires sensitive environment variables (WITHINGS_CLIENT_ID and WITHINGS_CLIENT_SECRET) and instructs execution of a local wrapper script, but it does not declare explicit tool scope or permissions. That weakens reviewability and sandbox enforcement, making it easier for an agent/runtime to expose secrets or grant broader execution capability than intended.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This skill processes highly sensitive health data, including weight, body composition, activity, and sleep metrics, and sends/receives that data through the Withings API, but it provides no privacy warning or consent guidance. Users may unknowingly expose regulated or intimate health information without understanding retention, transmission, or sharing implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code persists OAuth access and refresh tokens to a local tokens.json file in plaintext without any warning, consent flow, or file-permission hardening. Because this skill handles sensitive health data, theft of the token file could allow continued API access to highly private user information until the tokens are revoked or expire.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code formats sleep timestamps using toLocaleTimeString('fr-FR'), which imposes a specific locale regardless of user preference or environment. This is a natural-language/locale policy issue because the skill does not offer a choice or document a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.