Apple Health

• Analyzed: May 11, 2026, 4:58 AM
• Findings: 1
• Version: 1.0.0
• Hash: 8eafa37d3923bd78c754877c5f42a1df3efec70bf5b3f50bf686080361205bb6
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to its reliance on external command execution, broad file system access, and an explicit supply chain risk. It instructs the agent to execute `npx @neiltron/apple-health-mcp` (found in `SKILL.md`, `mcp-config.md`, `setup.md`), which allows arbitrary code execution if the third-party package is compromised. The skill also requires reading and validating user-provided local paths for health data and fetching documentation from `raw.githubusercontent.com` (`fallback-cli.md`). While these capabilities are necessary for the skill's stated purpose and include some guardrails, they represent significant attack surface and vulnerabilities, not intentional malice within the provided files.