T08 · Insecure Dependencies
Error
- Location
mcp-config.md:5- Finding
Unpinned Third-Party MCP Package Is Downloaded and Executed
- Content
View full analysis
- Remediation
View remediation
Security audit
Apple Health
Security checks for vulnerabilities and agentic risk
Overview
This skill is purpose-aligned for Apple Health export analysis, but it asks users to run mutable third-party code against sensitive health data and stores health context locally without clear access controls.
Review before installing. Only use this with Apple Health exports you are comfortable exposing to the MCP package, prefer a pinned and reviewed package version, avoid automatic npx -y execution where possible, restrict the export directory and environment available to the MCP process, and treat ~/apple-health/ memory and query logs as sensitive files.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
fallback-cli.md:5- Finding
Fallback Workflow Relies on Mutable Remote Skill Instructions
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
memory-template.md:15- Finding
Sensitive Health Context Is Persisted in Plaintext Without Defined Access Controls
- Content
View full analysis
## Constraints ## Notes ``` ```markdown ## query-log.md Template Create `~/apple-health/query-log.md`: ```markdown # Apple Health Query Log ## YYYY-MM-DD - Goal: - Query/report used: - Date window: - Result summary: - Caveats: ``` ``` The setup instructions require these details to be saved: ```markdown | Save to | Content | |---------|---------| | `memory.md` | Status, integration mode, last validated export path, freshness timestamp | | `integrations.md` | MCP client config decisions and known working command/env | | `query-log.md` | Queries that worked, plus caveats on units and table names | ``` ### Technical Analysis The workflow creates persistent Markdown files under `~/apple-health/` containing: - The absolute path to the user's Apple Health export. - The user's health-analysis goals and interests. - Export freshness metadata. - Queries used to analyze health records. - Result summaries and related caveats. These fields can reveal medical or wellness information even if raw CSV rows are not copied. For example, query goals and summaries may expose sleep problems, heart-rate trends, workout behavior, or other sensitive health context. The documentation does not require restrictive directory or file permissions, encryption, redactio ...[truncated 1340 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
The skill instructs users to run an MCP server via
npx @neiltron/apple-health-mcpwithout pinning an exact package version. This creates a supply-chain risk: future package updates, dependency compromise, or typosquatting-style replacement could cause unreviewed code to execute locally against sensitive Apple Health exports. The health-data context increases severity because the invoked tool is expected to read private medical data from disk.- Content
Unbounded Resource Access
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
- Content
md - Assuming live HealthKit access from CLI agents -> setup fails because only exported data is available - Using wrong export path in MCP env -> server starts but returns no data - Running SQL before schema discovery -> queries fail on wrong table names - Unbounded queries on large exports -> slow analysis and noisy output - Reporting "today" metrics from stale export -> inaccurate recommendations - Running MCP package on non-LTS Node -> DuckDB native module errors can break startup
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
The configuration instructs users to execute an unpinned package directly from npm via
npx -y @neiltron/apple-health-mcp, which allows whatever version is current at execution time to run locally. If the package is updated maliciously, compromised through account or dependency takeover, or simply introduces unsafe changes, users could execute attacker-controlled code with access to sensitive Apple Health export data and the local filesystem path specified inHEALTH_DATA_DIR.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
The setup instructs users to execute an unpinned package directly from the registry via
npx -y @neiltron/apple-health-mcp, which allows whatever version is current at execution time to run arbitrary install/startup code. In a skill focused on health-data access, this is especially sensitive because the package is configured with a local path to private Apple Health exports, so a compromised or typosquatted release could exfiltrate highly sensitive personal data.- Content
Static analysis
No suspicious patterns detected.