BestYou Health Intelligence

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 11:41 PM UTC
• Version: 1.0.0

Overview

This BestYou skill is a coherent health-coaching MCP integration, with setup risks around protecting the API key and installing the MCP client.

Before installing, confirm you trust BestYou and the mcporter package source, treat BESTYOU_API_KEY like a password, avoid committing or sharing it, prefer a secure environment or secret store over plaintext config, and review the granted scopes in the BestYou app.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:51

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:51-55; duplicated in references/setup.md:26-31
Vulnerability Type: Unpinned and globally installed third-party dependency
Risk Level: Medium

Vulnerable code from SKILL.md:

bash

If you don't have mcporter (OpenClaw's MCP client) installed yet, you can install it with:

npm install -g mcporter

Vulnerable code from references/setup.md:

bash

mcporter is OpenClaw's MCP client. If you don't have it installed:

npm install -g mcporter

Verify:

mcporter --version

Technical Analysis

The setup instructions install the latest version of the mcporter npm package globally without pinning a reviewed version or verifying package integrity. npm installations can execute package lifecycle scripts with the privileges of the user running npm. Global installation also makes the package available broadly in the user's environment.

Because no exact version, integrity hash, trusted publisher verification procedure, or lockfile is provided, the effective code installed by users can change after this skill has been audited. A compromised package release, maintainer account, transitive dependency, or registry response could therefore introduce arbitrary executable behavior.

This finding does not establish that mcporter is malicious. The vulnerability is the unsafe dependency acquisition pattern documented by the project.

Attack Path

1. An attacker compromises the npm package, its publisher account, or one of its install-time dependencies.
2. The attacker publishes a malicious version under the package name used by the documentation.
3. A user follows the documented npm install -g mcporter command.
4. npm retrieves the current package release rather than a specifically reviewed version.
5. Malicious lifecycle code executes under the installing user's privileges.
6. The malicious package can inspect files, environment variab ...[truncated 826 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin mcporter to an exact, reviewed version rather than installing the latest release:

   bash

   npm install -g mcporter@EXACT_REVIEWED_VERSION
   

2. Document the expected package publisher, official npm registry URL, and verified package provenance.
3. Publish and verify an integrity hash or signed release artifact where supported.
4. Review the package and its transitive dependencies before recommending installation.
5. Prefer a project-local, lockfile-controlled installation over a global installation where operationally feasible.
6. Disable install scripts during acquisition when they are unnecessary, then explicitly review any required lifecycle scripts.
7. Add a documented upgrade process so new versions are security-reviewed before changing the recommended pinned version.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/setup.md:19

Finding

Reusable API Bearer Token Persisted in Plaintext Configuration Files

Content

View full analysis

Vulnerability Details

File Location: references/setup.md:19-23 and references/setup.md:43-57
Vulnerability Type: Plaintext storage of a sensitive bearer credential
Risk Level: Medium

Shell-profile persistence guidance:

bash

Add your API key to your shell environment:

export BESTYOU_API_KEY="YOUR_KEY_HERE"

To persist across sessions, add the export to your shell profile (`~/.zshrc`, `~/.bashrc`, etc.).

Plaintext JSON configuration alternative:

bash

Alternatively, create or edit your mcporter config file at `~/.openclaw/workspace/config/mcporter.json`:

{
  "mcpServers": {
    "bestyou": {
      "baseUrl": "https://mcp.bestyou.ai/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_KEY_HERE"
      }
    }
  },
  "imports": []
}

**Important:** The API key goes in the `Authorization` header as a Bearer token. Do not pass it as a query parameter or body field.

Technical Analysis

The setup guide recommends persisting BESTYOU_API_KEY directly in a shell profile and provides an alternative configuration that embeds the bearer token in plaintext JSON. A bearer token grants access based on possession alone. Any process or user capable of reading the relevant file can copy and replay the token without knowing another secret.

The instructions do not require restrictive file permissions, use of an operating-system credential store, encrypted secret storage, or exclusion of the configuration from backups and source control. Shell profiles can also expose the credential to shell startup behavior, diagnostic collection, accidental sharing, or malicious processes running under the same user account.

Placing the token in the HTTP Authorization header is preferable to using a URL query parameter, but that transport practice does not protect the credential while it is stored locally.

Attack Path

1. A user follows the setup guide and writes the be ...[truncated 1512 chars]

Remediation

View remediation

Remediation Suggestions

1. Store the API key in an operating-system credential manager or another secret-management facility rather than directly in shell profiles or general-purpose JSON files.
2. If file-based storage is unavoidable, create a dedicated credential file with owner-only permissions:

   bash

   chmod 600 PATH_TO_CREDENTIAL_FILE
   

3. Ensure the containing directory is not accessible to other users.
4. Keep secrets out of dotfiles repositories, source control, logs, shell history, support bundles, and unencrypted backups.
5. Configure mcporter to resolve the token from a protected secret provider or runtime environment rather than embedding it in mcporter.json.
6. Document key rotation and immediate revocation through the BestYou iOS app if disclosure is suspected.
7. Use the narrowest available scopes and separate read and write credentials if the service supports that model.
8. Add explicit warnings explaining that bearer tokens provide account access to anyone who obtains them.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The alternative configuration method causes the authentication token to persist across sessions in a local configuration file, increasing the attack window compared with ephemeral shell usage. Because this skill interfaces with personal health and wellness data, stolen credentials could expose sensitive account information and enable unauthorized actions such as workout or nutrition plan changes.

Content

Scanner excerpt · references/setup.md (reported line 50)May include surrounding context.

--header "Authorization: Bearer $BESTYOU_API_KEY"

text

Alternatively, create or edit your mcporter config file at `~/.openclaw/workspace/config/mcporter.json`:

```json
{

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The setup guide instructs users to place a live API key directly into a persistent JSON config file, creating long-lived plaintext credential storage on disk. If the file is readable by other local users, backed up to cloud storage, or accidentally committed/shared, the token could be stolen and used to access sensitive health-related account data and write-capable MCP actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown file tells users to place BESTYOU_API_KEY in their environment, which involves handling a sensitive credential. The README does not include any warning here about protecting the key, avoiding sharing it, or treating it as secret, so the user-facing description omits a basic credential-safety disclosure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.