Health Auto Log

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:05 AM UTC
• Version: 1.0.0

Overview

This skill has a clear health-logging purpose, but it automatically writes sensitive health data from broad chat triggers without a consent step or tight execution scoping.

Review before installing. This skill may automatically create AX3 health records from chat messages, including ambiguous numeric messages, and it relies on a local mcporter configuration. Use it only in an environment where message routing is tightly controlled, AX3 credentials are scoped appropriately, and users understand that detected health data will be recorded.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T07 · Tool Hijacking and Spoofing

Warning

• Location: scripts/record_health_data.py:71

Finding

PATH-Based Hijacking of the mcporter Executable

Content

View full analysis

Vulnerability Details

File Location: scripts/record_health_data.py, lines 71-78
Vulnerability Type: Untrusted executable resolution through the inherited PATH
Risk Level: Medium

Vulnerable Code

python

cmd = [
    'mcporter',
    '--config', '/Users/klcintw/clawd/config/mcporter.json',
    'call', 'ax3-personal.record_habit',
    f'habitId={habit_id}',
    f'numberValue={value}'
]
result = subprocess.run(cmd, capture_output=True, text=True, check=True)

Technical Analysis

The subprocess invocation uses the bare executable name mcporter. Python therefore delegates executable resolution to the operating system using the process's inherited PATH.

Although the code safely avoids shell=True and constructs the arguments as a list, those protections do not prevent executable-path hijacking. If an attacker can modify PATH, control a directory already listed before the legitimate executable, or place a counterfeit mcporter binary in a writable search directory, the counterfeit program will be executed.

The fixed configuration argument does not mitigate this issue because it is passed directly to whichever executable is resolved first. A counterfeit executable could also imitate valid JSON output, making the invocation appear successful.

Attack Path

1. An attacker obtains write access to a directory that precedes the legitimate mcporter installation directory in the Agent process's PATH, or causes the Skill to run with an attacker-controlled PATH.
2. The attacker places an executable file named mcporter in that directory.
3. A user message containing a supported health measurement causes record_to_ax3 to run.
4. subprocess.run resolves mcporter through PATH and starts the attacker's executable.
5. The counterfeit executable runs with the same operating-system identity and permissions as the Agent process.
6. It may access Agent-readable data, alter healt ...[truncated 671 chars]

Remediation

View remediation

Remediation Suggestions

• Invoke mcporter through an absolute path located in an administrator-controlled directory rather than relying on PATH.
• During deployment, verify that the executable is owned by a trusted account and is not writable by unprivileged users.
• If dynamic discovery is unavoidable, resolve the executable once with shutil.which, verify the resolved path against an explicit allowlist, and reject unexpected locations.
• Supply a minimal, trusted environment to subprocess.run, including a restricted PATH.
• Run the Skill under a dedicated least-privileged account with access only to the required AX3 configuration and API operation.
• Where supported, verify the executable's signature or expected cryptographic digest before execution.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/record_health_data.py:61

Finding

Unbounded Running-Time Input Can Corrupt Records or Terminate Processing

Content

View full analysis

Vulnerability Details

File Location: scripts/record_health_data.py, lines 61-64
Vulnerability Type: Missing range and input-length validation
Risk Level: Low

Vulnerable Code

python

for pattern in patterns:
    match = re.search(pattern, text)
    if match:
        return int(match.group(1))

Technical Analysis

Running-time values are converted directly to integers without a maximum duration, a numeric-length restriction, or local exception handling. This differs from the weight and blood-sugar extraction functions, which enforce explicit acceptable ranges.

A large but convertible value can consequently be passed to record_to_ax3 as a running-time record, damaging health-data integrity. A numeric string large enough to exceed Python's configured integer-string conversion limit can cause int() to raise ValueError. Because this exception is not caught by extract_running_time, process_message, or main, the script can terminate without returning its expected JSON response.

The issue also conflicts with the Skill documentation's general assertion that detected values are validated against reasonable ranges.

Attack Path

1. An attacker or untrusted message sender submits a running-related message containing an excessive duration.
2. The regular expression captures the unrestricted sequence of digits.
3. For a large value that Python can convert, the function returns the value without checking whether it is a plausible exercise duration.
4. process_message submits the value to habit ID 2, potentially creating a false or unusable AX3 record.
5. Alternatively, if the captured numeric string exceeds Python's permitted integer-conversion length, int() raises ValueError.
6. The uncaught exception terminates the script, preventing the expected JSON response and causing a denial of service for that invocation.

Impact Assessment

The primary impact is loss of health-re ...[truncated 370 chars]

Remediation

View remediation

Remediation Suggestions

• Define and document a plausible running-time range, such as a positive value with an application-approved maximum.
• Reject captured numeric strings whose length exceeds a small fixed limit before calling int().
• Catch ValueError and return a structured validation failure instead of terminating the process.
• Apply consistent range validation to every supported metric.
• Validate the value again immediately before the AX3 call so that future parsing changes cannot bypass the constraint.
• Return explicit per-field validation errors while ensuring invalid values are never submitted.
• Add tests for zero, negative or malformed input, boundary values, excessive durations, and extremely long digit sequences.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill description says it should activate on messages with health keywords or even plain numeric values that could be weight measurements. This is dangerously broad for messaging channels because many ordinary messages contain numbers, creating a high risk of mis-triggering and silently treating non-health content as sensitive health data for logging.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill is designed to automatically detect health data from WhatsApp or similar messages and send it to AX3, but the description provides no privacy warning or consent guard. Health measurements are sensitive personal data, so automatic transmission without clear disclosure and user consent creates significant privacy and compliance risk.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The usage guidance explicitly lists a plain number like 69.8 as sufficient to trigger weight logging. In a chat context, this can misclassify unrelated numeric content and cause unauthorized collection and transmission of sensitive health information, especially because the workflow is described as automatic.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill instructs the agent to invoke a shell command (python3 scripts/record_health_data.py ...) but does not declare any corresponding tool scope or allowed-tools policy. Undeclared execution capability weakens containment and review, making it easier for a skill handling sensitive health data to run code without explicit authorization boundaries.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The activation examples and trigger guidance are centered on Chinese terms such as "體重" and "血糖," and the description does not say that the locale is intentionally limited or that other languages are supported. This can amount to an implicit language constraint without user opt-in or a documented justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The workflow tells the agent to run the script and confirm the result, but it does not include any user-facing warning or consent step before recording sensitive health data. In context, this increases the chance of silent collection from routine messages and makes accidental disclosure or unwanted record creation more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script automatically transmits detected health measurements to AX3 without explicit user confirmation, notice, or a review step. Because health data is sensitive, automatic forwarding can cause privacy violations, accidental record creation, or logging of ambiguous messages that the user did not intend to persist.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill invokes an external CLI using a hard-coded user-specific local config file, which grants the script indirect access to whatever capabilities and credentials that config enables. In a health-logging skill, this broad external capability increases risk because sensitive data is sent outside the script boundary and behavior depends on an unmanaged local tool/config rather than narrowly scoped in-code permissions.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/record_health_data.py (reported line 75)May include surrounding context.

python

f'habitId={habit_id}',
            f'numberValue={value}'
        ]
        result = subprocess.run(cmd, capture_output=True, text=True, check=True)
        return json.loads(result.stdout)
    except Exception as e:
        return {'success': False, 'error': str(e)}

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The module docstring presents the skill purpose exclusively in Chinese and does not indicate that language selection is optional or region-specific. Under the policy, forcing a specific language without user choice or explicit justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 63% confidence

Finding

The manifest specifically frames the skill around detecting weight, blood sugar, and exercise, so recording running time may be broadly related, but the implementation hard-codes a specific treadmill habit (running) without corresponding detail in the description. This is a mild behavior expansion beyond the concretely described measurement-focused examples.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.