Apple Watch Health Sync

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:51 PM UTC
• Version: 1.0.0

Overview

This Apple Watch sync skill has a plausible purpose, but it handles sensitive health data with overbroad persistence, network exposure, and weak secret controls.

Review this skill carefully before installing. It is intended to sync Apple Watch health data, but it creates a long-running local service, exposes health records on the LAN if reachable, duplicates the API key in several places, and asks the agent to handle that key directly. Only use it if you are comfortable hardening the server first: bind to localhost unless LAN access is required, avoid persistent elevated startup tasks, do not share .env.json or templates containing the key, and review or remove the mutable upstream download path.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (6)

T06 · System Persistence

Error

• Location: SKILL.md:33
• Finding: Persistent Health Server Registered with Unnecessary Elevated Privileges<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 33-65 and 212-226 **Vulnerability Type**: Cross-session startup persistence and excessive privilege assignment **Risk Level**: High ### Vulnerable Code ```powershell $action = New-ScheduledTaskAction -Execute "pythonw.exe" -Argument "server.py" -WorkingDirectory "<health-sync-dir>" $trigger = New-ScheduledTaskTrigger -AtLogon Register-ScheduledTask -TaskName "HealthSyncServer" -Action $action -Trigger $trigger -RunLevel Highest -Force Start-ScheduledTask -TaskName "HealthSyncServer" ``` ```xml <key>ProgramArguments</key><array> <string>python3</string><string>server.py</string> </array> <key>WorkingDirectory</key><string>HEALTH_SYNC_DIR</string> <key>RunAtLoad</key><true/> <key>KeepAlive</key><true/> ``` ```bash launchctl load ~/Library/LaunchAgents/com.health-sync.server.plist ``` ### Technical Analysis The Skill instructs the Agent to register the generated server as a Windows scheduled task or macOS LaunchAgent. Both mechanisms survive the Skill execution and future Agent sessions. Continuous background operation is relevant to the declared real-time synchronization functionality. However, the Windows task uses `-RunLevel Highest`, even though a Flask server listening on an unprivileged port and writing to the user's project directory does not require administrative execution. This exceeds the minimum privileges necessary. The service runs `server.py` using relative executable and script references. If the script, working directory, or resolved Python executable is replaced or compromised, attacker-controlled code will execute automatically at subsequent logons. On Windows, it may execute with the task's elevated privileges. ### Attack Path 1. The user or Agent follows the setup instructions. 2. A scheduled task or LaunchAgent is installed and configured to run at logon and remain active. 3. An attacker gains write access to `server.py`, its working directory, or a dependency ...[truncated 647 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Make persistent startup an explicit, informed, opt-in choice rather than a mandatory setup step. - Remove `-RunLevel Highest`; register the Windows task with ordinary user privileges. - Use absolute paths for the Python interpreter and `server.py`. - Restrict write permissions on the server script, configuration, and dependency environment. - Prefer a dedicated, minimally privileged service account where persistent operation is required. - Add documented removal commands for both the scheduled task and LaunchAgent. - Configure restart limits instead of unconditional `KeepAlive` behavior. - Verify the script's ownership and integrity before each service start. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/setup.py:307
• Finding: Unauthenticated Dashboard Exposes the API Key and Protected Health Data<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup.py`, lines 307-397 **Vulnerability Type**: Broken access control and client-side secret exposure **Risk Level**: Critical ### Vulnerable Code The generated dashboard route has no authentication check: ```python @app.route("/dashboard", methods=["GET"]) def dashboard(): if DASHBOARD_FILE.exists(): return DASHBOARD_FILE.read_text(encoding="utf-8"), 200, {"Content-Type": "text/html"} return "dashboard.html not found - run setup.py first", 404 ``` The generated server listens on every network interface: ```python if __name__ == "__main__": api_key = get_api_key() if not api_key: print("ERROR: .env.json not found. Run setup.py first.") exit(1) print(f"Health data server on http://0.0.0.0:3001") app.run(host="0.0.0.0", port=3001) ``` The unauthenticated dashboard embeds the API key directly in client-side JavaScript: ```javascript const API='http://localhost:3001'; const KEY='...'; async function api(path){ const r=await fetch(API+path,{headers:{'api-key':KEY}}); return r.json(); } ``` ### Technical Analysis The generated server binds to `0.0.0.0`, making it reachable from other devices on the local network unless an external firewall blocks it. Although the health-data API routes check the `api-key` header, `/dashboard` does not. The dashboard response contains the same long-lived API key needed to access authenticated endpoints. Authentication is therefore bypassable: any network client that can fetch `/dashboard` can extract the key from the HTML source and use it to call `/api/summary` and `/api/latest/...`. CORS restrictions do not mitigate this issue. The server explicitly allows any origin, and an attacker can also issue direct HTTP requests independently of a browser. ### Attack Path 1. The Skill generates and starts the Flask server on `0.0.0.0:3001`. 2. An attacker on the same LAN identifies the host and requests `http://<host ...[truncated 821 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Never embed a long-lived API credential in dashboard HTML or client-side JavaScript. - Require authentication before serving `/dashboard`. - Bind the server to `127.0.0.1` by default. - If phone access over the LAN is required, apply host firewall rules restricting access to trusted devices or subnets. - Separate ingestion credentials from read credentials and assign the minimum required scope. - Use a secure authenticated enrollment process for the phone. - Use HTTPS or a trusted authenticated tunnel when transmitting credentials and health data. - Add key rotation and revocation support. - Consider using a server-side authenticated session for dashboard access rather than exposing the API key to the browser. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/setup.py:403
• Finding: API Credential Stored and Distributed Through Multiple Plaintext or Reversible Channels<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup.py`, lines 37-44, 403-433, and 511-542 **Vulnerability Type**: Insecure secret storage and disclosure **Risk Level**: High ### Vulnerable Code The API key is written as plaintext JSON: ```python def load_config(): """Load or generate config. API key stored in .env.json (gitignored).""" if CONFIG_FILE.exists(): return json.loads(CONFIG_FILE.read_text(encoding="utf-8")) api_key = "sk-health-" + secrets.token_hex(16) config = {"api_key": api_key} CONFIG_FILE.write_text(json.dumps(config, indent=2), encoding="utf-8") print(f" Generated new API key -> .env.json") return config ``` The credential is Base64-encoded and inserted into generated templates: ```python def make_template(name, data_type, lan_ip, api_key): headers_b64 = base64.b64encode(json.dumps([{"api-key": api_key}]).encode()).decode() return { "includeSymptoms": False, "notifyOnUpdate": True, "workoutTypes": [], "metrics": data_type["metrics"], "headers": headers_b64, "urlString": f"http://{lan_ip}:{PORT}/api/data", } ``` The key is also printed directly: ```python print(f" API Key: {api_key}") ``` ```python print(f" 3. IMPORTANT: manually add API key header after import:") print(f" Open automation -> Headers -> Add Header") print(f" Key: api-key") print(f" Value: {api_key}") ``` The Skill instructions additionally state: ```markdown Read the API key from .env.json first - you will need to tell the user. SEND THE FILE TO USER. ``` ### Technical Analysis Base64 is an encoding format and provides no confidentiality. Anyone who obtains a generated template can decode the `headers` value and recover the API key. The same credential is duplicated across `.env.json`, dashboard content, generated phone templates, terminal output, and potentially chat or file-transfer history. Duplication substantially i ...[truncated 1445 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not include the API key in generated dashboard assets or broadly shareable template files. - Do not print the full key to standard output. - Do not instruct the Agent to send `.env.json` through an arbitrary messaging channel. - Create `.env.json` with owner-only permissions, such as mode `0600` on supported systems. - Use separate, scoped credentials for ingestion and data retrieval. - Use a one-time enrollment token to provision the phone rather than distributing the permanent API key. - Clearly document whether templates contain credentials. - Add credential expiration, rotation, and revocation. - Redact secrets from logs, screenshots, exception messages, and support output. ]]>

T08 · Insecure Dependencies

Error

• Location: scripts/setup.py:31
• Finding: Unpinned Dependencies and Unverified Mutable Upstream Download<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup.py`, lines 31-32, 47-55, and 153-205 **Vulnerability Type**: Software supply-chain exposure **Risk Level**: High ### Vulnerable Code ```python REPO_URL = "https://github.com/HealthyApps/health-auto-export-server" REPO_ZIP = "https://github.com/HealthyApps/health-auto-export-server/archive/refs/heads/main.zip" ``` ```python def ensure_flask(): """Install flask if not present.""" try: import flask except ImportError: print(" Flask not found, installing...") subprocess.check_call([sys.executable, "-m", "pip", "install", "flask"]) print(" Flask installed.") ``` ```python if has_git: result = subprocess.run( ["git", "clone", REPO_URL, str(UPSTREAM_DIR)], env=env, ) ``` ```python req = urllib.request.Request(REPO_ZIP) with opener.open(req, timeout=30) as resp: zip_data = resp.read() with zipfile.ZipFile(io.BytesIO(zip_data)) as zf: UPSTREAM_DIR.mkdir(parents=True, exist_ok=True) for member in zf.namelist(): parts = member.split("/", 1) if len(parts) < 2 or not parts[1]: continue target = UPSTREAM_DIR / parts[1] if member.endswith("/"): target.mkdir(parents=True, exist_ok=True) else: target.parent.mkdir(parents=True, exist_ok=True) target.write_bytes(zf.read(member)) ``` ### Technical Analysis Flask is installed without a pinned version, lock file, or package hash. The effective dependency selected during setup can therefore change after the Skill has been reviewed. The upstream repository is cloned from its current default state, while the fallback archive explicitly tracks the mutable `main` branch. No commit identifier, release signature, or cryptographic checksum is verified. The current script does not directly execute files downloaded into `upstream/`; therefore, this is not confirmed remote payload execution. Neverthel ...[truncated 1347 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin Flask and all transitive dependencies to reviewed versions. - Use a lock file and verify package hashes during installation. - Pin the upstream repository to a specific reviewed commit rather than `main`. - Verify downloaded archives against a hardcoded, reviewed SHA-256 digest or a trusted signature. - Make the optional upstream repository download opt-in. - Do not disable configured proxies without a documented security reason. - Review upstream Docker, Grafana, and configuration files before presenting them as trusted setup material. - Prefer distributing the required reviewed assets with the Skill if licensing and update procedures permit it. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/setup.py:187
• Finding: ZIP Extraction Allows Writes Outside the Intended Upstream Directory<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup.py`, lines 187-199 **Vulnerability Type**: ZIP path traversal and arbitrary file overwrite **Risk Level**: High ### Vulnerable Code ```python with zipfile.ZipFile(io.BytesIO(zip_data)) as zf: UPSTREAM_DIR.mkdir(parents=True, exist_ok=True) for member in zf.namelist(): # strip top-level dir (health-auto-export-server-main/) parts = member.split("/", 1) if len(parts) < 2 or not parts[1]: continue target = UPSTREAM_DIR / parts[1] if member.endswith("/"): target.mkdir(parents=True, exist_ok=True) else: target.parent.mkdir(parents=True, exist_ok=True) target.write_bytes(zf.read(member)) ``` ### Technical Analysis The extraction logic strips the archive's first path component but does not validate the remaining path. A malicious entry such as: ```text health-auto-export-server-main/../../server.py ``` produces a destination equivalent to: ```python UPSTREAM_DIR / "../../server.py" ``` `Path` joining does not automatically reject `..` components. The subsequent `mkdir` and `write_bytes` operations can therefore write outside `UPSTREAM_DIR`. The vulnerability requires a malicious or compromised archive. That prerequisite is relevant because the archive is downloaded from a mutable branch without checksum or signature verification. ### Attack Path 1. An attacker gains control of, or can influence, the downloaded ZIP archive. 2. The attacker adds an archive entry containing `../` traversal components after the top-level directory. 3. Git cloning is unavailable or fails, causing setup to use the ZIP fallback. 4. Setup downloads and processes the malicious archive. 5. The extraction routine joins the traversal path to `UPSTREAM_DIR` without containment validation. 6. The attacker's file overwrites another file writable by the setup user. 7. If a persistent or subsequently executed script is ov ...[truncated 444 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Resolve each destination path before writing it. - Confirm that every resolved destination remains strictly beneath the resolved `UPSTREAM_DIR`. - Reject absolute paths, `..` components, symbolic links, hard links, device files, and other special archive entries. - Extract into a newly created temporary directory with restrictive permissions. - Verify the archive's cryptographic hash or signature before extraction. - Abort extraction on the first invalid member rather than silently continuing. - Prefer a standard hardened archive extraction helper where available. A containment check should follow this pattern: ```python root = UPSTREAM_DIR.resolve() target = (root / relative_member).resolve() if root not in target.parents: raise ValueError(f"Unsafe archive path: {relative_member}") ``` ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:75
• Finding: Setup Instructions Forcibly Terminate Unrelated Processes on Port 3001<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 75-82 **Vulnerability Type**: Unsafe process termination and denial of service **Risk Level**: Medium ### Vulnerable Code ```powershell (Get-NetTCPConnection -LocalPort 3001 -State Listen -ErrorAction SilentlyContinue).OwningProcess | ForEach-Object { Stop-Process -Id $_ -Force } ``` ```bash lsof -ti:3001 | xargs kill -9 2>/dev/null ``` ### Technical Analysis The instructions terminate every process listening on port 3001 without verifying the process identity, executable path, owner, or relationship to this Skill. Both variants use forceful termination, and the Unix command sends `SIGKILL`, preventing the target process from performing cleanup. A port conflict does not establish that the listening process is an obsolete Health Sync server. It may be an unrelated user application or service. The instruction therefore exceeds what is necessary to start the declared server safely. ### Attack Path 1. A legitimate application or service is listening on port 3001. 2. The Agent follows the Skill's setup instructions. 3. The command identifies the owning process solely by its listening port. 4. The process is forcibly terminated without user confirmation. 5. The unrelated application becomes unavailable and may lose buffered or in-progress data. ### Impact Assessment The issue can cause local denial of service, interruption of unrelated applications, and data corruption caused by abrupt process termination. If the command is executed with elevated privileges, it may also terminate services owned by other users or the system, depending on operating-system controls. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Detect and report the port conflict instead of automatically terminating the process. - Display the process ID, owner, executable path, and command line. - Ask for explicit user confirmation before stopping a verified Health Sync instance. - Attempt graceful termination before using a forceful signal. - Select another configurable port when the existing listener is unrelated. - Store the Health Sync server's process ID in a protected PID file and only stop the matching process. - Never use unconditional `kill -9` or `Stop-Process -Force` as the default conflict-resolution mechanism. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (37)

Ae1

High

• Category: analysis-evasion

Content

Run `python scripts/setup.py` - generates server, dashboard, API key, and phone templates.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

Run `python scripts/setup.py` - generates server, dashboard, API key, and phone templates.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

Run `python scripts/setup.py` - generates server, dashboard, API key, and phone templates.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ssd 3

High

• Confidence: 98% confidence
• Finding: The skill explicitly instructs the agent to read a secret from .env.json and disclose it to the user in chat/setup messages. Even if intended for legitimate configuration, extracting and transmitting secrets from local files violates safe secret-handling practices and can leak credentials through conversation history, screenshots, or compromised messaging channels.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

if has_git:
        print(f"  git clone -> upstream/")
        env = os.environ.copy()
        for k in ["https_proxy", "http_proxy", "HTTPS_PROXY", "HTTP_PROXY"]:
            env.pop(k, None)
        result = subprocess.run(

• Confidence: 60% confidence
• Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill requests only a binary prerequisite in metadata while the instructions clearly require broad capabilities including shell execution, file read/write, environment access, and network operations. This creates an undeclared privilege surface that reduces reviewability and can let an agent perform sensitive actions without explicit scope constraints.

Session Persistence

Medium

• Category: Rogue Agent

Content

The server MUST run independently of any agent session. Do NOT start it in an exec session
that will get killed by heartbeat or session recycling.

**Windows** - register as a startup task:
```powershell
$action = New-ScheduledTaskAction -Execute "pythonw.exe" -Argument "server.py" -WorkingDirectory "<health-sync-dir>"
$trigger = New-ScheduledTaskTrigger -AtLogon

• Confidence: 91% confidence
• Finding: The skill instructs the agent to install a persistent startup task so the server runs independently across sessions and logons. Persistence is a sensitive behavior because it survives the current interaction and can continue processing data or expose services long after the user expects the agent's actions to end.

Session Persistence

Medium

• Category: Rogue Agent

Content

Start-ScheduledTask -TaskName "HealthSyncServer"
```

**macOS** - use launchd plist:
```bash
cat > ~/Library/LaunchAgents/com.health-sync.server.plist << 'EOF'
<?xml version="1.0" encoding="UTF-8"?>

• Confidence: 90% confidence
• Finding: The launchd plist instructions set up a persistent agent that restarts automatically and survives reboot/logon. Installing persistence mechanisms is security-sensitive because it changes the user's system state beyond the immediate task and can maintain ongoing access to health data.

Session Persistence

Medium

• Category: Rogue Agent

Content

**macOS** - use launchd plist:
```bash
cat > ~/Library/LaunchAgents/com.health-sync.server.plist << 'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">

• Confidence: 88% confidence
• Finding: The plist creation content is part of a persistent autorun configuration. Even if operationally useful, embedding autorun installation in a skill normalizes durable execution without strong guardrails or explicit consent flows.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
cat > ~/Library/LaunchAgents/com.health-sync.server.plist << 'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key><string>com.health-sync.server</string>

• Confidence: 88% confidence
• Finding: This portion continues the persistent launch agent configuration, including keepalive behavior that will respawn the service. Keepalive increases persistence strength and can make shutdown harder, which is risky for services processing private health information.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
cat > ~/Library/LaunchAgents/com.health-sync.server.plist << 'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key><string>com.health-sync.server</string>

• Confidence: 88% confidence
• Finding: This portion continues the persistent launch agent configuration, including keepalive behavior that will respawn the service. Keepalive increases persistence strength and can make shutdown harder, which is risky for services processing private health information.

Session Persistence

Medium

• Category: Rogue Agent

Content

cat > ~/Library/LaunchAgents/com.health-sync.server.plist << 'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key><string>com.health-sync.server</string>
  <key>ProgramArguments</key><array>

• Confidence: 88% confidence
• Finding: The ProgramArguments and related launch agent directives operationalize automatic background execution of the server. Such persistence is not inherently malicious here, but it is security-relevant because it creates enduring process execution and a listening service.

Session Persistence

Medium

• Category: Rogue Agent

Content

<key>StandardOutPath</key><string>HEALTH_SYNC_DIR/server.log</string>
  <key>StandardErrorPath</key><string>HEALTH_SYNC_DIR/server.log</string>
</dict>
</plist>
EOF
# replace HEALTH_SYNC_DIR with actual path, then:
launchctl load ~/Library/LaunchAgents/com.health-sync.server.plist

• Confidence: 86% confidence
• Finding: The completion of the plist plus log paths finalizes a persistent service installation. Persistent logging of a health sync service may also increase secondary exposure if logs contain sensitive request or error details.

Session Persistence

Medium

• Category: Rogue Agent

Content

</plist>
EOF
# replace HEALTH_SYNC_DIR with actual path, then:
launchctl load ~/Library/LaunchAgents/com.health-sync.server.plist
```

**Quick start (if you just need it running now, not persistent):**

• Confidence: 92% confidence
• Finding: Loading the launch agent immediately enables the persistent service. This step crosses from documentation into activation of a durable background component, which should be treated as a sensitive system modification.

Session Persistence

Medium

• Category: Rogue Agent

Content

</plist>
EOF
# replace HEALTH_SYNC_DIR with actual path, then:
launchctl load ~/Library/LaunchAgents/com.health-sync.server.plist
```

**Quick start (if you just need it running now, not persistent):**

• Confidence: 92% confidence
• Finding: Loading the launch agent immediately enables the persistent service. This step crosses from documentation into activation of a durable background component, which should be treated as a sensitive system modification.

Session Persistence

Medium

• Category: Rogue Agent

Content

# Windows
start /B pythonw.exe server.py
# macOS / Linux
nohup python3 server.py > server.log 2>&1 &
```

Before starting, kill anything already on port 3001:

• Confidence: 83% confidence
• Finding: Using nohup or background start detaches the server from the current session, allowing it to continue running without active oversight. Even though framed as convenience, this creates session persistence and a standing local service that may continue handling sensitive data unexpectedly.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The instructions tell the agent to disclose and transmit the API key from a local secret file to the user without warning about handling, storage, or channel security. Secrets echoed into chat or attachments may be retained in logs, copied to insecure devices, or exposed to unintended viewers.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The heartbeat section directs the agent to perform ongoing health-data checks and send derived personal updates, extending behavior from one-time setup/query into persistent surveillance. Because the data is highly sensitive health information, continuous monitoring without narrowly scoped, explicit consent materially increases privacy risk.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The heartbeat guidance proposes periodic monitoring of sensitive health information and user-facing updates, but it does not require an explicit consent prompt, retention notice, or explanation of monitoring scope. Health data is especially sensitive, so silent or assumed background monitoring creates meaningful privacy and compliance risk.

Ssd 3

Medium

• Confidence: 90% confidence
• Finding: This section instructs the agent to continually inspect health data and send derived notifications such as wake-up greetings based on sleep timing. Although not a credential leak, it operationalizes sensitive personal data in an ongoing way that can reveal intimate habits and create unauthorized profiling if enabled without strong consent and limits.

Session Persistence

Medium

• Category: Rogue Agent

Content

**macOS** - launchd (survives reboot):
```bash
# create plist at ~/Library/LaunchAgents/com.health-sync.server.plist
# see Agent Instructions section for full plist template
launchctl load ~/Library/LaunchAgents/com.health-sync.server.plist
```

• Confidence: 89% confidence
• Finding: This later section again recommends launchd persistence that survives reboot. Repetition reinforces a default posture of durable background execution for a health-data receiver, increasing exposure if the user is unaware or no longer using the feature.

Session Persistence

Medium

• Category: Rogue Agent

Content

**macOS** - launchd (survives reboot):
```bash
# create plist at ~/Library/LaunchAgents/com.health-sync.server.plist
# see Agent Instructions section for full plist template
launchctl load ~/Library/LaunchAgents/com.health-sync.server.plist
```

• Confidence: 89% confidence
• Finding: The persisted launch agent path is reiterated as a reboot-surviving mechanism. Persistent components broaden the system's steady-state attack surface and should not be installed casually by an agent.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
# create plist at ~/Library/LaunchAgents/com.health-sync.server.plist
# see Agent Instructions section for full plist template
launchctl load ~/Library/LaunchAgents/com.health-sync.server.plist
```

**Quick (non-persistent):**

• Confidence: 92% confidence
• Finding: Executing launchctl load activates the persistent autorun behavior immediately. That is a sensitive action because it causes long-lived execution beyond the current session and may continue collecting or serving health data indefinitely.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
# create plist at ~/Library/LaunchAgents/com.health-sync.server.plist
# see Agent Instructions section for full plist template
launchctl load ~/Library/LaunchAgents/com.health-sync.server.plist
```

**Quick (non-persistent):**

• Confidence: 92% confidence
• Finding: Executing launchctl load activates the persistent autorun behavior immediately. That is a sensitive action because it causes long-lived execution beyond the current session and may continue collecting or serving health data indefinitely.

Session Persistence

Medium

• Category: Rogue Agent

Content

# Windows
start /B pythonw.exe server.py
# macOS / Linux
nohup python3 server.py > server.log 2>&1 &
```

## Directory Structure

• Confidence: 83% confidence
• Finding: This quick-start command also launches the server detached from the session, creating a persistent background process handling health data. Detached services increase the risk of unnoticed continued operation and broaden the attack surface on the local host.

Static analysis

No suspicious patterns detected.