apple-health-sync

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:41 PM UTC
• Version: 0.9.4

Overview

This skill handles sensitive Apple Health data, but its behavior is disclosed, scoped to the stated sync workflow, and requires user-directed actions.

Install only if you are comfortable storing Apple Health-derived data and private sync keys locally under the selected state directory and using the disclosed Supabase relay. Keep the state directory private, do not share rotation backups or saved reports, and confirm any dependency install, unlink, rotation, report save, or recurring schedule before running it.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared description says the skill syncs encrypted Apple Health data from an iPhone/iPad to external AI agents. The supplied code does not communicate with any device, network service, or AI agent. Instead, it loads already-stored local health data from SQLite or JSON files, summarizes numeric metrics over a selected time window, and outputs or saves a local report. This is a materially different primary purpose: local summarization/reporting rather than device-to-agent sync. The code does touch Apple Health data, but only as local stored snapshots, so the description does not accurately represent the actual behavior.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The declared purpose says the skill syncs encrypted Apple Health data from iOS to AI agents. However, the supplied code chunk is specifically an onboarding/setup utility. Its primary actions are creating secure directories/files, generating RSA/Ed25519/X25519 keys, building onboarding payloads, optionally rotating identities with backups, requesting a challenge from a remote service, rendering and saving a QR code, and initializing a local SQLite table. There is no code here to connect to an iPhone/iPad, read Apple Health exports, decrypt synced health payloads, or transfer health data to any AI agent. While onboarding may support a broader Apple Health sync system, this chunk’s actual behavior is materially different from the declared primary purpose.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared description is about transferring encrypted Apple Health data from iOS devices to AI agents. The actual code does not perform any health-data access, iOS-device interaction, encryption handling, syncing, or communication with AI agents. Instead, it contains security tests for application configuration and relay URL validation. This is a materially different purpose, not merely a supporting detail of the declared functionality, so the description does not accurately represent the code chunk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description promises a synchronization capability that moves encrypted Apple Health data from iOS devices to various AI agents. The supplied code chunk does not implement or demonstrate syncing, device communication, encryption handling, or any integration with OpenClaw, Hermes Agent, Claude, Codex, or other agents. Instead, it contains unit tests for a local data-summary tool: requiring explicit confirmation before saving sensitive output, writing private files with mode 0600, refusing overwrites and symlinks, and producing summaries without record identifiers. That is a materially different primary purpose from the declared sync functionality, so this is a clear mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The supplied code does not implement or invoke Apple Health data syncing, iOS device access, or transfer of encrypted health data to AI agents. Instead, it tests onboarding and identity-rotation behavior, including archiving cryptographic materials, generating replacement user IDs, resetting config fields, and validating backup permissions. This is a materially different primary purpose from the declared description, so it is a clear mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description says the skill syncs encrypted Apple Health data from iOS devices to AI agents. The supplied code does not perform syncing, iOS device interaction, Apple Health data handling, encryption/decryption of user data, or communication with any AI agent. Instead, it runs regression tests over local project files to enforce a safe `cryptography` dependency range. This is a materially different primary purpose, so the description does not accurately represent the code.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description focuses on transferring encrypted Apple Health data from iOS devices to AI agents. The actual code does not implement or test any health-data sync functionality. Instead, it contains unit tests for helper functions that update in-memory state fields related to unlinking a device, including timestamps and error/status tracking. This is a materially different primary purpose and lacks the core declared capabilities such as Apple Health access, encryption, device sync, or communication with external AI platforms.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description focuses on synchronizing encrypted Apple Health data from an iOS device to AI agents. However, this code does not perform any health data access, synchronization, export, decryption, or transfer to AI agents. Its primary purpose is instead administrative device unlinking: it loads config, locates keys, requests a challenge from a backend endpoint, signs that challenge, submits an unlink_device action, and records unlink status timestamps/errors locally. While unlinking might exist within the broader product lifecycle, this chunk’s behavior is materially different from the declared sync purpose and introduces undeclared account/device-management capabilities.

Ae1

High

• Category: analysis-evasion

Content

- Require `python3` and the Python package version pinned in `requirements.txt`.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- Require `python3` and the Python package version pinned in `requirements.txt`.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 97% confidence
• Finding: The skill declares substantial capabilities—shell execution, file reads/writes, and network access—but does not expose an explicit tool-scope or permissions block. That leaves enforcement to prose instructions rather than machine-checkable policy, increasing the chance an agent or runtime grants broader access than intended when handling highly sensitive health data and private keys.

Session Persistence

Medium

• Category: Rogue Agent

Content

# Apple Health Sync

Act only on an explicit user request. Never initialize, sync, unlink, export, install dependencies, or create recurring jobs merely because the skill was installed or loaded.

Support this end-to-end encrypted OpenClaw <> iOS Apple Health workflow:

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Unverifiable Dependency: cryptography has 16 known advisory(ies) (GHSA-39hc-v87j-747x (Vulnerable OpenSSL included in cryptography wheels); CVE-2023-50782 (Python Cryptography package vulnerable to Bleichenbacher timing oracle attack); GHSA-537c-gmf6-5ccf (Vulnerable OpenSSL included in cryptography wheels) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence
• Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Intent-Code Divergence

Low

• Confidence: 91% confidence
• Finding: The module docstring states 'Bootstrap secure identity material for Apple Health sync. Not required to just onboard a new iOS device.' However, the script generates keys, writes onboarding payloads/QR artifacts, and initializes the local health-data database used by the sync workflow. That wording directly understates what the code actually sets up and can mislead operators about the script's role.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/config.md:56