Security audit

biohub

Security checks for vulnerabilities and agentic risk

Overview

This health-data skill is not clearly malicious, but it needs review because it handles sensitive biometric data through unpinned external software and understates some capabilities.

Review carefully before installing. Only use this with health data you are comfortable exposing to your agent and model provider, install the backing biohub software from a specific trusted release when possible, avoid enabling watch-folder importers or the Apple Health LAN receiver unless needed, and treat optional persona/profile files as editable local data that should not contain agent instructions.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T08 · Insecure Dependencies

Error

Location: SKILL.md:25
Finding: Unpinned External Software Is Installed and Executed
Content: View full analysis
.py` and parse the JSON. ``` ```markdown - `blood_panel_import.py --watch-dir ` - `supplement_import.py --watch-dir ` ``` ```markdown biohub connect ``` ```markdown python3 -m adapters.apple_health.receiver ``` ### Technical Analysis The artifact does not include the implementation of the Biohub CLI, analytics scripts, importers, adapters, or HTTP receiver. Instead, it directs users to install software from a mutable GitHub repository and follow installation instructions from its current README. No reviewed commit hash, immutable release archive, package hash, signature, or integrity-verification procedure is specified. The effective code executed by the skill can therefore change after this artifact has been audited. The referenced components are not limited to passive database reads: they include Python execution, watch-directory importers, device adapters, data-writing CLI operations, and an HTTP receiver. This creates a supply-chain trust boundary in which control of the upstream repository, release process, package distribution mechanism, or installation documentation can affect code executed on the user's system. ### Attack Path 1. An attacker compromises the linked repository, its maintainer account, release artifacts, package distribution channel, or installation documentation. 2. The attacker modifies the installation process or one of ...[truncated 1142 chars]
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:29
Finding: Unaudited Persona Files Can Alter Agent Behavior Across Sessions
Content: View full analysis
Remediation: View remediation

other

Warning

Location: CLAWSCAN.md:3
Finding: Security Documentation Incorrectly Describes the Skill as Read-Only
Content: View full analysis
.py` and parse the JSON. ``` ```markdown - `blood_panel_import.py --watch-dir ` — parses dropped lab PDFs / text into `blood_panels` + `blood_markers` (reference-range flags included). - `supplement_import.py --watch-dir ` — imports a `date,supplement,dose_mg,...` CSV/JSON into `supplement_log`, auto-creating unknown supplements. ``` ```markdown biohub log-measurement biohub log-phase start "" biohub log-phase end "" ``` ```markdown python3 -m adapters.apple_health.receiver ``` ```markdown Store health insights in a workspace-local `memory/` directory. ``` ### Technical Analysis `CLAWSCAN.md` states that every instructed action is a SQLite `SELECT` and that the skill involves no dynamic execution or writes. The operative skill instructions have a materially broader surface: - Python scripts are executed. - Importers write parsed data into database tables. - CLI commands create measurements and tracking phases. - A local HTTP receiver can be started and optionally exposed to the LAN. - Health insights may be written to a workspace memory directory. - Device connection and synchronization commands invoke external adapter behavior. Although some implementation details reside in separate Biohub software, the skill explicitly directs or recommends these actions. Describing the complete i ...[truncated 1567 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The invocation guidance is broad enough to match generic wellness check-ins like 'How am I doing in general?' and 'Give me a status check,' which can cause the skill to activate in contexts where the user did not explicitly intend to grant access to highly sensitive biometric and health data. Because this skill aggregates especially sensitive information such as blood panels, glucose data, supplements, and body composition, over-triggering increases the risk of unnecessary exposure and processing of private health data.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.