Samsung Health

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:43 PM UTC
• Version: 1.0.1

Overview

This skill is meant to analyze Samsung Health data, but it installs mutable external code and works with very sensitive health records without enough privacy or supply-chain safeguards.

Review this before installing. Only use it on a trusted machine and with a Google account/folder you are comfortable exposing to the downloaded CLI. Prefer a pinned commit or reviewed release instead of the current default-branch clone, and confirm where downloaded health archives and parsed data are stored and how to delete them.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: SKILL.md:10

Finding

Unpinned Remote Repository Is Retrieved and Installed as Executable Code

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10–17
Vulnerability Type: T03: Remote Payload Retrieval and Execution
Risk Level: Medium

The Skill retrieves the default branch of an external GitHub repository and immediately installs it as an editable Python package. The retrieved source is not pinned to a reviewed commit or verified using a cryptographic checksum or signature.

Complete vulnerable code snippet:

yaml

install:
  - id: clone
    kind: shell
    label: "Clone repository"
    command: "git clone https://github.com/mudgesbot/samsung-health-skill.git"
  - id: venv
    kind: shell
    label: "Create virtualenv and install"
    command: "cd samsung-health-skill && python3 -m venv .venv && source .venv/bin/activate && pip install -e ."

Equivalent installation instructions are repeated at SKILL.md, lines 31–37:

bash

cd /path/to/workspace/projects
git clone https://github.com/mudgesbot/samsung-health-skill.git
cd samsung-health-skill
python3 -m venv .venv
source .venv/bin/activate
pip install -e .

Technical Analysis

A plain git clone retrieves whichever revision is currently referenced by the remote repository's default branch. Because no immutable commit hash or verified release artifact is specified, the effective code can change after this Skill has been reviewed.

The subsequent pip install -e . treats the downloaded repository as a Python package. Package installation may invoke attacker-controlled build backend, packaging, or setup logic. Creating a virtual environment limits where Python packages are installed, but it does not sandbox installation-time code; such code still runs with the invoking user's operating-system privileges.

The remote implementation is not included in the audited artifact, so this audit cannot confirm that it is malicious or assess its internal dependency handling. The vulnerability is ...[truncated 1517 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the repository to an immutable, reviewed commit hash rather than cloning and installing the current default branch.
2. Fetch the pinned revision explicitly and verify that the checked-out commit exactly matches the approved value before installation.
3. Prefer a versioned release artifact with a published SHA-256 checksum or a cryptographically verified signature.
4. Vendor the reviewed source into the Skill package when feasible so that the audited artifact contains the code that will execute.
5. Replace editable installation with a reproducible, non-editable installation process.
6. Pin all direct and transitive Python dependencies and verify package hashes using a lock file or pip --require-hashes.
7. Review the repository's build-system configuration and installation hooks before approval.
8. Perform installation and health-data processing in an isolated environment with minimal filesystem, credential, and network access.
9. Avoid exposing unrelated Google credentials or sensitive files to the installation process, and grant only the minimum Drive permissions required for the declared operation.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md

command: "git clone https://github.com/mudgesbot/samsung-health-skill.git"
      - id: venv
        kind: shell
        label: "Create virtualenv and install"
        command: "cd samsung-health-skill && python3 -m venv .venv && source .venv/bin/activate && pip install -e ."
---

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill handles highly sensitive health data and instructs users to configure a Google account and folder for downloading Health Connect archives, but it does not clearly warn that protected health information will be pulled from Google Drive and stored/processed locally. This can lead users to expose regulated or private data without informed consent, especially on shared or insufficiently secured systems.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.