ClawHub
Back to skill

Security audit

Apple Health → OpenClaw

Security checks for vulnerabilities and agentic risk

Overview

The skill’s Apple Health syncing purpose is coherent, but it under-discloses high-impact handling of gateway tokens, network exposure, and persistent health data.

Review this before installing if the OpenClaw gateway is reachable beyond your own machine or trusted LAN. Do not share setup QR codes, raw JSON, screenshots, or terminal logs, because they can contain a live gateway token. Prefer HTTPS, VPN, or a trusted tunnel for any remote/VPS use, avoid opening port 18789 broadly, install dependencies yourself in an isolated environment, and restrict permissions on ~/.apple-health-sync because it stores sensitive health data.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/setup.py:153
Finding

Gateway Bearer Token Provisioned for Plaintext HTTP Connections

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/setup.py:198
Finding

Complete Gateway Bearer Token Disclosed Through QR Code and Terminal Output

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
scripts/setup.py:121
Finding

Automatic Installation of an Unpinned Package from the Active Pip Index

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/ingest.py:227
Finding

Owner-Only Permissions Are Not Enforced for the Sensitive Health Database

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (21)

Tp4

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding

A second description-behavior mismatch is present: the skill markets itself as an end-to-end Apple Health sync mechanism, yet the visible commands only read provided input and local state. Such overclaiming can mislead operators into exposing services or trusting data-handling paths that are not transparently implemented.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

A second description-behavior mismatch is present: the skill markets itself as an end-to-end Apple Health sync mechanism, yet the visible commands only read provided input and local state. Such overclaiming can mislead operators into exposing services or trusting data-handling paths that are not transparently implemented.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
94% confidence
Finding

The setup flow states that it reads a gateway bearer token automatically and emits a QR code or raw JSON for manual entry, but it does not require or prominently present a warning that these materials contain connectivity and authentication details. If the QR code, terminal output, screenshots, logs, or copied JSON are exposed, an attacker could gain unauthorized access to the gateway or associated health-data channel.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill invokes Python scripts for setup, ingest, and query, and those workflows imply shell execution, file/database access, and network exposure, but the manifest does not declare any tool restrictions or permissions. This weakens reviewability and containment because a host may grant broader capabilities than users or operators expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill instructs users to open TCP port 18789 and even provides firewall commands, but it does not explain the security implications of exposing a service to the LAN or internet. In context, this could expose a health-data ingestion or gateway endpoint to unauthorized probing, abuse, or token theft if access controls are weak.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

text
# Linux iptables
sudo iptables -A INPUT -p tcp --dport 18789 -j ACCEPT

# Ubuntu ufw
sudo ufw allow 18789/tcp

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

text
# Linux iptables
sudo iptables -A INPUT -p tcp --dport 18789 -j ACCEPT

# Ubuntu ufw
sudo ufw allow 18789/tcp

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The trigger for health queries is broad enough to activate on ordinary health-related conversation, potentially causing the agent to access or summarize sensitive biometric data without sufficiently clear user intent. In a health-data skill, overbroad activation increases privacy risk because the underlying data is highly sensitive even if the action is read-only.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The instruction to format query output naturally in Chinese imposes a fixed language requirement. The file does not offer a user opt-in or explain a justified region-specific constraint, so this conflicts with the language-choice policy.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
91% confidence
Finding

The rule to auto-ingest incoming health data without confirmation enables autonomous processing of highly sensitive biometric information. In this context, even if triggered by a recognizable prefix, skipping confirmation increases the chance of ingesting spoofed, misrouted, or unintended data and storing it persistently without informed user approval.

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

md
## Rules

1. Auto-ingest first, acknowledge second — no confirmation prompts on incoming data.
2. Never fabricate data — only report what's in the database.
3. All responses in Chinese.
4. Never expose the bearer token to the user.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

This rule explicitly requires every response to be in Chinese. Because no language preference choice or justified locale limitation is provided, it constitutes a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The parsing logic only accepts messages containing a Chinese header variant and then extracts fields using Chinese labels like "类型：" and "时间：". This effectively hard-codes a specific language/locale behavior without user opt-in or an explicitly documented regional constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script hardcodes Chinese period labels and later emits Chinese-language messages and metric names, which imposes a specific language on all users. There is no opt-in, locale selection, or documented justification that this skill is intended only for Chinese-speaking or region-specific use.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Multiple user-facing strings throughout the script are hard-coded in Chinese, including errors, warnings, status messages, and CLI help text. This enforces a specific language for all users without opt-in or justification, which matches the language/locale policy-violation category.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The script launches or restarts the external OpenClaw gateway automatically, which changes system and network state as a side effect of generating a pairing QR code. Because the QR payload includes the gateway URL and token, automatically exposing or restarting a network service can increase the chance of unintended remote accessibility, especially on VPS hosts.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/setup.py (reported line 82)May include surrounding context.

python
"""Start/restart gateway in the specified bind mode."""
    print(f"→ 启动 OpenClaw gateway（bind={bind_mode}）...", flush=True)
    try:
        subprocess.Popen(
            ["openclaw", "gateway", "--bind", bind_mode, "--force"],
            stdout=subprocess.DEVNULL,
            stderr=subprocess.DEVNULL,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/setup.py (reported line 99)May include surrounding context.

python
# Try qrencode (brew/apt install qrencode)
    for mode in (["ansiutf8"] if not compact else ["ansi"]):
        try:
            result = subprocess.run(
                ["qrencode", "-t", mode, "-m", "1", data],
                capture_output=True, text=True
            )

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

A setup script that silently installs packages via pip performs privileged environment modification and can pull executable code from external repositories during a routine pairing flow. In the context of a security-sensitive tool that reads a gateway token and prepares network access, this makes the behavior more dangerous because users may run it on trusted hosts expecting only local configuration output.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
95% confidence
Finding

The setup script automatically installs a Python package at runtime via pip, which introduces unreviewed code into the environment and creates package-management side effects beyond simple QR setup. This expands the supply-chain attack surface and can execute arbitrary install-time code from dependency packages if the package source or dependency resolution is compromised.

Content

Scanner excerpt · scripts/setup.py (reported line 123)May include surrounding context.

python
# Auto-install and retry
    print("→ 正在安装 qrcode 库...", flush=True)
    try:
        subprocess.run(
            [sys.executable, "-m", "pip", "install", "qrcode", "-q"],
            check=True, capture_output=True
        )

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/setup.py (reported line 138)May include surrounding context.

python
def firewall_hint(ip: str, port: int):
    print(f"\n⚠️  VPS 防火墙配置（如果手机无法连接）：")
    print(f"   Linux iptables:  sudo iptables -A INPUT -p tcp --dport {port} -j ACCEPT")
    print(f"   Ubuntu ufw:      sudo ufw allow {port}/tcp")
    print(f"   Oracle Cloud:    控制台 → VCN → Security List → 添加入站规则 TCP {port}")
    print(f"   确认后可用以下命令测试连通性（在另一台机器上）：")

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/setup.py (reported line 139)May include surrounding context.

python
def firewall_hint(ip: str, port: int):
    print(f"\n⚠️  VPS 防火墙配置（如果手机无法连接）：")
    print(f"   Linux iptables:  sudo iptables -A INPUT -p tcp --dport {port} -j ACCEPT")
    print(f"   Ubuntu ufw:      sudo ufw allow {port}/tcp")
    print(f"   Oracle Cloud:    控制台 → VCN → Security List → 添加入站规则 TCP {port}")
    print(f"   确认后可用以下命令测试连通性（在另一台机器上）：")

Static analysis

No suspicious patterns detected.