Apple Health Skill Free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:18 AM UTC
• Version: 1.0.2

Overview

This health-data skill is not clearly malicious, but it asks for broad local file and command powers and routes itself to unrelated security tasks, so it needs review before use.

Install only after confirming the skill is limited to explicit health and training-data requests, that local read/write/exec access is removed or tightly constrained, and that you understand what health data and API keys may be sent to the external service.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:14

Finding

Excessive and Unrelated Agent Capabilities Violate Least Privilege

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:14-17, with supporting behavior declarations at SKILL.md:198 and SKILL.md:257-259
Vulnerability Type: Excessive tool permissions and overbroad activation scope
Risk Level: Medium

Vulnerable Code

yaml

tools:
- read
- exec
- write

Supporting declarations translated from the original Skill text:

text

Trigger condition: automatically activate when the user needs to process Security-related tasks

text

- File processing: supports reading, parsing, and writing multiple file formats
- Command execution: executes system commands in a secure sandbox and collects results

Technical Analysis

The Skill's stated purpose is to retrieve workout plans, workout records, and athlete profiles through HTTPS API calls. This functionality does not inherently require arbitrary local file reads, file writes, or operating-system command execution.

Nevertheless, the Skill requests read, write, and exec capabilities and advertises generic file-processing and command-execution behavior. It also defines an unrelated activation condition for Security tasks. These declarations unnecessarily expand both the available privilege set and the contexts in which the Skill may become active.

The document mentions command allowlisting and sandbox testing as recommended precautions, but it does not define an enforceable command allowlist, permitted argument schema, filesystem boundary, or restricted execution policy. Consequently, the declared permission model does not demonstrate least privilege.

The project contains only SKILL.md, so no concrete command-construction implementation or active exploit payload was found. Exploitation therefore depends on how the host Agent interprets and grants the declared tools.

Attack Path

1. A user invokes the Skill for health-data processing, or an unrelated Security-related request activates it under the broad trigger.
2. The Skill operates with ac ...[truncated 1353 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove read, write, and exec unless each capability is demonstrably necessary for a documented health-data workflow.
2. Replace general-purpose tools with a narrowly scoped HTTP capability restricted to:
   • HTTPS only.
   • The verified health-service origin.
   • Explicitly approved API routes.
   • Required HTTP methods only.
3. Remove the unrelated automatic activation rule for Security tasks. Limit activation to explicit requests for workout plans, workout history, or athlete-profile retrieval.
4. If local file access is necessary, enforce:
   • A dedicated application-owned directory.
   • Canonical-path validation.
   • Denial of symbolic-link traversal.
   • Read-only access wherever possible.
5. If command execution is unavoidable, enforce:
   • A fixed executable allowlist.
   • Structured argument arrays rather than shell strings.
   • Rejection of shell metacharacters and user-controlled executable paths.
   • Minimal environment-variable exposure.
   • A non-privileged, network-restricted sandbox.
6. Ensure the host denies undeclared or out-of-scope tool calls independently of natural-language instructions.
7. Add tests confirming that health-task input cannot trigger arbitrary filesystem access or command execution.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill handles sensitive health and fitness records but does not clearly warn users that their health data may be accessed and transmitted to an external service. Without an explicit privacy notice, consent boundary, and data-handling warning, users and agents may send protected or sensitive information off-platform without understanding the exposure.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The free-edition manifest claims users can 'chat with sports health data using AI' while later sections explicitly say AI coach/chat features are unavailable in the free version. This inconsistency can mislead users or calling agents into invoking unsupported capabilities, causing unintended data handling or trust in functionality that does not actually exist.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill is described as a sports-health data tool, but the application scenarios and trigger conditions say it activates for 'Security' tasks. In an agent ecosystem, this domain mismatch can cause the skill to be selected in unrelated security-sensitive contexts, unnecessarily exposing health-data APIs, exec/write capabilities, or confusing operators about the skill’s real purpose.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger condition states the skill should auto-activate whenever a user needs 'Security' tasks, which is both overly broad and unrelated to sports health. Overbroad routing increases the chance of accidental invocation in sensitive workflows, potentially granting an irrelevant skill access to data, command execution, or user trust it should not receive.

Content

No source excerpt is available for this finding.