Security audit

Apple Health Skill

Security checks for vulnerabilities and agentic risk

Overview

This looks like a health-data API helper, but it needs Review because it handles sensitive health/profile/chat data while requesting broad command and file authority with limited safeguards.

Install only if you trust the health sync service and API endpoint. Treat outputs as sensitive health data, avoid callback URLs unless the destination is trusted, keep the API key private, and restrict exec/read/write permissions where your agent platform allows it.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The skill declares `exec` capability even though its documented purpose is health-data querying and analysis, which does not inherently require arbitrary shell access. In an agent environment, this materially expands the attack surface: prompts or downstream workflow logic could invoke system commands, enabling data exfiltration, local file access, or command abuse unrelated to the stated skill purpose.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The security section claims command execution is limited to a whitelist, but the file provides no technical mechanism, policy binding, or implementation details that would actually enforce such a restriction. This creates a dangerous false sense of safety around a skill that already exposes `exec`, increasing the chance that operators trust the skill with sensitive health data under incorrect assumptions.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The skill is designed to transmit and analyze sensitive health data, including training, heart rate, VO2 Max, and related personal metrics, yet it does not present a prominent privacy warning or explicit consent boundary near the core capability description. Health data is highly sensitive, so weak disclosure increases the risk of users unknowingly sending regulated or intimate personal information to an external service.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The documented `callback_url` parameter enables sending results to an external endpoint but does not warn users that outputs, potentially including sensitive health analysis, may be delivered off-platform. In practice, this can facilitate unintended exfiltration of personal data or SSRF-style abuse if arbitrary callback destinations are accepted by the implementation.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The profile and chat-history endpoints expose especially sensitive personal information, including historical conversations and athlete profile data, yet the documentation does not foreground this sensitivity or advise cautious handling. In a health-focused context, these endpoints can reveal intimate behavioral and medical-adjacent patterns, making under-disclosure materially risky.

Static analysis

No suspicious patterns detected.