ClawHub
Back to skill

Security audit

健康数据助手免费版

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-aligned for Apple Health queries, but it handles sensitive health data and API keys with under-disclosed external transmission and unsafe plaintext storage examples.

Review this skill carefully before installing. Use it only if you are comfortable sending Apple Health-derived questions and data to Transition, avoid saving long-lived API keys in shell startup files, do not cache health responses in plaintext, and narrow use to explicit Apple Health requests.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:125
Finding

API Key Persisted in Plaintext Configuration Files

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 125–128 and 269–276
Vulnerability Type: Plaintext credential storage
Risk Level: Medium

Vulnerable Code

bash
export TRANSITION_API_KEY="your_api_key_here"

The documentation then recommends adding this command to ~/.bashrc or ~/.zshrc for persistence.

A second documented configuration method also stores the credential in plaintext:

bash
# Method 1: Environment variable (recommended)
export TRANSITION_API_KEY="sk_your_key_here"
# ...
# Method 2: Configuration file
cat > ~/.apple-health.env << 'EOF'
TRANSITION_API_KEY=sk_your_key_here
EOF
# ...
source ~/.apple-health.env

Technical Analysis

The Skill recommends persisting the Transition API key in shell startup files or a plaintext environment file. It does not instruct the user to apply restrictive permissions to these files.

Shell startup files may be exposed through permissive home-directory permissions, system backups, diagnostic archives, support bundles, accidental synchronization, or unrelated local processes running under the same account. The documented cat command creates the environment file using the user's current umask; if that configuration permits group or world access, the credential may be readable by other local users.

Because the key authenticates requests to a service containing Apple Health information, disclosure could permit unauthorized access to endpoints available under the victim's Transition account. This issue does not itself grant operating-system privileges beyond those already held by an attacker capable of reading the file.

Attack Path

  1. A user follows the Skill and stores TRANSITION_API_KEY in ~/.bashrc, ~/.zshrc, or ~/.apple-health.env.
  2. The resulting file is retained in plaintext and may be created without explicitly restrictive permissions.
  3. An attacker obtains read access through a local account, ...[truncated 795 chars]
Remediation
View remediation

Remediation Suggestions

  • Prefer an operating-system credential manager, such as macOS Keychain, Windows Credential Manager, or a Linux secret service.

  • Do not recommend storing long-lived credentials directly in .bashrc or .zshrc.

  • If file-based storage is unavoidable, create the file with restrictive permissions:

    bash
    umask 077
printf '%s\n' 'TRANSITION_API_KEY=replace_with_key' > ~/.apple-health.env
chmod 600 ~/.apple-health.env

  • Verify that the parent home directory is not accessible to untrusted local users.

  • Exclude credential files from source control, cloud synchronization, diagnostics, and unencrypted backups.

  • Avoid printing or logging the credential.

  • Document API-key revocation and rotation procedures.

  • Where supported, use narrowly scoped, short-lived credentials rather than a long-lived account key.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:217
Finding

Sensitive Health API Responses Cached in an Unencrypted File

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 217–226
Vulnerability Type: Plaintext storage of sensitive health data
Risk Level: Medium

Vulnerable Code

python
import json
from pathlib import Path
from datetime import datetime
# ...
CACHE_FILE = Path.home() / ".apple_health_cache.json"
# ...
def cache_response(key, data):
    cache = json.loads(CACHE_FILE.read_text()) if CACHE_FILE.exists() else {}
    cache[key] = {"data": data, "ts": datetime.now().isoformat()}
    CACHE_FILE.write_text(json.dumps(cache, ensure_ascii=False, indent=2))

Technical Analysis

The sample cache writes complete API response data to ~/.apple_health_cache.json as unencrypted JSON. It does not minimize the cached fields, apply explicit file permissions, define expiration behavior, securely delete old entries, or request user consent before retaining health information.

Path.write_text() uses the process environment and current permission context when creating the file. The sample therefore does not guarantee that only the account owner can read it. Even if local permissions are restrictive, plaintext data may subsequently enter backups, synchronization systems, endpoint indexing, or forensic artifacts.

The stored responses may contain workout history, heart-rate trends, activity information, or other health-related records returned by the API.

Attack Path

  1. A user runs an implementation based on the documented caching example.
  2. Health API responses are serialized in full to ~/.apple_health_cache.json.
  3. The file remains on disk without encryption, automatic expiration, or documented cleanup.
  4. An attacker obtains access through permissive local file permissions, a compromised process operating as the user, an exposed backup, cloud synchronization, or device theft.
  5. The attacker reads and parses the JSON file.
  6. The attacker obtains the cached health records and associated ...[truncated 408 chars]
Remediation
View remediation

Remediation Suggestions

  • Disable health-data caching by default and require explicit user consent before enabling it.
  • Cache only the minimum fields necessary for the intended feature.
  • Establish a short retention period and delete expired entries automatically.
  • Create the cache with owner-only permissions, for example mode 0600, and ensure its parent directory is private.
  • Use authenticated encryption for health data retained on disk, with encryption keys stored in an operating-system credential manager.
  • Prevent the cache from entering source control, cloud synchronization, diagnostic archives, or unencrypted backups.
  • Provide a documented command or application function that securely clears cached records.
  • Handle malformed or attacker-modified cache content safely and avoid trusting cached fields as commands or executable input.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (13)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill handles highly sensitive health data and sends requests to an external service, but it does not prominently warn users about privacy implications, data categories involved, retention, or third-party processing. Health data is especially sensitive, so missing consent and privacy disclosures materially increases the risk of users unintentionally transmitting regulated or intimate information.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The capability table explicitly marks '表现管理图 (PMC) | CTL/ATL/TSB 计算' as '不支持 (升级 PRO)'. Later, the '优秀实践' section instructs users to query /api/v1/performance/pmc and interpret TSB values, which directly contradicts the earlier limitation and could mislead users about what the free skill actually does.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The documentation describes export/save/modify/reset/import operations without warning that these actions may alter local files, cached health outputs, or configuration state. In an agent context with write/exec tools, omission of such warnings can lead users to approve actions that overwrite configs or persist sensitive health information locally without realizing it.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The capability keyword list includes many generic terms and fragmented phrases, making the activation surface too broad. Because the skill advertises read/exec/write tools and interacts with a third-party health API, an imprecise trigger increases the risk of invoking the skill in contexts where sensitive data should not be sent externally.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This example sends natural-language health questions plus an API credential to a third-party endpoint, which constitutes external transmission of sensitive health-related data. In the context of Apple Health integration, such prompts can reveal intimate medical, fitness, and behavioral information, making the transmission materially privacy-sensitive even if it is part of intended functionality.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

用户询问最近一周运动情况,助手汇总并给出建议.

bash
# 通过 AI 教练查询
curl -X POST -H "X-API-ref: $TRANSITION_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"message": "这周我做了几次运动?平均心率多少?"}' \
  "https://api.transition.fun/api/v1/coach/chat"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

curl -X POST -H "X-API-ref: $TRANSITION_API_KEY"
-H "Content-Type: application/json"
-d '{"message": "这周我做了几次运动?平均心率多少?"}'
"https://api.transition.fun/api/v1/coach/chat"

text

### 场景二: 训练计划生成

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

curl -X POST -H "X-API-ref: $TRANSITION_API_KEY"
-H "Content-Type: application/json"
-d '{"message": "这周我做了几次运动?平均心率多少?"}'
"https://api.transition.fun/api/v1/coach/chat"

text

### 场景二: 训练计划生成

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

curl -X POST -H "X-API-ref: $TRANSITION_API_KEY"
-H "Content-Type: application/json"
-d '{"message": "这周我做了几次运动?平均心率多少?"}'
"https://api.transition.fun/api/v1/coach/chat"

text

### 场景二: 训练计划生成

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This example sends a question about resting heart-rate trends to an external coaching endpoint using an API key, directly involving sensitive health information. Because the skill centers on personal health analytics, the context makes this especially dangerous from a privacy perspective if users are not clearly informed and consent is not explicit.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

curl -X POST -H "X-API-ref: $TRANSITION_API_KEY"
-H "Content-Type: application/json"
-d '{"message": "过去一个月静息心率变化趋势如何?"}'
"https://api.transition.fun/api/v1/coach/chat"

text

## 不适用场景

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger condition is overly broad ('use when data analysis, reporting, statistics, visualization are needed'), which can cause the skill to activate for unrelated requests. In a skill with exec/write capabilities and external API access, over-triggering increases the chance of unnecessary data transmission or unintended actions on user systems.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The profile test uses an API key against a third-party endpoint and can retrieve account/profile information, so it does involve external transmission and potential exposure of personal metadata. The risk is lower than detailed health-content queries but still meaningful because it encourages credentialed requests without emphasizing privacy and token-handling precautions.

Content

Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.

...

测试认证接口

curl -s -H "X-API-ref: $TRANSITION_API_KEY"
"https://api.transition.fun/api/v1/profile"

text

#

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

L154 在示例配置中直接将 language 设为 zh-CN，且全文均以中文呈现，没有说明这是可选默认值，也没有向用户提供语言/区域设置选择。根据语言/locale 政策，强制特定语言而无用户 opt-in 可能构成自然语言策略违规。

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The PMC/fatigue example transmits authenticated performance and recovery metrics to an external endpoint, which are sensitive health/fitness inferences. Such derived metrics can reveal training load and physical condition, and the surrounding documentation does not clearly warn users about the privacy impact of sending this data off-device.

Content

Scanner excerpt · SKILL.md (reported line 206)May include surrounding context.

在安排高强度训练前,先检查疲劳状态.

bash
curl -H "X-API-ref: $TRANSITION_API_KEY" \
  "https://api.transition.fun/api/v1/performance/pmc"

当 TSB 低于 -20 时,说明身体处于疲劳状态,建议安排恢复训练.