The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The installation instructions require the user to execute sudo mv ghealth /usr/local/bin/. Using sudo to move a newly built binary into system-wide executable paths is a privilege escalation finding as it grants the software root-level residency on the system.
[EXTERNAL_DOWNLOADS]: The skill instructs the user to git clone and build code from https://github.com/Google-Health-API/google-health-cli.git. This organization name mimics an official Google entity but is not associated with the verified 'google' or 'google-health' organizations on GitHub. This represents a significant supply chain risk through impersonation of a well-known vendor.
[DATA_EXFILTRATION]: The 'Moving Tokens Between Machines' section instructs users to run ghealth auth export > /tmp/ghealth-creds.json. On most Unix-like systems, the /tmp directory is world-readable, meaning any other user or malicious process on the system could read the exported OAuth access and refresh tokens, leading to full account compromise.
[INDIRECT_PROMPT_INJECTION]: The skill processes highly sensitive health data (e.g., exercise notes, sleep stage descriptions) from the Google Health API which may contain attacker-controlled strings.
Ingestion points: Data retrieved via ghealth data exercise list and ghealth data sleep list (specifically fields like notes).
Boundary markers: None; the instructions show raw JSON data being piped directly into jq for analysis without delimiters or sanitization warnings.
Capability inventory: The skill has capabilities to write files (--output), export data, and perform network operations via the Google Health API.
Sanitization: There is no evidence of sanitization or escaping of the health data before it is presented to the agent for summarization or calculation.

google-health-cli