Security audit

Rowing Machine Buying Consultant

Security checks for vulnerabilities and agentic risk

Overview

This is an instruction-only rowing machine buying guide that asks relevant shopping questions and does not include code, persistence, credential access, or hidden behavior.

Reasonable to install if you are comfortable sharing approximate body measurements and household setup details needed for a purchase recommendation. Because product availability, specifications, pricing, and subscriptions can change, verify any suggested model with the manufacturer or authorized retailer before buying.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (10)

Whitespace Padding

Medium

Category: Prompt Injection
Content: ### R1 — Technical Specifications | Spec | What It Measures | Standard Range | Why It Matters | Listing Label | | --------------------------------- | --------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------- | | Resistance Type | The mechanism that creates pulling resistance | Air, water, magnetic, electromagnetic, hydraulic piston | Determines workout feel, noise level, maintenance needs, and suitability for training vs casual use | "air resistance", "water resistance", "magnetic resistance", "electromagnetic", "hydraulic" | | Resistance Levels | Number of distinct resistance settings | Air: infinite (damper 1–10); Water: variable by water volume; Magnetic/Electromagnetic: 8–20 levels; Hydraulic: 2–12 levels | Determines workout variety and ability to match exertion to fitness level | "resistance levels", "damper setting", "water level" |
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

Category: Prompt Injection
Content: ### R1 — Technical Specifications | Spec | What It Measures | Standard Range | Why It Matters | Listing Label | | --------------------------------- | --------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------- | | Resistance Type | The mechanism that creates pulling resistance | Air, water, magnetic, electromagnetic, hydraulic piston | Determines workout feel, noise level, maintenance needs, and suitability for training vs casual use | "air resistance", "water resistance", "magnetic resistance", "electromagnetic", "hydraulic" | | Resistance Levels | Number of distinct resistance settings | Air: infinite (damper 1–10); Water: variable by water volume; Magnetic/Electromagnetic: 8–20 levels; Hydraulic: 2–12 levels | Determines workout variety and ability to match exertion to fitness level | "resistance levels", "damper setting", "water level" |
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

Category: Prompt Injection
Content: | --------------------------------- | --------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------- | | Resistance Type | The mechanism that creates pulling resistance | Air, water, magnetic, electromagnetic, hydraulic piston | Determines workout feel, noise level, maintenance needs, and suitability for training vs casual use | "air resistance", "water resistance", "magnetic resistance", "electromagnetic", "hydraulic" | | Resistance Levels | Number of distinct resistance settings | Air: infinite (damper 1–10); Water: variable by water volume; Magnetic/Electromagnetic: 8–20 levels; Hydraulic: 2–12 levels | Determines workout variety and ability to match exertion to fitness level | "resistance levels", "damper setting", "water level" | | Drive Mechanism | How force transfers from handle to flywheel | Chain, belt, or strap | Chain is the competition standard (Concept2); belt/strap is quieter and requires less maintenance; both are durable in quality machines | "chain drive", "belt drive", "strap drive" | | Seat Rail Length | The travel distance of the seat on its track | ~54"–60"+ effective stroke travel | Limits the l ...[truncated 26 chars]
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

Category: Prompt Injection
Content: | Resistance Type | The mechanism that creates pulling resistance | Air, water, magnetic, electromagnetic, hydraulic piston | Determines workout feel, noise level, maintenance needs, and suitability for training vs casual use | "air resistance", "water resistance", "magnetic resistance", "electromagnetic", "hydraulic" | | Resistance Levels | Number of distinct resistance settings | Air: infinite (damper 1–10); Water: variable by water volume; Magnetic/Electromagnetic: 8–20 levels; Hydraulic: 2–12 levels | Determines workout variety and ability to match exertion to fitness level | "resistance levels", "damper setting", "water level" | | Drive Mechanism | How force transfers from handle to flywheel | Chain, belt, or strap | Chain is the competition standard (Concept2); belt/strap is quieter and requires less maintenance; both are durable in quality machines | "chain drive", "belt drive", "strap drive" | | Seat Rail Length | The travel distance of the seat on its track | ~54"–60"+ effective stroke travel | Limits the leg extension of tall users; the single most common fit issue for users above 6'3" (190 cm) | "rail length", "seat travel", "stroke length" | | Maximum User Weight | Maximum supported weight | 250–500 lb (113–227 kg) | Safety-criti ...[truncated 26 chars]
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

Category: Prompt Injection
Content: | Resistance Levels | Number of distinct resistance settings | Air: infinite (damper 1–10); Water: variable by water volume; Magnetic/Electromagnetic: 8–20 levels; Hydraulic: 2–12 levels | Determines workout variety and ability to match exertion to fitness level | "resistance levels", "damper setting", "water level" | | Drive Mechanism | How force transfers from handle to flywheel | Chain, belt, or strap | Chain is the competition standard (Concept2); belt/strap is quieter and requires less maintenance; both are durable in quality machines | "chain drive", "belt drive", "strap drive" | | Seat Rail Length | The travel distance of the seat on its track | ~54"–60"+ effective stroke travel | Limits the leg extension of tall users; the single most common fit issue for users above 6'3" (190 cm) | "rail length", "seat travel", "stroke length" | | Maximum User Weight | Maximum supported weight | 250–500 lb (113–227 kg) | Safety-critical; underrated frames flex and wear unevenly under heavy users | "max user weight", "weight capacity", "weight limit" | | Flywheel / Resistance Unit Weight | Mass of the rotating element (air/magnetic) | 6–20 kg typical | Heavier flyw ...[truncated 26 chars]
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

Category: Prompt Injection
Content: | Drive Mechanism | How force transfers from handle to flywheel | Chain, belt, or strap | Chain is the competition standard (Concept2); belt/strap is quieter and requires less maintenance; both are durable in quality machines | "chain drive", "belt drive", "strap drive" | | Seat Rail Length | The travel distance of the seat on its track | ~54"–60"+ effective stroke travel | Limits the leg extension of tall users; the single most common fit issue for users above 6'3" (190 cm) | "rail length", "seat travel", "stroke length" | | Maximum User Weight | Maximum supported weight | 250–500 lb (113–227 kg) | Safety-critical; underrated frames flex and wear unevenly under heavy users | "max user weight", "weight capacity", "weight limit" | | Flywheel / Resistance Unit Weight | Mass of the rotating element (air/magnetic) | 6–20 kg typical | Heavier flywheel produces a smoother, more inertia-rich stroke feel; light flywheels can feel jerky at high stroke rates | "flywheel weight" (rarely listed prominently; check reviews and spec sheets) | | Noise Level | Sound output during normal use | Air: ~75–85 dB; Water: ~60–70 dB (distinctive whoosh); Magnetic/Electromagnetic: ~45–60 dB; Hydraulic: ~50–65 dB | Apartment re ...[truncated 26 chars]
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

Category: Prompt Injection
Content: | Drive Mechanism | How force transfers from handle to flywheel | Chain, belt, or strap | Chain is the competition standard (Concept2); belt/strap is quieter and requires less maintenance; both are durable in quality machines | "chain drive", "belt drive", "strap drive" | | Seat Rail Length | The travel distance of the seat on its track | ~54"–60"+ effective stroke travel | Limits the leg extension of tall users; the single most common fit issue for users above 6'3" (190 cm) | "rail length", "seat travel", "stroke length" | | Maximum User Weight | Maximum supported weight | 250–500 lb (113–227 kg) | Safety-critical; underrated frames flex and wear unevenly under heavy users | "max user weight", "weight capacity", "weight limit" | | Flywheel / Resistance Unit Weight | Mass of the rotating element (air/magnetic) | 6–20 kg typical | Heavier flywheel produces a smoother, more inertia-rich stroke feel; light flywheels can feel jerky at high stroke rates | "flywheel weight" (rarely listed prominently; check reviews and spec sheets) | | Noise Level | Sound output during normal use | Air: ~75–85 dB; Water: ~60–70 dB (distinctive whoosh); Magnetic/Electromagnetic: ~45–60 dB; Hydraulic: ~50–65 dB | Apartment re ...[truncated 26 chars]
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

Category: Prompt Injection
Content: | Flywheel / Resistance Unit Weight | Mass of the rotating element (air/magnetic) | 6–20 kg typical | Heavier flywheel produces a smoother, more inertia-rich stroke feel; light flywheels can feel jerky at high stroke rates | "flywheel weight" (rarely listed prominently; check reviews and spec sheets) | | Noise Level | Sound output during normal use | Air: ~75–85 dB; Water: ~60–70 dB (distinctive whoosh); Magnetic/Electromagnetic: ~45–60 dB; Hydraulic: ~50–65 dB | Apartment residents, early-morning users, and shared-floor households need quieter resistance types | Rarely listed as dB; check resistance type as proxy | | Performance Monitor | Console tracking and feedback quality | Basic LCD (time, SPM, distance, calories) to advanced PM5-class (split time, watts, pace, drag factor) | Determines training data quality; the Concept2 PM5 is the worldwide standard for competitive and serious training use | "PM5", "performance monitor", "console", "display" | | Assembled Dimensions | Footprint during use (L × W) | Typically 95"–108" long × 20"–24" wide | Machine must fit in the room with adequate stroke clearance; length ≠ stroke space requirement | "assembled dimensions", "product dimensions" | | Folded / Storage Dimensions | Footprint when stored | Varies; most quality rowers fold vertically or on end | Determines w ...[truncated 26 chars]
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

Category: Prompt Injection
Content: | Flywheel / Resistance Unit Weight | Mass of the rotating element (air/magnetic) | 6–20 kg typical | Heavier flywheel produces a smoother, more inertia-rich stroke feel; light flywheels can feel jerky at high stroke rates | "flywheel weight" (rarely listed prominently; check reviews and spec sheets) | | Noise Level | Sound output during normal use | Air: ~75–85 dB; Water: ~60–70 dB (distinctive whoosh); Magnetic/Electromagnetic: ~45–60 dB; Hydraulic: ~50–65 dB | Apartment residents, early-morning users, and shared-floor households need quieter resistance types | Rarely listed as dB; check resistance type as proxy | | Performance Monitor | Console tracking and feedback quality | Basic LCD (time, SPM, distance, calories) to advanced PM5-class (split time, watts, pace, drag factor) | Determines training data quality; the Concept2 PM5 is the worldwide standard for competitive and serious training use | "PM5", "performance monitor", "console", "display" | | Assembled Dimensions | Footprint during use (L × W) | Typically 95"–108" long × 20"–24" wide | Machine must fit in the room with adequate stroke clearance; length ≠ stroke space requirement | "assembled dimensions", "product dimensions" | | Folded / Storage Dimensions | Footprint when stored | Varies; most quality rowers fold vertically or on end | Determines w ...[truncated 26 chars]
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

Category: Prompt Injection
Content: ### R2 — Factors That Determine Required Specs | Factor | Affected Spec(s) | Direction of Effect | | ------------------------------------------------------------------------------------ | ------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | User height / inseam length | Seat rail length | Users above ~6'3" (190 cm) or with inseam >34" need long-rail or extended-rail models; standard 54" rails may restrict full leg extension | | User body weight | Weight capacity | Required capacity ≥ user weight × 1.25; heavier users also stress bearings and the seat carriage more under high stroke rates |
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Static analysis

No suspicious patterns detected.