Security audit
Security checks for vulnerabilities and agentic risk
This Hevy skill is mainly a workout API CLI, but its query-only description understates commands that can change data in the user's Hevy account.
Review before installing if you expected a read-only workout lookup tool. This skill can read Hevy workout history and can also create or update routines, folders, and custom exercises when those commands are invoked; use it only if you are comfortable giving the agent that level of account access through HEVY_API_KEY.
The documented request structures and endpoints include mutation flows beyond simple data retrieval, contradicting the stated read-oriented purpose. In agent settings, such hidden or under-emphasized write capability can bypass user expectations and policy constraints, resulting in unauthorized account changes.
The documented request structures and endpoints include mutation flows beyond simple data retrieval, contradicting the stated read-oriented purpose. In agent settings, such hidden or under-emphasized write capability can bypass user expectations and policy constraints, resulting in unauthorized account changes.
The documented request structures and endpoints include mutation flows beyond simple data retrieval, contradicting the stated read-oriented purpose. In agent settings, such hidden or under-emphasized write capability can bypass user expectations and policy constraints, resulting in unauthorized account changes.
The documented request structures and endpoints include mutation flows beyond simple data retrieval, contradicting the stated read-oriented purpose. In agent settings, such hidden or under-emphasized write capability can bypass user expectations and policy constraints, resulting in unauthorized account changes.
The documented request structures and endpoints include mutation flows beyond simple data retrieval, contradicting the stated read-oriented purpose. In agent settings, such hidden or under-emphasized write capability can bypass user expectations and policy constraints, resulting in unauthorized account changes.
The documented request structures and endpoints include mutation flows beyond simple data retrieval, contradicting the stated read-oriented purpose. In agent settings, such hidden or under-emphasized write capability can bypass user expectations and policy constraints, resulting in unauthorized account changes.
The documented request structures and endpoints include mutation flows beyond simple data retrieval, contradicting the stated read-oriented purpose. In agent settings, such hidden or under-emphasized write capability can bypass user expectations and policy constraints, resulting in unauthorized account changes.
The skill metadata says it should be used to query workout data, but the API surface includes write-capable methods that can create and modify workouts, routines, folders, and exercise templates. This creates a capability mismatch that can lead to unauthorized state-changing actions if the agent invokes these methods based on ambiguous prompts or prompt-injection, especially because fitness records are user data stored in an external service.
The skill metadata says it is for querying workout data, but the client exposes state-changing methods to create and update workouts, routines, routine folders, and exercise templates. In an agent context, this expands capability beyond the declared user expectation and can lead to unauthorized or accidental modification of sensitive fitness data if higher-level tooling invokes these methods.
The skill metadata says this capability is for querying workout data, but the CLI also exposes write operations that create and update routines, folders, and custom exercises. In an agent setting, this scope mismatch is dangerous because a caller, reviewer, or policy layer may treat the skill as read-only while it can actually modify user data, enabling unintended state changes or abuse if invoked by mistake or via prompt manipulation.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
*/
const ENV_VAR_NAME = "HEVY_API_KEY";
/**
* Get API key from environment variable
*/
export function getApiKey() {
return process.env[ENV_VAR_NAME] ?? null;
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
*/
const ENV_VAR_NAME = "HEVY_API_KEY";
/**
* Get API key from environment variable
*/
export function getApiKey() {
return process.env[ENV_VAR_NAME] ?? null;
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
*/
const ENV_VAR_NAME = "HEVY_API_KEY";
/**
* Get API key from environment variable
*/
export function getApiKey() {
return process.env[ENV_VAR_NAME] ?? null;
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
*/
const ENV_VAR_NAME = "HEVY_API_KEY";
/**
* Get API key from environment variable
*/
export function getApiKey() {
return process.env[ENV_VAR_NAME] ?? null;
The skill metadata says it is for querying workout data, but the client exposes multiple write-capable methods that create or update workouts, routines, folders, and exercise templates. In an agent setting, this scope mismatch is dangerous because downstream tools or prompts may invoke mutating operations a user did not expect, leading to unauthorized changes to fitness records or account content.
The skill metadata describes a read-only/query capability for workout data, but the CLI also exposes state-changing operations to create and update routines, folders, and custom exercises. In an agent setting, this expands authority beyond user expectations and can enable unintended modification of account data if the agent selects or invokes this skill based on the manifest alone.
The skill declares no explicit tool scope or permission boundaries even though it requires environment credential access and network/API connectivity. In an agent environment, missing scope declarations can allow broader-than-expected execution and make it harder to enforce least privilege or audit what the skill is allowed to do.
The documentation section exposes creation and update operations even though the skill is presented at the manifest level as a query-only data access tool. This inconsistency increases the chance that users, reviewers, or calling agents will underestimate the skill's ability to alter user data.
Claiming the CLI focuses on read operations while also documenting multiple write operations can create a false sense of safety. Even if writes are fewer than reads, the presence of mutation capability is security-relevant and should be disclosed unambiguously.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
* Hevy API Client
*
* REST client for the Hevy workout tracking API.
* Docs: https://api.hevyapp.com/docs/
*/
const BASE_URL = "https://api.hevyapp.com";
export class HevyClient {
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
* Hevy API Client
*
* REST client for the Hevy workout tracking API.
* Docs: https://api.hevyapp.com/docs/
*/
const BASE_URL = "https://api.hevyapp.com";
export class HevyClient {
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
* Hevy API Client
*
* REST client for the Hevy workout tracking API.
* Docs: https://api.hevyapp.com/docs/
*/
const BASE_URL = "https://api.hevyapp.com";
export class HevyClient {
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
* Hevy API Client
*
* REST client for the Hevy workout tracking API.
* Docs: https://api.hevyapp.com/docs/
*/
const BASE_URL = "https://api.hevyapp.com";
export class HevyClient {
The manifest describes the skill as querying workout data, routines, exercises, and history, which implies read-oriented access. This file defines request bodies for creating workouts, routines, routine folders, exercise templates, and updating routines, indicating write capabilities beyond the stated query scope.
The shared request method sends authenticated HTTP requests using the API key to a third-party service, which can transmit user workout data and account-related information. While the file has developer-oriented comments about the API client, it does not provide any user-facing warning, confirmation, or disclosure about network transmission of user data.
No suspicious patterns detected.