Hevy

• Outcome: Review
• Latest audit: Jun 25, 2026 · 11:36 PM UTC
• Version: 0.2.1

Overview

This Hevy skill is useful for workout queries, but it can also make persistent changes to a Hevy account while being advertised mainly as query-focused.

Install only if you are comfortable giving the skill access to your Hevy account via HEVY_API_KEY and potentially allowing it to create or update routines, folders, custom exercises, and workout records. Treat it as read/write, not read-only, and require explicit user confirmation before running any create or update command.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill requires an API key and makes remote API calls, but the manifest does not clearly declare corresponding permissions or trust boundaries. This can mislead users or orchestration layers about the skill's access to secrets and networked data, reducing informed consent and weakening policy enforcement.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill is described as query-only, but the documentation exposes write operations that can create or modify workouts, routines, folders, and exercises. This mismatch is dangerous because an agent or user may invoke the skill assuming it is read-only, while it can perform state-changing actions on the user's Hevy account.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The manifest language frames the skill as only querying workout data, while the body documents commands that create and update account resources. Security-relevant behavior hidden behind a benign description increases the chance of overbroad activation and unsafe autonomous use.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The documentation claims the CLI focuses on read operations, but it also provides first-class write commands and lists supported write endpoints. This inconsistency can cause reviewers and agents to underestimate the risk of account changes and use the skill without appropriate confirmation safeguards.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The skill metadata says it is for querying workout data, but the exposed client interface also supports creating and updating workouts, routines, folders, and exercise templates. This capability mismatch is dangerous because an agent or downstream caller could modify user fitness data despite users and policy expecting read-only behavior, enabling unauthorized state changes and integrity loss.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The skill metadata says it is for querying workout data, but the client exposes multiple state-changing methods that can create or update workouts, routines, folders, and exercise templates. In an agent setting, this is a capability mismatch that can lead to unauthorized or unexpected modification of a user's fitness data if the skill is invoked under read-only expectations.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill metadata says it is for querying workout data, but the CLI also exposes mutation operations including create-routine, create-folder, update-routine, and create-exercise. This capability mismatch is dangerous because an orchestrator or user may grant or invoke the skill assuming read-only access, while it can actually modify user data and create persistent objects in the Hevy account.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The skill is presented as a read/query tool for workout data, but this client also exposes write operations that can create or modify workouts, routines, folders, and exercise templates. That capability mismatch is dangerous because an agent or integrator may grant this skill broader trust than intended, leading to unauthorized state-changing actions against a user’s fitness account.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill metadata says it is for querying workout data, but this CLI also exposes state-changing operations including creating and updating routines, folders, and custom exercises. In an agent context, that mismatch is dangerous because a caller or orchestrating system may grant this skill broader trust than intended, leading to unauthorized modifications of a user's Hevy account from prompts that were expected to be read-only.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The activation description is broad enough to match many general fitness-related requests, which increases the chance the skill is invoked in contexts where the user did not expect external account access. Because the skill can reach remote personal workout data and includes write capabilities, overbroad triggering raises privacy and integrity risk.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The setup and usage describe an API key and remote account queries, but there is no explicit privacy or data-transmission warning. Users may not realize their workout history and related personal fitness data will be sent to or retrieved from a third-party service using stored credentials.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The client provides remote write operations for workout creation and update without any built-in confirmation, policy check, or separation from read-only flows. In an agent environment, this increases the risk that a prompt misunderstanding, prompt injection, or orchestration mistake causes unintended changes to user workout records.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Routine, routine-folder creation, and routine update methods can modify user data remotely, yet the client has no safeguards that distinguish these operations from simple reads. Because the skill is described as query-oriented, these hidden write capabilities are more dangerous: users and upstream agents may not anticipate that invoking the skill can alter persistent data.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: Creating a custom exercise template is a persistent remote write, but the method is available alongside read helpers with no friction or confirmation. In a skill advertised primarily for querying workout data, this can cause accidental or unauthorized creation of user-visible objects if an agent misinterprets a request.

Static analysis

No suspicious patterns detected.