T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:26- Finding
Automatic Retrieval and Execution of an Unreviewed CLI Update
- Content
View full analysis
- Remediation
View remediation
Security audit
骑行&健康(Garmin/iGPSPORT/Intervals.icu/Strava/Xingzhe)
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly coherent for cycling and health analysis, but it requires an automatic CLI self-upgrade before use, which can replace local executable code before accessing sensitive fitness accounts and data.
Review this skill carefully before installing. Its fitness-account access and local credential handling are expected for the stated purpose, but the automatic `cycling-health upgrade` step means the agent may replace the CLI from external release channels before using your health, activity, location, and account data. Install only if you trust the CLI publisher and its update channel, or require manual approval/version pinning for upgrades.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md read-only scopes. The default callback is `http://localhost:8765/callback`. Use `--callback-port 0` when the port is occupied. Access tokens are refreshed and saved automatically. Profiles isolate credentials for different accounts. Authorization revocation is preview-first:
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - Missing app credentials: direct the user to `docs/xingzhe.md`; do not ask for the secret value. - Expired access token with a refresh token: allow the CLI's automatic refresh and preserve any final OAuth error. - Port conflict: retry login with `--callback-port 0`. - Empty route page: report the selected profile, collection, and offset; do not
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - Prefer `cycling-health` from `PATH`. If it is missing, guide installation from the public repository. - When command execution is available, run `cycling-health upgrade --output json` once before status, synchronization, or analysis commands. - Prefer `--output json` for collection and analysis. - Treat Garmin credentials, Intervals.icu API keys, OAuth tokens, passwords, MFA codes, account descriptions, downloaded FIT/GPX files, and exported activity files as sensitive local data. Never ask the user to paste secrets into chat. - Analyze only returned fields. Do not invent HRV, power, zones, fitness, fatigue, form, FTP, W/kg, or causal relationships. - Collect in stages. Start with summary/list/statistics calls, then request intervals, streams, curves, raw payloads, or exported files only when the conclusion needs them. - Separate current recovery from durable ability. A poor night or negative form can affect today's decision without proving fitness loss.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - Prefer `cycling-health` from `PATH`. If it is missing, guide installation from the public repository. - When command execution is available, run `cycling-health upgrade --output json` once before status, synchronization, or analysis commands. - Prefer `--output json` for collection and analysis. - Treat Garmin credentials, Intervals.icu API keys, OAuth tokens, passwords, MFA codes, account descriptions, downloaded FIT/GPX files, and exported activity files as sensitive local data. Never ask the user to paste secrets into chat. - Analyze only returned fields. Do not invent HRV, power, zones, fitness, fatigue, form, FTP, W/kg, or causal relationships. - Collect in stages. Start with summary/list/statistics calls, then request intervals, streams, curves, raw payloads, or exported files only when the conclusion needs them. - Separate current recovery from durable ability. A poor night or negative form can affect today's decision without proving fitness loss.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md Release archives also include `README.md` plus the setup guides `docs/intervals-icu.md`, `docs/strava.md`, `docs/igpsport.md`, and `docs/xingzhe.md`. Use the matching guide for first-time application, credential, OAuth, and callback configuration. Do not ask the user to expose the local secret files described by those guides. ## Upgrade Before Use