Strava CLI Skill

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:42 PM UTC
• Version: 2.2.98

Overview

The skill is a coherent Strava CLI helper, but it asks users to install and authenticate an unpinned third-party executable that can access private fitness/location data and perform limited account writes.

Review before installing. Use this only if you are comfortable granting a third-party Strava CLI access to your account data, including activity and route details. Prefer a pinned reviewed release, verify checksums or signatures if available, and confirm manually before uploads or activity updates.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15
• Finding: Unpinned and Unverified Third-Party CLI Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 15-19 **Vulnerability Type**: Unpinned third-party executable dependency **Risk Level**: Medium ### Vulnerable Code ```markdown Install `stravacli` before using this skill: - Recommended (release binary): - Download latest from: https://github.com/Brainsoft-Raxat/strava-cli/releases/latest - Or with Go: - `go install github.com/Brainsoft-Raxat/strava-cli/cmd/stravacli@latest` ``` ### Technical Analysis The skill instructs users or agents to install mutable “latest” versions of an external executable. Neither installation method pins a reviewed release, commit, or artifact digest. The instructions also provide no checksum or cryptographic-signature verification. Consequently, the effective executable can change after the skill has been reviewed. A compromise of the upstream repository, maintainer account, release infrastructure, Go module, or transitive dependency chain could cause a malicious binary to be installed and executed. This risk is especially significant because the CLI is subsequently authorized to access sensitive Strava resources, including athlete profiles, activity history, routes, streams, and location-related data. It can also perform activity uploads and metadata updates. ### Attack Path 1. An attacker compromises the upstream repository, release process, maintainer account, module source, or dependency chain. 2. The attacker publishes a malicious release or module version that becomes the target of `releases/latest` or `@latest`. 3. A user or agent follows the skill instructions and installs the mutable dependency. 4. The installed `stravacli` binary is executed for version verification or authentication. 5. The malicious executable runs with the privileges of the invoking user. 6. It can attempt to access files and credentials available to that user, intercept Strava authentication material, manipulate CLI output, or transmit authenticated Strava data to an ...[truncated 825 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the dependency to a specific, reviewed release rather than using `latest`: ```bash go install github.com/Brainsoft-Raxat/strava-cli/cmd/stravacli@vX.Y.Z ``` 2. Replace the mutable `/releases/latest` URL with a version-specific release URL. 3. Publish an expected SHA-256 digest for each supported release artifact and require verification before execution: ```bash sha256sum -c stravacli-vX.Y.Z-checksums.txt ``` 4. Verify cryptographic release signatures or provenance attestations where supported. 5. Record the reviewed upstream commit and dependency version in `SKILL.md`, and require a new security review before updating them. 6. Execute the CLI with least privilege. Restrict unnecessary filesystem access, environment variables, and network destinations where sandboxing capabilities are available. 7. Document the expected authentication-token storage location and required permissions. Ensure credentials are not exposed through command-line arguments, logs, or overly permissive files. 8. Prefer reproducible builds from a pinned commit and audited dependency graph when trusted prebuilt artifacts and signatures are unavailable. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger description is broad enough to activate on general Strava-related requests, including ambiguous automation or export tasks, which can cause the agent to invoke this skill when the user did not clearly intend terminal-based access to a third-party account. Because the skill supports authenticated access and limited write actions, unintended invocation could expose private fitness data or increase the chance of accidental account modifications.

Static analysis

No suspicious patterns detected.