Security audit

Fitness Log

Security checks for vulnerabilities and agentic risk

Overview

The skill is a straightforward local fitness logger, but its bundled script can turn workout or weight inputs into executable Python, so it needs review before installation.

Review or patch the script before installing. At minimum, pass values to Python through argv or environment variables instead of source interpolation, validate workout types, durations, counts, goals, formats, and weights, and set restrictive permissions on ~/.fitness and its files. Avoid using this skill with untrusted or automatically forwarded text until those issues are fixed.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/fitness_log.sh:30
Finding: Arbitrary Python Code Execution Through Unsafely Interpolated Command Arguments
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/fitness_log.sh:45
Finding: Stored Python Code Injection Through Weight Records
Content: View full analysis
"; exit 1; } echo "$(date +%Y-%m-%d)|$w" >> "$FIT_DIR/weight.csv" echo "⚖️ Weight: ${w}kg ($(date +%Y-%m-%d))";; ``` ```bash progress) echo "⚖️ Weight Progress:" if [ -f "$FIT_DIR/weight.csv" ]; then tail -14 "$FIT_DIR/weight.csv" | while IFS='|' read -r date w; do bar=$(python3 -c "print('█' * int(float('$w')/5))" 2>/dev/null || echo "") echo " $date ${w}kg $bar" done else echo " No weight data yet"; fi;; ``` ### Technical Analysis The `weight` command accepts an arbitrary string and appends it to `weight.csv` without verifying that it is a valid numeric weight. The `progress` command later reads that stored value and inserts it directly into a Python program: ```python print('█' * int(float('$w')/5)) ``` A stored value containing quotes, closing parentheses, Python statements, and a comment delimiter can escape the intended `float()` argument and alter the generated source. This is a second-order or stored injection vulnerability: the malicious value is persisted during one command and executed by a later command. Suppressing standard error and falling back to an empty string does not mitigate the vulnerability. Those controls only affect output after Python has already parsed and potentially executed the injected statements. ### Attack Path 1. An attacker invokes `weight` with a crafted nonnumeric value, or otherwise gains the ability to modify `~/.fitness/weight.csv`. 2. The application appends the value to `weight.csv` without validation. 3. The malicious record remains dormant until `progress` processes it. 4. `progress` reads the record into the shell variable `w`. 5. The script interpolates ...[truncated 706 chars]
Remediation: View remediation
/dev/null || echo "") ``` 3. Reject values containing record separators such as newlines or `|`, even after numeric validation is added. 4. Consider generating the progress bar directly in Bash after validated numeric conversion, thereby removing the dynamic Python invocation. 5. Treat existing `weight.csv` content as untrusted. Validate each record while reading it and skip malformed records without placing their content into executable code. 6. Add tests covering malformed numbers, quote characters, Python syntax, newline injection, negative values, infinities, and excessively large values. ]]>

T09 · Insecure Skill Coding Practices

Note

Location: scripts/fitness_log.sh:6
Finding: Fitness and Weight Records May Be Created With Excessively Broad Permissions
Content: View full analysis
"$DB" ``` ```bash weight) w="${1:-}"; [ -z "$w" ] && { echo "Usage: weight "; exit 1; } echo "$(date +%Y-%m-%d)|$w" >> "$FIT_DIR/weight.csv" ``` ### Technical Analysis The script stores workout history and body-weight information but does not establish an explicitly restrictive `umask`, directory mode, or file mode. Consequently, the effective permissions of `~/.fitness`, `workouts.json`, and `weight.csv` depend on the invoking process's environment and current `umask`. Under a permissive configuration, other local users may be able to read the directory or files. In addition, `mkdir -p` does not correct an already existing directory with insecure permissions. The implementation therefore does not enforce the privacy expectation associated with locally stored health-related data. ### Attack Path 1. The script is invoked under a permissive `umask`, or `FIT_DIR` already exists with broad permissions. 2. The directory and data files are created or retained with group-readable or world-readable permissions. 3. Another local account enumerates or opens the files. 4. That account obtains workout dates, workout types, notes, durations, calorie estimates, or body-weight history. Exploitation requires local access and filesystem permissions that permit reading the affected records. ### Impact Assessment The primary impact is confidentiality loss involving personal fitness and body-weight data. This issue does not provide code execution or additional privileges. Its scope is limited to records exposed by the resulting filesystem permissions and to local users who can access those paths. ]]>
Remediation: View remediation
"$DB" chmod 600 -- "$DB" touch -- "$FIT_DIR/weight.csv" chmod 600 -- "$FIT_DIR/weight.csv" ``` 4. Validate that `FIT_DIR` is an expected directory owned by the invoking user before writing records, particularly when the environment variable overrides the default path. 5. Document that workout and weight records contain private information and should not be placed in shared directories. ]]>

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill advertises local data storage and workout logging/export features, which reasonably imply file writes, but it does not declare any explicit tool scope such as permissions or allowed-tools. That mismatch weakens containment and reviewability, because an agent may invoke file-writing behavior without a clearly declared capability boundary for users or platform policy to inspect.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The description is overly broad, using phrases like 'personal daily-use tool' and 'organizing your life,' which could cause the skill to be selected in contexts far beyond fitness tracking. Over-broad routing increases the chance of unintended invocation, exposing local file-writing behavior or user data handling in situations where the user did not specifically ask for this skill.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.