Fitbit MCP

AdvisoryAudited by Static analysis on May 6, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteMedium Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing the MCP server can execute code from npm on the user's machine and handle the Fitbit OAuth flow.

Why it was flagged

The setup is user-directed but downloads/runs an external npm package, and the artifact set contains no package code or lockfile for review.

Skill content

- `npx -y fitbit-mcp-unofficial setup`
- `npx -y fitbit-mcp-unofficial auth`

Recommendation

Verify the npm package and linked repository before running setup, and pin a known-good version if the MCP client supports it.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

The connected MCP server and agent may be able to access Fitbit account data within the granted OAuth scopes.

Why it was flagged

The skill clearly expects Fitbit OAuth tokens and warns not to expose them, which is purpose-aligned but sensitive.

Skill content

Fitbit OAuth tokens stay under ~/.fitbit-mcp/ by default. ... Do not print OAuth tokens, API keys, service-account JSON, local token files, or private user data.

Recommendation

Review requested OAuth scopes, keep tokens private, and revoke the Fitbit authorization when the connector is no longer needed.

NoteHigh Confidence

ASI06: Memory and Context Poisoning

What this means

Sensitive Fitbit data could be shown in chat, copied into logs, or reused in later agent context if the client stores conversations.

Why it was flagged

These agent surfaces are private health and wellness data that may enter the agent's working context or outputs.

Skill content

- activity
- sleep
- heart rate
- HRV
- SpO2
- weight
- nutrition

Recommendation

Only ask for the specific Fitbit data needed, avoid sharing outputs publicly, and disable memory/logging for sensitive health queries where possible.

NoteMedium Confidence

ASI02: Tool Misuse and Exploitation

What this means

An agent could make live Fitbit provider calls or change user data if those MCP tools are enabled and invoked.

Why it was flagged

The instructions imply the MCP integration may support live provider calls or writes, though the skill also recommends safer status, audit, and dry-run steps first.

Skill content

Prefer connection_status, manifest, doctor, privacy_audit, or dry-run surfaces before any write or live provider call.

Recommendation

Require explicit user confirmation before any write action or live provider operation, and use dry-run or audit tools first.