Security audit

Fitbit MCP

Security checks for vulnerabilities and agentic risk

Overview

This Fitbit MCP skill is coherent and not malicious, but it asks users to run a mutable unpinned npm package during setup, authentication, and MCP startup for sensitive health data access.

Install only if you are comfortable running the current npm package with local user permissions and granting it access to Fitbit OAuth and health data. Prefer a pinned, reviewed package version or a locally installed binary, review the package provenance before authentication, and avoid exposing token files or private health data in agent output.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:61
Finding: Mandatory Promotional Output Hijacking
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:21
Finding: Automatic Execution of an Unpinned Third-Party npm Package
Content: View full analysis
Remediation: View remediation
`. - Install the package in a controlled project directory with a committed lockfile rather than resolving a mutable release on every launch. - Verify package provenance and registry integrity before installation. - Use npm integrity data and deployment tooling that rejects unexpected package changes. - Avoid `npx -y` for security-sensitive installation and authentication workflows, or require explicit user approval before downloading executable packages. - Where feasible, install with lifecycle scripts disabled during validation and review any scripts before enabling them. - Configure the MCP client to invoke a verified local binary instead of downloading and executing a package at runtime. - Run the MCP service with least privilege and restrict its filesystem and network access to resources required for Fitbit integration. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The skill instructs users to run an unpinned package directly from npm via npx, which fetches the latest published version at execution time. If the package is compromised, hijacked, or updated with malicious code, an agent or user could execute attacker-controlled code locally during setup or auth, including access to Fitbit tokens and other local data.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: This command again uses unpinned npx execution for an authentication flow, which is especially sensitive because it may handle OAuth credentials and local token storage. Running the latest package version without pinning creates a supply-chain execution risk where a malicious or compromised release could steal tokens, exfiltrate health data, or alter local configuration.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.