Security audit

Strava MCP

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for Strava MCP setup, but it directs users to run a mutable unpinned npm MCP package that may handle OAuth and GPS data.

Install only if you are comfortable trusting the current npm package each time npx runs. Prefer pinning strava-mcp-unofficial to a reviewed exact version, limiting the MCP process's filesystem and environment access, and treating OAuth tokens and GPS/activity data as sensitive.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Note

Location: SKILL.md:60
Finding: Mandatory Promotional Instruction Alters Agent Output
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:21
Finding: Automatic Execution of an Unpinned npm Package
Content: View full analysis
Remediation: View remediation
`, rather than resolving the latest available release. - Remove `-y` from setup instructions so package installation is not silently approved. - Prefer installing the verified package locally and configuring the MCP client to invoke that fixed local executable. - Commit and use an npm lockfile where applicable. - Verify npm integrity metadata or cryptographic checksums before execution. - Document the expected package publisher, repository, version, and release checksum so users can validate provenance. - Review dependency updates before changing the pinned version. - Run the MCP process with least privilege, restricted filesystem access, minimal environment variables, and controlled network access. - Keep OAuth tokens and other credentials outside the package's unrestricted environment wherever the client supports isolated secret injection. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill instructs users to execute an npm package via npx without pinning a specific version, which allows whatever package version is current at execution time to run on the user's machine. Because this is an MCP server that will process local data and may access Strava-related tokens or sensitive activity/location information, a malicious or compromised package update could lead to arbitrary code execution, credential theft, or privacy-sensitive data exfiltration.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The authentication command also uses unpinned npx, meaning the package fetched and executed during auth may change over time without review. This is especially sensitive because auth flows often handle OAuth tokens and local credential material, so a malicious upstream release could harvest secrets or alter authentication behavior.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.