Security audit

Strava Cycling Coach

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Strava ride-analysis integration with real privacy and persistence considerations, but the sensitive behavior is purpose-aligned and user-enabled.

Install only if you are comfortable granting Strava read access to private activity/profile data and storing Strava credentials plus OAuth tokens locally. Treat cron monitoring and the shell-profile export as optional; remove the crontab entry and delete ~/.config/strava and ~/.cache/strava when you stop using it, especially on shared machines.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill clearly requires environment variables, local file writes, shell commands, and network access, but these capabilities are not explicitly declared. That creates a transparency and consent problem because users may invoke a seemingly simple analytics skill without realizing it can persist data, modify local configuration, and communicate externally.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented behavior goes beyond ride analysis into OAuth credential handling, token storage/refresh, local caching of athlete data, and Telegram notifications. This mismatch is dangerous because users may authorize broader data access and persistence than the description implies, increasing the chance of unintended credential exposure or privacy-impacting data flows.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The function claims to send a private notification but actually prints both the chat ID and the full ride analysis message to stdout. In many agent, CI, or orchestration environments, stdout is logged centrally, which can expose sensitive fitness and heart-rate data to operators or other users who can access logs.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The README advertises automatic monitoring, local caching, and Telegram notifications without clearly warning users that ride data will be collected continuously, stored locally, and potentially transmitted to a third party. This can lead to uninformed consent, privacy exposure of sensitive fitness/location data, and unsafe deployment in shared or unmanaged environments.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill describes automatic monitoring and notifications without a prominent warning that it will continue accessing ride data in the background and may send outbound messages. In a fitness-data context, this is sensitive because ongoing collection and transmission of personal activity patterns can reveal location, habits, and health-related information over time.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The script prompts for a Strava client secret and writes it in plaintext to a local config file without clearly warning the user that a long-lived credential will be stored on disk. Although the file is later restricted with mode 600, plaintext local storage still increases the risk of accidental disclosure through backups, dotfile sync tools, screenshots, terminal recording, or compromise of the user account.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.