Strava Cycling Coach
Analysis
The skill is mostly consistent with Strava ride analysis, but it asks for broad Strava account access, stores activity data locally, and can create a recurring background monitor.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
# Set up cron job (checks every 30 minutes) crontab -l > /tmp/cron_backup.txt echo "*/30 * * * * $(pwd)/scripts/auto_analyze_new_rides.sh" >> /tmp/cron_backup.txt crontab /tmp/cron_backup.txt
The skill openly documents an optional cron job that runs on a schedule. This is purpose-aligned for automatic ride monitoring, but it is persistent background behavior.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
OAUTH_URL="https://www.strava.com/oauth/authorize?client_id=${CLIENT_ID}&redirect_uri=http://localhost:8080/callback&response_type=code&scope=activity:read_all,profile:read_all"The OAuth setup requests read-all access to Strava activities and profile data. That is sensitive delegated account access and is broader than clearly justified for ride-performance analysis, especially the profile:read_all scope.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
recent = fetch_recent_activities(config, limit=20)
...
if new_rides:
update_cache_with_new_activities(recent)The monitor checks for new virtual rides, but when it finds one it caches the full recent activity list returned by Strava, not only the newly analyzed virtual ride.