Oura API Complete Export

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:37 AM UTC
• Version: 1.0.0

Overview

The skill appears to perform the advertised Oura export, but it handles OAuth secrets and sensitive health data with weak local safeguards that users should review before installing.

Install only on a trusted machine. Avoid putting real client secrets directly in shell commands, keep ~/.config/oura-oauth/config.json private, use localhost for the OAuth redirect, and write exports only to an encrypted or access-restricted location because the JSON files can contain sensitive health and personal data.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/auth_oura_oauth.py:55

Finding

OAuth Client Secret Exposed Through Command-Line Arguments

Content

View full analysis

" \ --client-secret "" \ --redirect-uri "http://localhost:8765/callback" ``` ### Technical Analysis The authentication script requires the Oura OAuth client secret to be supplied as a command-line argument. Command-line arguments are not an appropriate transport for secrets because they can be retained or exposed through: - Shell history files. - Process-listing and process-inspection interfaces. - Terminal session recordings. - CI/CD, orchestration, or automation logs. - Diagnostic and monitoring tools that record command invocations. Sending the client secret to Oura's official HTTPS token endpoint is necessary for the declared OAuth functionality. The vulnerability is the local method used to supply the secret, not the network transmission itself. ### Attack Path 1. A user follows the documented authentication command and supplies the OAuth client secret using `--client-secret`. 2. The shell records the command in its history, or the argument remains temporarily visible through process inspection. 3. Another local account, support operator, monitoring service, or log reader obtains the command-line value. 4. The exposed secret is used to impersonate or misuse the registered OAuth client, subject to Oura's OAuth controls and the attacker ...[truncated 565 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/export_oura_data.py:131

Finding

Sensitive Health Export Files May Be Created with Permissive Filesystem Permissions

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/auth_oura_oauth.py:62

Finding

OAuth Callback Server Allows Non-Loopback Plain-HTTP Bindings

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill claims to perform OAuth token storage/refresh and full Oura dataset export, but the analyzed behavior reportedly does not implement those functions. This mismatch is dangerous because users may provide sensitive OAuth client secrets and expect a complete backup workflow, while the skill may silently fail, mishandle credentials, or leave operators with a false sense of data coverage and security controls.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md

- `SKILL.md`

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/auth_oura_oauth.py (reported line 54)May include surrounding context.

python

def main():
    ap = argparse.ArgumentParser(description="Authenticate Oura OAuth app and store refresh/access tokens")
    ap.add_argument("--client-id", required=True)
    ap.add_argument("--client-secret", required=True)
    ap.add_argument("--redirect-uri", required=True)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/export_oura_data.py (reported line 129)May include surrounding context.

python

cfg = refresh_if_needed(load_config())
    access_token = cfg.get("token", {}).get("access_token")
    if not access_token:
        raise SystemExit("Missing access token. Run auth_oura_oauth.py again.")

    out = Path(args.out).resolve()
    out.mkdir(parents=True, exist_ok=True)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 20)May include surrounding context.

md

- `scripts/run_full_export.sh`
- `references/endpoints.md`

## 1) Create an Oura OAuth app

1. Open Oura developer portal and create an app.
2. Copy:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README instructs users to store OAuth tokens in a predictable local config path but does not warn that refresh/access tokens are sensitive secrets equivalent to account access. If that file is left with weak permissions, included in backups, synced to cloud storage, or exposed on a shared system, an attacker could reuse the tokens to access the user's Oura data until revoked or expired.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README encourages exporting complete Oura datasets to local JSON files without warning that the output may contain sensitive health and behavioral data. Those files can be copied, indexed, backed up, or disclosed unintentionally, creating privacy and compliance risks even if the export process itself is legitimate.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill advertises and directs use of capabilities including shell execution, network access, and file read/write, but it does not declare any explicit tool scope or permission boundaries. In an agent environment, missing scope constraints increases the chance that the skill can be invoked with broader-than-necessary privileges, enabling unintended network calls, local file access, or token/material persistence without clear guardrails.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file documents bulk export of multiple Oura usercollection endpoints containing highly sensitive health and behavioral data, but provides no warning about the sensitivity of the data, secure storage expectations, retention limits, or consent considerations. In this skill context, the omission matters because the skill is explicitly designed for full backup/raw export, which increases the chance of over-collection, accidental disclosure, or unsafe downstream handling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script persists highly sensitive material including the OAuth client secret and issued access/refresh tokens to a local JSON config file. Although it applies mode 0600, storing long-lived credentials in plaintext on disk increases exposure to local compromise, backups, endpoint malware, and accidental disclosure, especially because the script gives no explicit warning or safer storage option.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/auth_oura_oauth.py (reported line 16)May include surrounding context.

python

import requests

BASE_URL = "https://api.ouraring.com"
TOKEN_URL = "https://api.ouraring.com/oauth/token"
CONFIG_PATH = Path.home() / ".config" / "oura-oauth" / "config.json"

ENDPOINTS = [

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/export_oura_data.py (reported line 13)May include surrounding context.

python

import requests

BASE_URL = "https://api.ouraring.com"
TOKEN_URL = "https://api.ouraring.com/oauth/token"
CONFIG_PATH = Path.home() / ".config" / "oura-oauth" / "config.json"

ENDPOINTS = [

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script writes a full export of Oura health data to local JSON files without any consent prompt, sensitivity warning, or safeguards on the output directory and file permissions. In the context of a backup/export skill this behavior is expected, but it still creates a real confidentiality risk because highly sensitive health data may be stored in plaintext where other local users, backup systems, or synced folders can access it.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This HTTP request sends the authorization code, client ID, and client secret to Oura's token endpoint. Network transmission is expected for OAuth, but the file lacks an explicit warning or explanatory comment telling users that their supplied secret will be sent to the remote service.

Content

No source excerpt is available for this finding.