ClawHub
Back to skill

Security audit

Strava (Official API)

Security checks across malware telemetry and agentic risk

Overview

This Strava skill does what it says: it connects to Strava, stores OAuth tokens locally, and fetches workout data without evidence of hidden or unrelated behavior.

Install only if you are comfortable granting OpenClaw access to your Strava activity data. Keep STRAVA_CLIENT_SECRET and the token JSON private, avoid sharing raw activity exports, set STRAVA_TZ for your region, and revoke the Strava OAuth grant if you stop using the skill.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill documentation clearly indicates capabilities to read environment variables, write token files, access the network, and invoke shell commands, yet no explicit permissions are declared. This creates a transparency and governance gap: users or hosting platforms may not realize the skill can access secrets and persist OAuth credentials, increasing the risk of over-privileged execution or unnoticed misuse.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill handles OAuth client secrets, refresh/access tokens, and personal fitness activity data, but the documentation provides no user-facing warning about the sensitivity of these credentials and records. That omission can lead to insecure deployment, careless sharing of token files or outputs, and inadequate consent around collection and retention of personal data.

Natural-Language Policy Violations

Medium
Confidence
80% confidence
Finding
Defaulting the timezone to Asia/Shanghai without user opt-in can cause activity-day boundaries, summaries, and date-range queries to be computed incorrectly for users in other regions. While not typically a direct compromise, it can mis-handle personal data and produce inaccurate reports that may leak assumptions about locale or cause erroneous downstream wellness calculations.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.