Strava CLI

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:28 PM UTC
• Version: 0.1.0

Overview

The skill is a coherent Strava CLI guide, but it sends users through unpinned third-party code execution and persistent OAuth token storage without enough security hardening guidance.

Review this before installing if you are comfortable running an unpinned third-party Python CLI and storing Strava OAuth tokens locally. If used, pin or verify the package version, protect ~/.config/strava-cli with restrictive permissions, avoid putting secrets in shell history, and treat exports as private location-sensitive data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:8
• Finding: Execution of an Unpinned Third-Party Package## Vulnerability Details **File Location**: `SKILL.md`, lines 8-14 **Vulnerability Type**: Supply-chain risk caused by unpinned dependency installation and execution **Risk Level**: Medium **Complete Code Snippet**: ```markdown ## Install ```bash uvx --from strava-client-cli strava --help # Or install persistently: uv tool install strava-client-cli ``` ``` ### Technical Analysis The documented commands retrieve `strava-client-cli` from the configured package registry without specifying an exact version, cryptographic hash, lockfile, or verified artifact source. In particular, `uvx` downloads and immediately executes the resolved package. Because package resolution is mutable, the code executed by users may differ from the code that was reviewed. A compromised maintainer account, malicious package release, registry compromise, or compromised transitive dependency could therefore introduce arbitrary code. ### Attack Path 1. An attacker compromises the `strava-client-cli` distribution channel, maintainer account, or one of its dependencies. 2. The attacker publishes a malicious release that remains compatible with the unpinned package name. 3. A user follows the Skill instructions and runs `uvx --from strava-client-cli strava --help` or installs the package persistently. 4. The package manager resolves and downloads the attacker-controlled release. 5. The malicious package executes with the privileges of the invoking user. ### Impact Assessment Successful exploitation could allow arbitrary code execution under the invoking user's account. This could expose local files, Strava OAuth credentials, environment variables, and other user-accessible secrets. A malicious persistent installation could also affect later invocations of the installed CLI. The instructions do not request elevated privileges, so the direct privilege scope is normally limited to the current user unless the command is independently run from a ...[truncated 20 chars]
• Remediation: ## Remediation Suggestions - Pin `strava-client-cli` to a specifically reviewed version instead of resolving the latest available release. - Use a lockfile or package-manager mechanism that verifies cryptographic hashes for the package and its transitive dependencies. - Document the expected trusted registry and reject unexpected indexes or package sources. - Review package metadata and source before the first execution. - Prefer installing into an isolated environment with only the permissions necessary for Strava access. - Establish a controlled process for reviewing and updating the pinned version rather than accepting upgrades automatically.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:64
• Finding: Plaintext OAuth Token Storage Without Explicit Permission Hardening## Vulnerability Details **File Location**: `SKILL.md`, lines 64-74 **Vulnerability Type**: Insecure storage of sensitive OAuth credentials **Risk Level**: Medium **Complete Code Snippet**: ```markdown 4. Save the response tokens to `~/.config/strava-cli/tokens.json`: ```json { "access_token": "...", "refresh_token": "...", "expires_at": 1234567890, "token_type": "Bearer" } ``` ``` The related default storage locations are also documented at line 42: ```markdown Tokens auto-refresh (every 6 hours). Config: `~/.config/strava-cli/config.json`, tokens: `~/.config/strava-cli/tokens.json`. ``` ### Technical Analysis The manual authentication procedure directs users to place an access token and refresh token in a plaintext JSON file. It does not require the containing directory or token file to have restrictive permissions. The actual exposure depends on the user's operating-system defaults and `umask`; the document does not prove that the resulting file will be world-readable. Nevertheless, a permissive environment or an incorrectly pre-created file may allow other local users or processes to read the credentials. The refresh token is particularly sensitive because it can be used to obtain replacement access tokens after the current access token expires. The requested OAuth scopes include `activity:read_all` and `profile:read_all`, so compromised credentials may expose private activity and profile information within the permissions granted by Strava. ### Attack Path 1. A user completes the documented OAuth flow and obtains access and refresh tokens. 2. The user saves the response to `~/.config/strava-cli/tokens.json` as instructed. 3. Due to a permissive `umask`, insecure directory permissions, a previously created file, backups, or access by another local process, the token file is readable outside the intended application context. 4. An attacker copies the access token ...[truncated 745 chars]
• Remediation: ## Remediation Suggestions - Prefer an operating-system credential manager or keychain rather than a plaintext JSON file. - If file storage is unavoidable, create `~/.config/strava-cli` with mode `0700` and `tokens.json` with mode `0600`. - Set restrictive permissions before writing secrets rather than correcting permissions only after the write. - Write tokens atomically through a securely created temporary file in the same protected directory, then rename it into place. - Refuse to use token files owned by another account or files with unsafe permissions. - Avoid printing tokens in logs, shell history, diagnostics, or error messages. - Document token revocation through Strava and recommend immediate revocation if the file may have been exposed. - Request only the minimum OAuth scopes necessary for the user's intended commands.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence
• Finding: The install command uses `uvx --from strava-client-cli` without pinning a specific version, so users may execute whatever package version is current at runtime. If the upstream package is compromised or a breaking/malicious update is published, the skill would direct users to fetch and run it automatically.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Setup

### 1. Create a Strava Account (if needed)

Sign up at https://www.strava.com/register. Only name, email, and password required.

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill instructs users to save OAuth access and refresh tokens locally but does not warn that these are sensitive credentials that can grant continued access to Strava account data. Users may store them with weak filesystem permissions, commit them to repos, or expose them via backups and shared systems.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The manual token exchange flow exposes the client secret and authorization code in a shell command without any security guidance. These values are sensitive and may be leaked through shell history, terminal logging, screenshots, process inspection, or shared automation environments.

External Transmission

Medium

• Category: Data Exfiltration

Content

2. Open in any browser, authorize, grab the `code` from the redirect URL
3. Exchange:
   ```bash
   curl -s -X POST https://www.strava.com/oauth/token \
     -d client_id=CLIENT_ID \
     -d client_secret=CLIENT_SECRET \
     -d code=CODE \

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Low

• Confidence: 78% confidence
• Finding: The export example writes potentially sensitive personal activity data to local storage without warning users about privacy implications. Exported fitness history, routes, and timestamps may later be exposed via insecure directories, syncing services, or accidental sharing.

Static analysis

No suspicious patterns detected.