ClawHub
Back to skill

Security audit

Workout

Security checks across malware telemetry and agentic risk

Overview

This workout-tracking skill appears purpose-aligned and clean, but users should be careful with its delete and cancel commands because they can change or remove workout records.

Install only if you are comfortable letting the agent operate your workout CLI. Before asking it to delete a profile, cancel a session, or delete a logged set, confirm the exact target and consider exporting or backing up important workout history.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill documents `workout profile delete old` without any warning that deleting a profile may permanently remove that user's workout history, templates, and configuration. In an agent setting, a user may ask to 'clean up' or remove an old profile and the agent could execute the destructive command without confirming scope or reversibility, causing data loss.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
`workout cancel` is shown as a normal core command without warning that it discards the current session, which can lead to irreversible loss of in-progress workout data. In conversational use, an agent may interpret vague user requests like 'start over' or 'never mind' as permission to cancel, making destructive behavior more likely.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The documented `workout delete bench-press 3` command removes a logged set entirely, but the skill provides no warning that this permanently alters workout records. Because this skill is specifically for tracking historical strength progression, silent deletion is more dangerous in context: it can corrupt training history, PR calculations, and analytics.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.