ClawHub
Back to skill

Security audit

running-coach

Security checks across malware telemetry and agentic risk

Overview

This is a coherent running-coach skill with local health-profile storage and coaching guidance that is disclosed and purpose-aligned, though users should treat the health and nutrition advice cautiously.

Install only if you are comfortable storing running and physiological data locally for personalization. Treat injury and nutrition outputs as training guidance, not medical advice, and consult a qualified clinician for pain, worsening symptoms, cardiovascular concerns, pregnancy, medication interactions, or stimulant sensitivity.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
This file provides injury triage guidance, medical red flags, likely diagnoses, and treatment actions without clearly warning users that it is not a substitute for professional medical advice. In a running-coach skill, users may rely on this content to self-diagnose or delay seeking care, especially because the document presents specific stop/go criteria and intervention advice in an authoritative format.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The file gives a specific caffeine dose recommendation ('3 mg/kg 45-60 min before') without any caution about stimulant sensitivity, pregnancy, cardiovascular conditions, anxiety, medication interactions, or age-related considerations. In a coaching skill that provides actionable performance guidance, users may treat this as personalized medical-safe advice and experience palpitations, GI distress, sleep disruption, or other adverse effects.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The file documents collection and local storage of sensitive health and physiological data such as heart rate, injuries, and performance metrics, but provides no warning that this information is sensitive or guidance on minimizing exposure. In a coaching skill, collecting such data is functionally relevant, but omitting privacy notice and handling guidance increases the risk of users oversharing or storing regulated/sensitive information insecurely.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The setup questions explicitly ask for sensitive health information, including resting/max heart rate and injury history, without warning the user about privacy implications or clarifying that only necessary data should be provided. Because this skill is specifically for endurance coaching, the collection is contextually justified, but the lack of consent, minimization, and sensitivity framing makes accidental disclosure more likely.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.