Security audit

Fitness For Desk Workers

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a fitness coaching guide, but it asks for broad filesystem access without explaining any file use and installs through an unpinned npx command.

Review this before installing. The fitness content itself is straightforward, but the publisher should remove or narrowly justify filesystem access and pin the installer/package version. If installed anyway, grant only calendar access if possible, avoid broad file permissions, and configure reminders explicitly so they do not infer desk presence unexpectedly.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:15
Finding: Unpinned Package Execution Through npx
Content: View full analysis
Remediation: View remediation
`. - Use an exact version rather than a range or floating tag. - Where supported, enforce package integrity through a lockfile, checksum, signed release, or registry integrity metadata. - Configure `npx` to use an explicitly trusted registry and avoid silent fallback to alternate registries. - Review the pinned package and its transitive dependencies before updating. - Prefer a preinstalled and administratively managed installer rather than downloading and executing a package during each installation. - Run installation with the least-privileged account and without unnecessary secrets in the process environment. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:14
Finding: Unnecessary Broad Filesystem Capability
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill declares filesystem access even though the visible skill behavior is primarily coaching, reminders, and state tracking, and there is no user-facing disclosure explaining why file access is needed. Unnecessary or undisclosed file access expands the attack surface and could allow reading or writing local data beyond what users reasonably expect from a fitness skill.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The manifest uses npx clawhub install howtousehumans/fitness-for-desk-workers without pinning a specific version or immutable reference. That makes installation depend on whatever package/version is current at execution time, which creates a supply-chain risk if the package is updated maliciously or unexpectedly changed.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger condition user is at desk is broad and underspecified, which can lead to over-triggering or reliance on inferred context the user may not expect. In practice this can create privacy and consent issues if the agent monitors status too aggressively, and it may spam or nudge the user based on inaccurate assumptions.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.