Muscle Gain

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ConcernMedium Confidence
ASI06: Memory and Context Poisoning
What this means

A user could share sensitive body data or progress photos without knowing where that information will persist or whether it may be reused in later agent context.

Why it was flagged

The skill is designed to collect and organize sensitive personal fitness, nutrition, body-measurement, and photo data, but the artifacts do not define storage location, retention, deletion, or reuse boundaries.

Skill content
Log body weight and measurements... monitor daily protein intake... Progress photos - Timestamped images with metadata
Recommendation

Use only with data you are comfortable storing in the agent environment, and require an explicit local storage location, deletion process, and retention policy before logging sensitive photos or measurements.

What this means

A user may trust the skill with sensitive health or body-photo data under a privacy guarantee that is not supported by the provided artifacts.

Why it was flagged

This is a strong privacy and encryption promise, but the reviewed artifacts indicate an instruction-only skill with no code or install mechanism to implement or verify local encrypted storage.

Skill content
All data stays local on your machine - Your training logs, weight history, and progress photos are encrypted and stored offline. No cloud upload, no third-party access, full privacy.
Recommendation

Do not rely on the encryption/offline-storage claim unless the skill provides auditable storage code or clear instructions that keep data in a user-controlled encrypted local file.