Fitbit Connector

• Outcome: Review
• Latest audit: May 29, 2026 · 9:29 PM UTC
• Version: 1.0.0

Overview

This is a broadly disclosed health-data connector, but the package includes real-looking Fitbit OAuth token backups and private calendar/log artifacts that should not be distributed.

Do not install this version as a public skill package. The publisher should revoke or rotate the exposed Fitbit credentials, remove token backups, private calendar caches, and user-specific run logs, then republish a sanitized package with explicit scoping for broad Fitbit endpoints, Apple Health import, calendar ingestion, backups, and backup pruning.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (35)

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: This file contains extensive Google Calendar export data, including detailed workout logs, schedule metadata, event IDs, links, and creator/organizer information, which is unrelated to the stated Fitbit connector purpose. Bundling unrelated personal cache data into a skill expands the data exposure surface and can leak sensitive behavioral information to anyone with access to the skill package.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The later entries show active calendar-based training planning and logging behavior, including future plans, progression rules, and health/training state fields, which goes beyond a compact Fitbit data connector. This suggests scope creep or hidden capability, making the skill more dangerous because users and reviewers may not expect collection, storage, or exposure of calendar-derived coaching data in this context.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The cache contains non-Fitbit training plans, coaching rules, and notes sourced from Apple Notes and Discord, which exceeds the stated scope of a Fitbit-only connector. This over-collection increases exposure of sensitive personal data and creates a trust-boundary violation where downstream components may consume more intimate behavioral data than users expect.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The cached entries include explicit programming/coaching content such as workout plans, progression rules, and decision logic, contradicting the skill description that OpenClaw performs all coaching reasoning. This is dangerous because it silently shifts reasoning authority into stored content, enabling prompt/data poisoning of later agent behavior and causing undocumented processing of sensitive health-related guidance.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The run log shows the connector creating backups of local SQLite databases and a token file, which expands the skill from a narrow Fitbit auth/fetch/store/quality role into broader local data management. That increases the amount of sensitive health data and credentials duplicated on disk and broadens the blast radius if the skill is misused, compromised, or invoked unexpectedly.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The backup_prune step performs deletion/trash operations on local backup snapshots, which exceeds a compact data connector's described responsibilities. Any undeclared file lifecycle operation is risky because it can remove audit/history artifacts or affect user data availability, especially when operating on directories containing health databases and auth material.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The code computes readiness state, confidence, reasons, and a training recommendation inside the connector, which exceeds the stated skill scope of auth/fetch/store/quality tools. This is dangerous because downstream systems may trust these derived coaching signals as authoritative health guidance, creating integrity and safety risks when a data connector silently embeds decision logic.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The database write persists derived readiness and recommendation fields alongside raw Fitbit metrics, making the connector a source of behavioral guidance rather than only a transport/store component. Persisting these fields increases the chance that other components consume them without context, propagating potentially unsafe or out-of-scope health recommendations.

Description-Behavior Mismatch

High

• Confidence: 92% confidence
• Finding: The file substantially exceeds the declared Fitbit connector scope by including training calendar ingestion, cross-source health correlation, and access to a separate unified health database. This kind of scope drift is dangerous because operators may grant or trust the skill for Fitbit access while it also processes unrelated sensitive calendar and health data, expanding the attack surface and privacy impact.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The skill invokes an external calendar CLI and exports calendar events to local storage, which is unrelated to the stated Fitbit connector purpose. In context, this is especially risky because calendar events can contain sensitive titles, schedules, locations, and health-adjacent training details, so the hidden expansion of data collection materially increases privacy and exfiltration risk.

Context-Inappropriate Capability

Medium

• Confidence: 78% confidence
• Finding: Exposing arbitrary Fitbit endpoint access via user-supplied path and params broadens the tool beyond a compact connector and bypasses any intended least-privilege API surface. While it does not inherently bypass Fitbit scopes, it enables retrieval of any data available to the token, which can expose more sensitive user information than the skill description suggests.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill is described as a Fitbit connector, but this file also imports and aggregates Apple Health exports. That scope expansion increases access to unrelated sensitive health data and can violate least-privilege and user expectations, especially in an agent ecosystem where users may grant trust based on the stated connector purpose.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code parses Apple Health XML exports and ingests them into the local database even though the skill's stated purpose is Fitbit connectivity. Hidden or unjustified data-ingestion capabilities are dangerous because they broaden the attack and privacy surface for highly sensitive medical and wellness records without clear disclosure.

Natural-Language Policy Violations

Medium

• Confidence: 99% confidence
• Finding: The exported calendar data includes a personal email address and associated organizer identifiers without any indication of minimization, consent, or access restriction. Exposing direct identifiers alongside detailed routine and health-adjacent activity logs creates a privacy risk and can enable profiling, targeting, or unintended disclosure of personal information.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: A personal email address is stored in the calendar metadata without any visible minimization, masking, or handling notice. Exposing direct identifiers in cached skill data raises privacy risk, facilitates unwanted contact or correlation across services, and is unnecessary for most connector use cases.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: Another email address is exposed in calendar organizer metadata, again without documented necessity or privacy controls. Even if one address is a calendar identifier rather than a personal mailbox, retaining it in cleartext can still reveal account linkage and internal resource identifiers to downstream consumers.

Vague Triggers

Low

• Confidence: 81% confidence
• Finding: This run artifact records absolute local filesystem paths for backup directories, SQLite databases, and token storage. While not directly exposing credentials, these paths reveal username, workspace layout, asset names, and the location of sensitive token files, which can aid local targeting, social engineering, or follow-on attacks if logs are shared, synced, or exposed through other tooling.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: The run artifact includes absolute filesystem paths containing a user-specific identifier (`/Users/joao/...`). This leaks local environment details that can aid reconnaissance, reveal operator identity or account naming conventions, and expose the layout of sensitive assets such as token and database locations if logs or artifacts are shared outside the trusted host.

Natural-Language Policy Violations

Low

• Confidence: 97% confidence
• Finding: The run log includes absolute local filesystem paths under /Users/joao, which disclose a real username, workspace layout, backup locations, and the names of sensitive artifacts such as token and database files. While this is not code execution, it is still an information disclosure issue that can aid targeted attacks, social engineering, host fingerprinting, or follow-on attempts to locate credentials and health data stores.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: The run log records absolute local filesystem paths containing a likely personal username/home directory, which unnecessarily exposes environment-specific identifying information. If these logs are shared, committed, uploaded, or collected centrally, they can leak personal metadata and internal path structure that aids targeting or reconnaissance.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This run log exposes sensitive local filesystem paths for the live token file and backup copies, including a backed-up `fitbit_tokens.json`. Even without the token values, these paths materially lower the effort for an attacker or malicious local process to locate credential stores and backups, and the skill context increases sensitivity because the connector handles health data plus OAuth-style access tokens.

Natural-Language Policy Violations

Low

• Confidence: 92% confidence
• Finding: The run log exposes absolute local filesystem paths containing a probable username (`/Users/joao/...`) and the locations of databases, backups, and token files. While this does not directly grant access, it leaks host-specific environment details and sensitive file locations that can aid targeted phishing, local privilege abuse, or follow-on attempts to access credential material such as `fitbit_tokens.json`.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: The run artifact includes absolute filesystem paths containing a user-specific name ('/Users/joao/...') for backups and asset locations. This leaks personal/environment metadata that is not required for the artifact's apparent functional purpose and can aid host profiling, targeted phishing, or follow-on attacks when logs are shared outside the local machine. In this skill context, the artifact also references Fitbit token and database file locations, which increases sensitivity because it reveals where health data and auth material reside, even though the file does not expose token contents.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: The run log exposes absolute local filesystem paths containing a user-specific home directory and username (`/Users/joao/...`). This leaks host environment details that can aid fingerprinting, targeted social engineering, or subsequent attacks if logs are shared, uploaded, or exposed through the skill runtime. In this skill context, the danger is somewhat increased because the connector also references token and database artifact locations, making the leaked paths more operationally sensitive than a generic path disclosure.

Natural-Language Policy Violations

Low

• Confidence: 94% confidence
• Finding: The run log embeds a real-looking local username and full absolute home-directory paths for backups, databases, and token files. This unnecessarily discloses host-specific identity and filesystem layout information, which can aid follow-on targeting, social engineering, or access attempts if logs are shared, committed, or exposed through other tooling.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.