ClawHub
Back to skill

Security audit

Health Training Frontdoor

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed Fitbit/training data wrapper, but it also asks agents to load sensitive personal training memory for coaching despite saying coaching is outside its scope.

Review this skill before installing. The Fitbit retrieval wrapper itself appears read-only and narrowly mapped, but the skill also directs agents to read personal training and health memory for advice. Install only if you are comfortable with that local memory being brought into agent context, or split the coaching reference into a separately scoped skill.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:58
Finding

Mandatory Access to Sensitive Agent Memory Outside the Declared Skill Scope

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 58–68
Vulnerability Type: Least-privilege violation through unnecessary access to persistent personal data
Risk Level: Medium

Vulnerable Code

markdown
- Interpretation/coaching remains outside this skill.

## Training Programming Reference

All programming decisions must be grounded in **Practical Programming for Strength Training** (Rippetoe & Baker, 3rd Ed.).

**Always load before giving any programming advice:**
1. `reference/practical-programming/INDEX.md` — who Joao is, relevant chapters, reading guide
2. `memory/training-continuity.md` — current lifts, recent sessions, health signals

For any programming question, read the relevant sections of `reference/practical-programming/book.md` directly. The book is the authority.

Technical Analysis

The Skill describes itself as a narrow, read-only front door for live Fitbit and training-data retrieval. It also explicitly states that interpretation and coaching are outside its scope. Despite that boundary, its instructions require the Agent to load memory/training-continuity.md, which is described as containing current lifts, recent sessions, and health signals, whenever programming advice is requested.

This requirement unnecessarily expands the information accessible to the active Agent context. It violates the principle of least privilege because the Skill can perform its documented retrieval function without loading persistent personal health and training memory. The broad instruction to “Always load” the file does not require explicit user consent, identify a minimum necessary subset, or limit how the loaded data may subsequently be used.

The reviewed files do not demonstrate that this information is transmitted externally, modified, or used to gain operating-system permissions. Therefore, the confirmed issue is unauthorized contextual access to sensitive local Agent memory rather than confirmed data exfiltration or ...[truncated 1344 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the Training Programming Reference section from this retrieval-only Skill and place coaching behavior in a separate, explicitly scoped Skill.
  2. Do not automatically load persistent personal memory. Request explicit user consent before accessing health or training-history data.
  3. Apply data minimization by reading only the specific fields and date ranges required for the current question rather than loading the entire memory file.
  4. Clearly document which local files may be accessed, why access is necessary, and whether their contents can be included in generated output.
  5. Enforce purpose limitation so retrieved health information cannot be reused for unrelated requests without renewed authorization.
  6. Where supported, replace direct file access instructions with a constrained interface that returns only approved, task-relevant fields.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding

The skill invokes external code (node ... request.js) and the analyzer detected environment-capable behavior, but the manifest declares no explicit tool scope such as permissions or allowed-tools. That creates an authorization ambiguity: an agent may treat the skill as narrower and safer than it really is, while the underlying script can access broader runtime capabilities or inherited secrets from the environment.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The manifest describes a narrow front door for live Fitbit/training retrieval via stable JSON actions, which implies request translation and data retrieval. The code additionally executes an external interpreter and script via child_process.spawnSync, introducing process-execution capability that is broader than the stated purpose and not inherent to a JSON action front door.

Content

No source excerpt is available for this finding.