Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- dist/process.js:75
- Evidence
const child = spawn(binary, args, { cwd, env: childEnvironment(), shell: false,
Security audit
FitAgent
Security checks for vulnerabilities and agentic risk
Overview
The plugin’s fitness-data access and workout-calendar changes are clearly disclosed and controlled by bounded previews and confirmation requirements.
Install the separate CLI from a source you trust and configure the intended workspace. Enter credentials only in the private setup terminal. Review each calendar preview before approving a sync; confirmation tokens verify a matching preview, not human consent. Protect locally stored fitness data, and remember that uninstalling does not undo calendar changes or remove credentials.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
Detected: suspicious.dangerous_exec