Concept2-logbook

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 9:51 AM UTC
• Version: 1.0.0

Overview

This is a coherent Concept2 workout-analysis skill, but it handles a sensitive API token and personal fitness profile data.

Install only if you intend to let the agent use your Concept2 Logbook API token to fetch personal profile and workout data. Treat the token like a password, run the script only on a trusted machine, and rotate the token if it appears in shell history, logs, or shared terminal output. Be cautious with JSON exports because they may contain personal fitness data, and do not use the broader API reference's delete endpoints unless you explicitly intend to modify or remove Logbook records.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/fetch_workouts.py:405
• Finding: API Bearer Token Exposed Through Command-Line Arguments## Vulnerability Details **File Location**: `scripts/fetch_workouts.py:4`, `scripts/fetch_workouts.py:405`; `SKILL.md:15`, `SKILL.md:79-91` **Vulnerability Type**: Insecure credential handling through process arguments **Risk Level**: Medium ### Vulnerable Code `scripts/fetch_workouts.py:4` ```python Usage: python fetch_workouts.py --token <API_TOKEN> [options] ``` `scripts/fetch_workouts.py:405` ```python parser.add_argument("--token", required=True, help="API access token") ``` `SKILL.md:15` ```bash python3 scripts/fetch_workouts.py --token <API_TOKEN> --from-date 2026-03-01 --format table ``` `SKILL.md:79-91` ```bash # Auto-detect max HR from birthdate in profile python3 scripts/fetch_workouts.py --token <TOKEN> --from-date 2026-03-01 # Specify max HR manually python3 scripts/fetch_workouts.py --token <TOKEN> --max-hr 165 --from-date 2026-02-01 # Estimate max HR from age python3 scripts/fetch_workouts.py --token <TOKEN> --age 59 --from-date 2026-02-01 ``` ### Technical Analysis The Skill requires users to provide an OAuth2 bearer token directly through the `--token` command-line option. Command-line arguments are not an appropriate channel for long-lived or reusable secrets because they may be exposed through: - Shell history files. - Process-listing facilities such as `ps` or `/proc/<pid>/cmdline`. - Process monitoring and endpoint telemetry. - Terminal session recording. - Diagnostic logs, copied commands, and support transcripts. - Automation systems that retain executed command lines. The script subsequently sends the token only to the fixed HTTPS endpoint `https://log.concept2.com/api` in an Authorization header, which is necessary for its declared functionality. The vulnerability concerns how the secret enters the program, not the authenticated HTTPS request itself. ### Attack Path 1. A user follows the examples in `SKILL.md` and ...[truncated 1386 chars]
• Remediation: ## Remediation Suggestions 1. Replace the required `--token` argument with a protected input mechanism: - Read from a dedicated environment variable such as `CONCEPT2_API_TOKEN`. - Prompt interactively with `getpass.getpass()` so the token is not echoed. - Integrate with an operating-system credential store for persistent use. 2. If backward compatibility requires retaining `--token`, mark it as deprecated and display a warning explaining that process arguments may be visible. 3. Update every command in `SKILL.md` so it does not place a token directly in the command line. 4. Avoid printing, logging, or including the token in exception messages. 5. Recommend short-lived, minimally scoped tokens where the Concept2 API supports them. 6. Document immediate token revocation and rotation procedures for suspected exposure. A safer invocation pattern would be: ```bash export CONCEPT2_API_TOKEN='...' python3 scripts/fetch_workouts.py --from-date 2026-03-01 ``` The implementation should retrieve the value through `os.environ` and fail safely without echoing it.

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: scripts/fetch_workouts.py:417
• Finding: Unconditional Retrieval of Full User Profile Exceeds Data-Minimization Requirements## Vulnerability Details **File Location**: `scripts/fetch_workouts.py:417-423`; response fields documented in `references/api-reference.md:23-46` **Vulnerability Type**: Excessive collection of authenticated profile information **Risk Level**: Low ### Vulnerable Code `scripts/fetch_workouts.py:417-423` ```python # Get user info user = get_user_info(args.token) if "error" in user: print(f"❌ API-feil: {user.get('error', 'Ukjent feil')}", file=sys.stderr) sys.exit(1) user_data = user.get("data", {}) ``` The called function retrieves the complete current-user response: ```python def get_user_info(token): """Get authenticated user info.""" return api_request("/users/me", token) ``` The documented `/users/me` response in `references/api-reference.md` contains fields including: ```json { "data": { "id": 1, "username": "davidh", "first_name": "David", "last_name": "Hart", "gender": "M", "dob": "1977-08-19", "email": "[e-mail]", "country": "GBR", "profile_image": "http://...", "max_heart_rate": 180, "weight": 7500, "logbook_privacy": "partners" } } ``` ### Technical Analysis The script always calls `/users/me` before retrieving workouts. This occurs even when the user supplies `--max-hr` or `--age`, in which case the profile date of birth is not required for heart-rate estimation. The endpoint returns a full profile object rather than only the limited fields needed by the analysis. Depending on the selected output path, the script uses the profile for the user's name, gender, or date of birth, but it also receives unrelated values such as email, country, weight, username, and privacy settings. This is a least-data and least-privilege concern: authenticated access is used to collect more personal information than some execution paths require. The data is retained only in process memory, and no evide ...[truncated 1515 chars]
• Remediation: ## Remediation Suggestions 1. Do not retrieve `/users/me` when the selected operation does not require profile information. 2. When `--max-hr` is supplied, perform workout analysis without requesting the profile unless the user explicitly requests named output. 3. When `--age` is supplied, calculate maximum heart rate locally and avoid retrieving the date of birth. 4. Add an explicit option such as `--include-profile` or `--use-profile-dob` before accessing profile data. 5. If the API supports field selection, request only the specific fields needed for the operation. 6. Remove unrelated fields from in-memory objects as soon as possible if the endpoint cannot return a reduced representation. 7. Avoid including full API responses in exceptions, debugging output, or telemetry. 8. Document which personal fields are retrieved and why so users can make an informed decision. The preferred control flow is to fetch workouts directly and call `/users/me` only if profile-derived information is expressly required.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (12)

Credential Access

High

• Category: Privilege Escalation

Content

---
name: concept2
description: Fetch and analyze Concept2 Logbook workout data via API with pulse zone analysis and trend tracking. Use when the user wants to retrieve rowing/skiing/biking workouts, analyze heart rate zones, track training trends over time, get workout summaries with performance insights, or evaluate training effectiveness. Features include pulse zone distribution (5-zone model), weekly trend analysis, pace consistency evaluation, improvement tracking, and personalized training recommendations. Requires Concept2 API access token.
---

# Concept2 Logbook API Skill

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

---
name: concept2
description: Fetch and analyze Concept2 Logbook workout data via API with pulse zone analysis and trend tracking. Use when the user wants to retrieve rowing/skiing/biking workouts, analyze heart rate zones, track training trends over time, get workout summaries with performance insights, or evaluate training effectiveness. Features include pulse zone distribution (5-zone model), weekly trend analysis, pace consistency evaluation, improvement tracking, and personalized training recommendations. Requires Concept2 API access token.
---

# Concept2 Logbook API Skill

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

---
name: concept2
description: Fetch and analyze Concept2 Logbook workout data via API with pulse zone analysis and trend tracking. Use when the user wants to retrieve rowing/skiing/biking workouts, analyze heart rate zones, track training trends over time, get workout summaries with performance insights, or evaluate training effectiveness. Features include pulse zone distribution (5-zone model), weekly trend analysis, pace consistency evaluation, improvement tracking, and personalized training recommendations. Requires Concept2 API access token.
---

# Concept2 Logbook API Skill

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete Result
```
DELETE /users/{user}/results/{result_id}
```

#### Bulk Add Results

• Confidence: 92% confidence
• Finding: The documented DELETE /users/{user}/results/{result_id} endpoint can remove workout records, and the skill context involves authenticated access to personal logbook data. If an agent accepts attacker-influenced parameters or acts on vague instructions, this endpoint could be abused to delete arbitrary accessible results, leading to permanent integrity loss for the user's training history.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### Delete Stroke Data
```
DELETE /users/{user}/results/{result_id}/strokes
```

### File Export Endpoints

• Confidence: 90% confidence
• Finding: The DELETE /users/{user}/results/{result_id}/strokes endpoint removes detailed per-stroke telemetry, which may be important for later analysis, trend tracking, or auditability. In this skill, where pulse-zone and performance analysis depend on detailed workout data, parameter abuse or prompt injection could silently destroy the data needed for future insights and degrade trust in the system.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill documents network/API access but does not declare an explicit tool or permission scope. That creates a governance gap where an agent may invoke network-capable behavior without clear least-privilege boundaries or user-visible authorization constraints.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The activation text is broad enough to match generic fitness, training, or workout-analysis requests beyond narrowly scoped Concept2 logbook use. Overbroad routing can trigger unnecessary access to external account data or token-handling flows when the user did not explicitly ask for Concept2 retrieval.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill instructs retrieval of authenticated user profile and workout data, including birthdate-derived HR calculations, without a clear privacy warning or data-handling notice. This can lead to collection and processing of personal fitness and profile information without adequate disclosure, minimization, or consent framing.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The reference documents destructive endpoints that delete workout results and stroke data but provides no cautionary guidance, confirmation requirements, or notes about irreversible effects. In an agent skill context, this increases the chance that an LLM-enabled tool could invoke deletion from ambiguous or manipulated user prompts, causing unintended loss of user fitness data.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The skill contains extensive hardcoded Norwegian labels and messages for heart-rate zones, summaries, errors, and recommendations. This forces a specific language/locale on all users with no opt-in or configuration, which matches the language/locale policy violation criteria.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This code sends the provided bearer token in an Authorization header to a remote API and retrieves user profile and workout data. Although the module docstring mentions API usage, there is no explicit warning in code comments, prompts, or user-facing output that credentials and personal fitness data will be transmitted over the network.

Natural-Language Policy Violations

Low

• Confidence: 97% confidence
• Finding: The pulse zone and pace-consistency sections use Norwegian terms such as 'Restitusjon,' 'Aerob kapasitet,' 'Anaerob terskel,' 'Jevn,' and 'Ujevn.' This imposes a language choice in user-facing content without opt-in or explanation, which is a natural-language locale policy concern.

Static analysis

No suspicious patterns detected.