Concept2-logbook

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 9:51 AM UTC
• Version: 1.0.0

Overview

This is a coherent Concept2 workout-analysis skill, but it handles a sensitive API token and personal fitness profile data.

Install only if you intend to let the agent use your Concept2 Logbook API token to fetch personal profile and workout data. Treat the token like a password, run the script only on a trusted machine, and rotate the token if it appears in shell history, logs, or shared terminal output. Be cautious with JSON exports because they may contain personal fitness data, and do not use the broader API reference's delete endpoints unless you explicitly intend to modify or remove Logbook records.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/fetch_workouts.py:405

Finding

API Bearer Token Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: scripts/fetch_workouts.py:4, scripts/fetch_workouts.py:405; SKILL.md:15, SKILL.md:79-91
Vulnerability Type: Insecure credential handling through process arguments
Risk Level: Medium

Vulnerable Code

scripts/fetch_workouts.py:4

python

Usage: python fetch_workouts.py --token <API_TOKEN> [options]

scripts/fetch_workouts.py:405

python

parser.add_argument("--token", required=True, help="API access token")

SKILL.md:15

bash

python3 scripts/fetch_workouts.py --token <API_TOKEN> --from-date 2026-03-01 --format table

SKILL.md:79-91

bash

# Auto-detect max HR from birthdate in profile
python3 scripts/fetch_workouts.py --token <TOKEN> --from-date 2026-03-01

# Specify max HR manually
python3 scripts/fetch_workouts.py --token <TOKEN> --max-hr 165 --from-date 2026-02-01

# Estimate max HR from age
python3 scripts/fetch_workouts.py --token <TOKEN> --age 59 --from-date 2026-02-01

Technical Analysis

The Skill requires users to provide an OAuth2 bearer token directly through the --token command-line option. Command-line arguments are not an appropriate channel for long-lived or reusable secrets because they may be exposed through:

• Shell history files.
• Process-listing facilities such as ps or /proc/<pid>/cmdline.
• Process monitoring and endpoint telemetry.
• Terminal session recording.
• Diagnostic logs, copied commands, and support transcripts.
• Automation systems that retain executed command lines.

The script subsequently sends the token only to the fixed HTTPS endpoint https://log.concept2.com/api in an Authorization header, which is necessary for its declared functionality. The vulnerability concerns how the secret enters the program, not the authenticated HTTPS request itself.

Attack Path

1. A user follows the examples in SKILL.md and ...[truncated 1386 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the required --token argument with a protected input mechanism:
   • Read from a dedicated environment variable such as CONCEPT2_API_TOKEN.
   • Prompt interactively with getpass.getpass() so the token is not echoed.
   • Integrate with an operating-system credential store for persistent use.
2. If backward compatibility requires retaining --token, mark it as deprecated and display a warning explaining that process arguments may be visible.
3. Update every command in SKILL.md so it does not place a token directly in the command line.
4. Avoid printing, logging, or including the token in exception messages.
5. Recommend short-lived, minimally scoped tokens where the Concept2 API supports them.
6. Document immediate token revocation and rotation procedures for suspected exposure.

A safer invocation pattern would be:

bash

export CONCEPT2_API_TOKEN='...'
python3 scripts/fetch_workouts.py --from-date 2026-03-01

The implementation should retrieve the value through os.environ and fail safely without echoing it.

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: scripts/fetch_workouts.py:417

Finding

Unconditional Retrieval of Full User Profile Exceeds Data-Minimization Requirements

Content

View full analysis

Vulnerability Details

File Location: scripts/fetch_workouts.py:417-423; response fields documented in references/api-reference.md:23-46
Vulnerability Type: Excessive collection of authenticated profile information
Risk Level: Low

Vulnerable Code

scripts/fetch_workouts.py:417-423

python

# Get user info
user = get_user_info(args.token)
if "error" in user:
    print(f"❌ API-feil: {user.get('error', 'Ukjent feil')}", file=sys.stderr)
    sys.exit(1)

user_data = user.get("data", {})

The called function retrieves the complete current-user response:

python

def get_user_info(token):
    """Get authenticated user info."""
    return api_request("/users/me", token)

The documented /users/me response in references/api-reference.md contains fields including:

json

{
  "data": {
    "id": 1,
    "username": "davidh",
    "first_name": "David",
    "last_name": "Hart",
    "gender": "M",
    "dob": "1977-08-19",
    "email": "[e-mail]",
    "country": "GBR",
    "profile_image": "http://...",
    "max_heart_rate": 180,
    "weight": 7500,
    "logbook_privacy": "partners"
  }
}

Technical Analysis

The script always calls /users/me before retrieving workouts. This occurs even when the user supplies --max-hr or --age, in which case the profile date of birth is not required for heart-rate estimation.

The endpoint returns a full profile object rather than only the limited fields needed by the analysis. Depending on the selected output path, the script uses the profile for the user's name, gender, or date of birth, but it also receives unrelated values such as email, country, weight, username, and privacy settings.

This is a least-data and least-privilege concern: authenticated access is used to collect more personal information than some execution paths require. The data is retained only in process memory, and no evide ...[truncated 1515 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not retrieve /users/me when the selected operation does not require profile information.
2. When --max-hr is supplied, perform workout analysis without requesting the profile unless the user explicitly requests named output.
3. When --age is supplied, calculate maximum heart rate locally and avoid retrieving the date of birth.
4. Add an explicit option such as --include-profile or --use-profile-dob before accessing profile data.
5. If the API supports field selection, request only the specific fields needed for the operation.
6. Remove unrelated fields from in-memory objects as soon as possible if the endpoint cannot return a reduced representation.
7. Avoid including full API responses in exceptions, debugging output, or telemetry.
8. Document which personal fields are retrieved and why so users can make an informed decision.

The preferred control flow is to fetch workouts directly and call /users/me only if profile-derived information is expressly required.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (12)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: concept2
description: Fetch and analyze Concept2 Logbook workout data via API with pulse zone analysis and trend tracking. Use when the user wants to retrieve rowing/skiing/biking workouts, analyze heart rate zones, track training trends over time, get workout summaries with performance insights, or evaluate training effectiveness. Features include pulse zone distribution (5-zone model), weekly trend analysis, pace consistency evaluation, improvement tracking, and personalized training recommendations. Requires Concept2 API access token.
---

# Concept2 Logbook API Skill

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md

---
name: concept2
description: Fetch and analyze Concept2 Logbook workout data via API with pulse zone analysis and trend tracking. Use when the user wants to retrieve rowing/skiing/biking workouts, analyze heart rate zones, track training trends over time, get workout summaries with performance insights, or evaluate training effectiveness. Features include pulse zone distribution (5-zone model), weekly trend analysis, pace consistency evaluation, improvement tracking, and personalized training recommendations. Requires Concept2 API access token.
---

# Concept2 Logbook API Skill

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/fetch_workouts.py (reported line 403)May include surrounding context.

python

---
name: concept2
description: Fetch and analyze Concept2 Logbook workout data via API with pulse zone analysis and trend tracking. Use when the user wants to retrieve rowing/skiing/biking workouts, analyze heart rate zones, track training trends over time, get workout summaries with performance insights, or evaluate training effectiveness. Features include pulse zone distribution (5-zone model), weekly trend analysis, pace consistency evaluation, improvement tracking, and personalized training recommendations. Requires Concept2 API access token.
---

# Concept2 Logbook API Skill

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 92% confidence

Finding

The documented DELETE /users/{user}/results/{result_id} endpoint can remove workout records, and the skill context involves authenticated access to personal logbook data. If an agent accepts attacker-influenced parameters or acts on vague instructions, this endpoint could be abused to delete arbitrary accessible results, leading to permanent integrity loss for the user's training history.

Content

Scanner excerpt · references/api-reference.md (reported line 146)May include surrounding context.

Delete Result

text

DELETE /users/{user}/results/{result_id}

Bulk Add Results

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

The DELETE /users/{user}/results/{result_id}/strokes endpoint removes detailed per-stroke telemetry, which may be important for later analysis, trend tracking, or auditability. In this skill, where pulse-zone and performance analysis depend on detailed workout data, parameter abuse or prompt injection could silently destroy the data needed for future insights and degrade trust in the system.

Content

Scanner excerpt · references/api-reference.md (reported line 187)May include surrounding context.

Delete Stroke Data

text

DELETE /users/{user}/results/{result_id}/strokes

File Export Endpoints

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill documents network/API access but does not declare an explicit tool or permission scope. That creates a governance gap where an agent may invoke network-capable behavior without clear least-privilege boundaries or user-visible authorization constraints.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The activation text is broad enough to match generic fitness, training, or workout-analysis requests beyond narrowly scoped Concept2 logbook use. Overbroad routing can trigger unnecessary access to external account data or token-handling flows when the user did not explicitly ask for Concept2 retrieval.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs retrieval of authenticated user profile and workout data, including birthdate-derived HR calculations, without a clear privacy warning or data-handling notice. This can lead to collection and processing of personal fitness and profile information without adequate disclosure, minimization, or consent framing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The reference documents destructive endpoints that delete workout results and stroke data but provides no cautionary guidance, confirmation requirements, or notes about irreversible effects. In an agent skill context, this increases the chance that an LLM-enabled tool could invoke deletion from ambiguous or manipulated user prompts, causing unintended loss of user fitness data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill contains extensive hardcoded Norwegian labels and messages for heart-rate zones, summaries, errors, and recommendations. This forces a specific language/locale on all users with no opt-in or configuration, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code sends the provided bearer token in an Authorization header to a remote API and retrieves user profile and workout data. Although the module docstring mentions API usage, there is no explicit warning in code comments, prompts, or user-facing output that credentials and personal fitness data will be transmitted over the network.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The pulse zone and pace-consistency sections use Norwegian terms such as 'Restitusjon,' 'Aerob kapasitet,' 'Anaerob terskel,' 'Jevn,' and 'Ujevn.' This imposes a language choice in user-facing content without opt-in or explanation, which is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.