onelap sync strava

• Outcome: Pass
• Latest audit: May 29, 2026 at 9:30 PM UTC
• Version:
  1.0.5

Overview

This skill is a straightforward helper for syncing Onelap cycling activities to Strava, but it requires careful handling of account and API secrets.

Install only if you are comfortable running a third-party sync binary with access to your Onelap account and Strava upload authorization. Prefer building from source or verifying the release, keep config.json local with restrictive permissions, do not commit it to source control, and revoke or rotate credentials if the file is exposed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs users to place highly sensitive credentials—Onelap account credentials and Strava API secrets—into a local config.json file without any guidance on secure storage, file permissions, exclusion from version control, or avoidance of credential reuse. In this context, the skill is specifically about authenticating to third-party services, so encouraging plaintext local secret storage increases the risk of account takeover, token abuse, and accidental leakage through backups, logs, or repository commits.

VirusTotal

63/63 vendors flagged this skill as clean.