ClawHub
Back to skill

Security audit

onelap sync strava

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward helper for syncing Onelap cycling activities to Strava, but it requires careful handling of account and API secrets.

Install only if you are comfortable running a third-party sync binary with access to your Onelap account and Strava upload authorization. Prefer building from source or verifying the release, keep config.json local with restrictive permissions, do not commit it to source control, and revoke or rotate credentials if the file is exposed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill instructs users to place highly sensitive credentials—Onelap account credentials and Strava API secrets—into a local config.json file without any guidance on secure storage, file permissions, exclusion from version control, or avoidance of credential reuse. In this context, the skill is specifically about authenticating to third-party services, so encouraging plaintext local secret storage increases the risk of account takeover, token abuse, and accidental leakage through backups, logs, or repository commits.

Static analysis

No suspicious patterns detected.