ClawHub
Back to skill

Security audit

Fitness Personal Assistant

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its fitness-tracking purpose, but it needs review because it stores Intervals.icu API credentials locally while falsely claiming the credential folder is gitignored.

Review this before installing if you are not comfortable storing an Intervals.icu API key in a local plaintext config file. Do not commit or share the skill directory after first run unless you add a real .gitignore or move credentials outside the project; revoke and rotate the API key if it may have been exposed. Use dry-run mode for meal parsing until you are ready to write wellness data to Intervals.icu.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/intervals_api_client.py:252
Finding

API Credentials May Be Committed Because the Documented Git Exclusion Is Missing

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (36)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

代码的核心行为是调用 Intervals.icu 客户端的 get_athlete_summary、get_wellness 和 get_activities 等读取接口，随后基于训练负荷、HRV、静息心率、睡眠、营养和近7天活动生成一份详细文本报告并输出到终端。它没有把饮食记录或身体状态“同步到 intervals.icu”的逻辑，也没有看到新增/更新远端数据的 API 调用，因此与声明的主要目的存在实质偏差。虽然代码包含基本错误处理（客户端创建失败、连接失败），这一点与声明部分一致，但不足以覆盖其对‘自动同步’和‘配置引导’的缺失。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding

声明强调的是“自动同步饮食记录和身体状态到 intervals.icu”，其中“身体状态”部分与 wellness 数据读写、配置引导、错误处理基本一致，但代码中没有任何饮食记录相关字段、接口或同步逻辑，因此核心描述存在缺失。同时，代码的实际重点更像是一个通用的 Intervals.icu API 客户端/测试工具：它不仅读取 wellness，还查询 athlete summary、活动列表、活动详情，并支持上传活动文件。这些能力超出了声明的一体化健身追踪同步描述。另有交互式输入 API 凭证并保存到本地配置文件的行为，虽可视为配置支持的一部分，但也属于实际实现中的重要能力。综合来看，描述未准确覆盖代码真实功能，且宣称的饮食同步并未实现，应判定为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
84% confidence
Finding

声明描述较宽泛，声称是“一体化健身追踪系统”，可自动同步“饮食记录和身体状态”到 intervals.icu，并支持配置引导和错误处理。但给出的代码块实际只实现了饮食记录上传：解析中文自然语言或 JSON 输入，估算卡路里、蛋白质、碳水和脂肪，然后调用 intervals.icu 客户端更新 wellness 摄入相关字段和 comments。代码确实有一定错误处理（如客户端创建失败、连接失败、参数缺失），但没有看到身体状态数据采集/同步逻辑，也没有看到配置引导流程。因此描述与实际行为存在实质性夸大，尤其在主要能力范围上不一致。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

描述强调的是“健身追踪系统”以及“自动同步饮食记录和身体状态到 intervals.icu”。但提供的代码仅实现了食物文本解析和营养计算：包括调用 OpenFoodFacts API、匹配本地中文食物规则、以及可选的命令行交互式补录。代码中没有 intervals.icu 相关接口、认证、同步逻辑、身体状态数据处理、配置向导或系统级错误处理框架。因此其主要行为与声明用途存在明显偏差。另外，虽然网络请求是实现细节的一部分，但这里还访问了一个与声明目标不一致的外部资源（OpenFoodFacts 而非 intervals.icu），进一步说明描述与实际代码不符。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

声明强调的是一个会把饮食记录和身体状态自动同步到 intervals.icu 的健身追踪系统，但该代码块实际没有展示任何向 intervals.icu 写入数据的操作，也没有同步流程、定时/触发机制、配置向导或完善的异常处理。相反，代码核心是从 Intervals.icu 读取 athlete summary、wellness 和 activities 数据，并生成职业运动员级分析报告，包括 readiness 评分、表现预测、训练计划和营养目标。也就是说，实际主用途是分析与决策支持，而不是数据同步，因此描述与行为存在明显不一致。

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · scripts/body-status-reporter.py (reported line 382)May include surrounding context.

python
type_ = act.get("type", "Unknown")
            date_str = act.get("start_date_local", "")[:10] if act.get("start_date_local") else "Unknown"
            duration = act.get("icu_recording_time") or act.get("moving_time") or 0
            load = act.get("icu_training_load", 0)
            calories = act.get("calories", 0)
            
            emoji_map = {"tennis": "🎾", "stair": "🧗‍♂️", "walk": "🚶", "ride": "🚴", "run": "🏃", "swim": "🏊"}
            emoji = emoji_map.get(type_.lower(), "📅")
            
            duration_min = duration / 60
            
            report.append(f"[{date_str}] {emoji} {name}")
            report.append(f"        {duration_min:.0f}分钟 | 负荷{load} | {calories:.0f}kcal")
        report.append("")
    
    # 6. 今日行动指南
    report.append("───────────────────\n")
    report.append("💡 今日行动指南\n\n")
    
    recommendations = []
    
    if tsb and tsb <

Lp1

High
Category
MCP Least Privilege
Confidence
91% confidence
Finding

This code uses environment access, file writes, and outbound network access, but the declared skill permissions reportedly do not cover those capabilities. In a skill ecosystem, undeclared sensitive capabilities are dangerous because they prevent informed user consent and can enable unexpected secret handling and external data transmission.

Content

No source excerpt is available for this finding.

Lp1

High
Category
MCP Least Privilege
Confidence
91% confidence
Finding

This code uses environment access, file writes, and outbound network access, but the declared skill permissions reportedly do not cover those capabilities. In a skill ecosystem, undeclared sensitive capabilities are dangerous because they prevent informed user consent and can enable unexpected secret handling and external data transmission.

Content

No source excerpt is available for this finding.

Lp1

High
Category
MCP Least Privilege
Confidence
91% confidence
Finding

This code uses environment access, file writes, and outbound network access, but the declared skill permissions reportedly do not cover those capabilities. In a skill ecosystem, undeclared sensitive capabilities are dangerous because they prevent informed user consent and can enable unexpected secret handling and external data transmission.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

Line L108 states '中文注释说明关键逻辑', which directs contributors to use Chinese for explanatory comments. This is a natural-language locale requirement, and the document does not offer an opt-in choice or explain a justified region-specific need for enforcing Chinese.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The README’s descriptive and operational text is entirely in Chinese, including the skill description, setup notes, usage examples, and safety information. This imposes a specific language on users without indicating that language selection is optional or that the skill is intended only for a Chinese-speaking audience.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Broad and ambiguous activation examples can cause unintended invocation of the skill from ordinary conversation, leading to accidental processing of sensitive health or diet information. In a message-driven environment, weak invocation boundaries increase the risk of unexpected network actions, credential prompts, or data synchronization under the wrong context.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Natural-language triggers like '查看我的身体状态' overlap heavily with ordinary chat, making accidental activation plausible. Because this skill handles health data and may contact external APIs, unintended execution can expose private information or perform actions users did not mean to initiate.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 359)May include surrounding context.

md
| **加密级别** | Basic Auth (HTTP Header Authorization) |
| **传输安全** | HTTPS TLS 1.2+ 加密传输 |
| **存储位置** | `~/.openclaw/workspace/skills/fitness-personal-assistant/config/config.json` |
| **文件权限** | `600` (仅所有者可读/写，`chmod 600 config.json`) |
| **Git 状态** | ✅ 已忽略 (`config/` 在 `.gitignore`) |
| **磁盘加密** | 依赖系统级加密 (macOS FileVault / Windows BitLocker) |

File System Enumeration

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 395)May include surrounding context.

  1. ✅ 已自动 gitignore - config/ 目录不会提交到 GitHub
  2. ⚠️ 检查文件权限:
    bash
    ls -l ~/.openclaw/workspace/skills/fitness-personal-assistant/config/config.json
# 应为：-rw------- (600)
chmod 600 ~/.openclaw/workspace/skills/fitness-personal-assistant/config/config.json

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 397)May include surrounding context.

bash
   ls -l ~/.openclaw/workspace/skills/fitness-personal-assistant/config/config.json
   # 应为：-rw------- (600)
   chmod 600 ~/.openclaw/workspace/skills/fitness-personal-assistant/config/config.json
  1. 🔒 使用环境变量 (最安全):
    bash

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file documents API authentication and endpoints for athlete wellness, activities, and summaries, including weight, resting heart rate, sleep, and HRV data. Under SQP-2 for markdown files, descriptions that involve user data and privacy-impacting behavior should warn users about handling sensitive personal data, but no such warning appears here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This Python file contains its top-level description and all user-facing report strings exclusively in Chinese, indicating the skill is designed to operate in a fixed language/locale. The policy allows locale constraints only when users are given a choice or the restriction is clearly documented and justified; neither is present here.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

总结部分在条件满足时写入了硬编码数值“(-10.7)”和“(5.3h)”，而前文实际是基于实时 TSB 和睡眠时长计算并展示报告。这会让代码生成的说明与真实数据相矛盾，属于文档/输出意图和实际行为的不一致。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This code file contains natural-language descriptions and runtime prompts exclusively in Chinese, including the module docstring and later interactive messages. The policy for this audit flags language or locale constraints when a skill forces a specific language without offering an explicit choice or documenting a justified regional limitation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill description says it synchronizes diet logs and body status, but this module also supports uploading workout activity files to Intervals.icu. That scope expansion matters because activity files can contain sensitive location, timing, and exercise telemetry, so users may authorize the skill without realizing it can transmit a broader class of personal data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The script persists the API key to disk during an interactive flow without clearly warning the user first. Even though it later applies restrictive permissions, users may unknowingly store sensitive credentials on shared or backed-up systems, increasing the chance of secret disclosure through local compromise, backup leakage, or misplaced config directories.

Content

No source excerpt is available for this finding.

Tainted flow: 'CONFIG_FILE' from os.environ.get (line 26, credential/environment) → open (file write)

Medium
Category
Data Flow
Confidence
87% confidence
Finding

The config file path is influenced by the BODY_MANAGEMENT_DATA environment variable and is later used for credential writes. If an attacker can control the environment in which this script runs, they can redirect the API key to an unintended location, overwrite other files accessible to the process, or cause secrets to be stored in an unsafe directory.

Content

Scanner excerpt · scripts/intervals_api_client.py (reported line 259)May include surrounding context.

python
}
    
    STORAGE_PATH.mkdir(parents=True, exist_ok=True)
    with open(CONFIG_FILE, 'w') as f:
        json.dump(config, f, indent=2)
    
    os.chmod(CONFIG_FILE, 0o600)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The docstring explicitly says the tool supports natural-language input in Chinese only. Under the policy, forcing a specific language without offering a choice or documenting a justified locale limitation is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The API query function hard-codes the default language preference to "zh", and the overall skill text and interaction are written in Chinese without exposing a language choice. This can violate language/locale policy when a specific language is imposed rather than selected by the user.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.