Security audit
Security checks for vulnerabilities and agentic risk
This Hevy skill mostly does what it says, but it is framed as a query-only workout tool while also exposing live account-changing commands.
Review this carefully before installing if you only wanted read-only workout lookup. It needs your Hevy API key and can change data in your Hevy account when write commands are invoked, so use it only if you are comfortable with an agent having those capabilities.
The skill requires network access and an API key from the environment, but those capabilities are not surfaced as explicit permissions or constraints in the manifest. That weakens user and platform awareness of sensitive access and can lead to the skill being invoked with broader trust than warranted.
The description presents this as a query-only fitness data skill, but the documented behavior includes creating and updating workouts, routines, folders, and exercises. That mismatch can cause an agent or user to invoke the skill expecting read-only behavior while it actually mutates remote account data.
The manifest and top-level framing imply a workout-query skill, but the documentation exposes state-changing operations against the user’s Hevy account. In a tool-selection pipeline, that inconsistency increases the chance of unsafe autonomous use and unintended remote changes.
Claiming the CLI focuses on read operations downplays risk even though earlier sections document routine write commands as standard usage. This can mislead reviewers, orchestrators, or users into underestimating the possibility of remote data modification.
The skill metadata describes a read-only/query capability, but the client implements multiple state-changing operations including creating and updating workouts, routines, routine folders, and exercise templates. This creates a scope/permission mismatch that can enable unauthorized or surprising modification of a user's fitness data if higher-level guardrails assume the skill is non-destructive.
The skill metadata describes a read-only capability to query workout data, but the CLI also exposes write operations that create and modify routines, folders, and exercise templates. This capability mismatch is dangerous because an agent or user may invoke the skill under the assumption it is non-destructive, leading to unauthorized or unintended changes in the user's Hevy account.
The documentation presents account-modifying commands without a clear warning that they change live remote user data. In an agent setting, that omission increases the risk of accidental writes, especially when commands are shown as normal examples alongside read operations.
No suspicious patterns detected.
