Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Strava-to-Transition API guide; it uses sensitive fitness data, but the remote API access is disclosed and aligned with its purpose.
Install only if you are comfortable giving Transition and your agent access to Strava-linked activity data, performance metrics, profile details, prompts, and prior coach chats. Protect the TRANSITION_API_KEY like a password, revoke it if no longer needed, and review Transition's privacy and account controls before using personalized endpoints.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Try it right now — no API key needed:
curl "https://api.transition.fun/api/v1/wod?sport=run&duration=45"
For personalized features (your Strava data, training plan, AI coach), you need a Transition account + API key. See Getting an API Key below.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Try it right now — no API key needed:
curl "https://api.transition.fun/api/v1/wod?sport=run&duration=45"
For personalized features (your Strava data, training plan, AI coach), you need a Transition account + API key. See Getting an API Key below.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Try it right now — no API key needed:
curl "https://api.transition.fun/api/v1/wod?sport=run&duration=45"
For personalized features (your Strava data, training plan, AI coach), you need a Transition account + API key. See Getting an API Key below.
The README explicitly instructs users to send personalized Strava-derived data to a third-party API for analysis and coaching, but it does not provide any meaningful privacy, data-sharing, retention, or consent warning. This creates a real privacy/security risk because users may disclose sensitive health, location, and training information without understanding how that data is processed or shared.
This example instructs users to send authenticated, personalized fitness questions about their Strava data to an external API using an API key, but the README gives no adjacent warning about privacy, handling of personal training data, or potential exposure of sensitive health/location information. In the context of a fitness-data skill, this is materially more sensitive than a generic API call because the transmitted content may reveal private behavioral and health-related information.
curl -X POST -H "X-API-Key: $TRANSITION_API_KEY" \
-H "Content-Type: application/json" \
-d '{"message": "How did my long run this week compare to last week?"}' \
"https://api.transition.fun/api/v1/coach/chat"
# Get your fitness/fatigue/form metrics
curl -H "X-API-Key: $TRANSITION_API_KEY" \
This example sends authenticated performance metrics derived from a user's Strava account to an external endpoint without any explicit disclosure of privacy implications. Because performance-management metrics can reflect detailed health, training load, and activity patterns, omission of a clear data-sharing warning creates a legitimate privacy vulnerability in the documentation and user-consent flow.
curl -H "X-API-Key: $TRANSITION_API_KEY"
"https://api.transition.fun/api/v1/performance/pmc"
---
The skill encourages users to chat with and analyze Strava activity data via a remote AI service, but it does not clearly warn that personal fitness history, training patterns, and profile information will be transmitted to a third-party endpoint. This creates a real privacy risk because users or downstream agents may disclose sensitive health- and location-adjacent data without informed consent.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Generate a random structured workout — no account needed.
curl "https://api.transition.fun/api/v1/wod?sport=run&duration=45"
Parameters:
This endpoint sends free-form user messages plus authenticated access to a remote AI coach that has full context on the user's Strava activities and performance. In this skill context, that means potentially sensitive fitness, health-inference, behavioral, and historical activity data is transmitted to a third party, and the documentation does not provide adequate privacy, retention, or minimization guidance.
curl -X POST -H "X-API-Key: $TRANSITION_API_KEY"
-H "Content-Type: application/json"
-d '{"message": "How did my long run this week compare to last week?"}'
"https://api.transition.fun/api/v1/coach/chat"
Example questions:
This request retrieves scheduled workouts for a date range using an API key tied to the user's account, which means personal training schedule data is fetched from a third-party service. The transmission is part of intended functionality, but it is still a real privacy-sensitive data flow that lacks nearby warning or handling guidance.
curl -H "X-API-Key: $TRANSITION_API_KEY" \
"https://api.transition.fun/api/v1/workouts?start=2026-02-09&end=2026-02-15"
Parameters:
The PMC endpoint exposes derived fitness, fatigue, and form metrics based on the user's Strava activities. These metrics can reveal sensitive health and training-condition inferences, so sending or retrieving them from a remote service without clear privacy disclosure is a meaningful privacy vulnerability in this context.
curl -H "X-API-Key: $TRANSITION_API_KEY" \
"https://api.transition.fun/api/v1/performance/pmc"
The performance stats endpoint returns FTP, threshold paces, heart rate zones, and similar derived metrics, which are personal athletic and health-adjacent data. Because these are accessed through a remote third-party API and the skill does not foreground that sensitivity, the transmission presents a legitimate privacy risk.
curl -H "X-API-Key: $TRANSITION_API_KEY" \
"https://api.transition.fun/api/v1/performance/stats"
The athlete profile endpoint likely returns identifying profile information associated with the user's Strava-connected account. Accessing this data via a remote third-party API without explicit privacy notice or data-use constraints increases the risk of unintended exposure of personal identifiers and account-linked metadata.
curl -H "X-API-Key: $TRANSITION_API_KEY" \
"https://api.transition.fun/api/v1/profile"
The chat history endpoint involves retrieval of prior AI conversations that may contain sensitive prompts, fitness details, scheduling, and inferred health information. Exposing or normalizing access to stored conversation history without strong privacy disclosure and retention guidance is dangerous because historical chat logs often contain more sensitive context than a single request.
curl -H "X-API-Key: $TRANSITION_API_KEY" \
"https://api.transition.fun/api/v1/coach/history"
No suspicious patterns detected.