T09 · Insecure Skill Coding Practices
Error
- Location
mcp/main.go:12- Finding
API Key Can Be Transmitted to an Arbitrary Configured Server
- Content
View full analysis
- Remediation
View remediation
Security audit
Transition MCP
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent Transition coaching API wrapper, but it has under-disclosed credential and data-routing risks that users should review before installing.
Install only if you trust Transition with your workout history, profile, performance metrics, coach-chat messages, and any health-related details you provide. Keep TRANSITION_API_KEY private, avoid setting TRANSITION_API_URL unless you are intentionally using a trusted endpoint, and explicitly approve plan changes or third-party pushes such as Garmin before running them.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
mcp/client.go:21- Finding
Custom Authentication Header May Be Forwarded Across Redirects
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
mcp/client.go:47- Finding
Unbounded API and SSE Response Buffering Enables Memory Exhaustion
- Content
View full analysis
= 400 { return "", fmt.Errorf("API error %d: %s", resp.StatusCode, string(data)) } return string(data), nil } ``` ```go // mcp/client.go:68-93 func (tc *TransitionClient) Post(path string, body interface{}) (string, error) { var reader io.Reader if body != nil { jsonData, err := json.Marshal(body) if err != nil { return "", fmt.Errorf("failed to marshal body: %w", err) } reader = strings.NewReader(string(jsonData)) } resp, err := tc.doRequest("POST", path, reader) if err != nil { return "", fmt.Errorf("request failed: %w", err) } defer resp.Body.Close() data, err := io.ReadAll(resp.Body) if err != nil { return "", fmt.Errorf("failed to read response: %w", err) } if resp.StatusCode >= 400 { return "", fmt.Errorf("API error %d: %s", resp.StatusCode, string(data)) } return string(data), nil } ``` ```go // mcp/client.go:109-137 if resp.StatusCode >= 400 { data, _ := io.ReadAll(resp.Body) return "", fmt.Errorf("API error %d: %s", resp.StatusCode, string(data)) } // Check if this is actually an SSE response contentType := resp.Header.Get("Content-Type") if !strings.Contains(contentType, "text/event-stream") { // Not SSE, just read the whole body data, err := io.ReadAll(resp.Body) if err != nil { retur ...[truncated 1950 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Note
- Location
mcp/tools.go:117- Finding
Workout Generator Constructs Query Strings Without Input Validation or Encoding
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (28)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description promises an AI coaching capability focused on personalized workouts, training plans, and performance analytics for endurance sports. The supplied code does not implement any of that domain logic. Instead, it is a reusable network client that sends HTTP requests to a configurable base URL, optionally authenticates with an X-API-Key header, and reads standard JSON or SSE responses. This is a materially different primary purpose from multisport coaching. While API access could be a supporting detail if the surrounding code clearly implemented coaching features, this chunk itself only exposes generic transport functionality and accesses an external service not described in the skill purpose. Therefore, the description does not accurately represent the actual behavior shown.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared purpose is a multisport coaching assistant focused on workouts, training plans, and performance analytics. The supplied code instead sets up an MCP server connected to a 'Transition' API using environment-provided credentials and URL. There is no visible logic related to running, cycling, swimming, triathlon, coaching, analytics, or athlete personalization. While this is only a bootstrap file, the observable primary purpose is infrastructure for a Transition service, which does not accurately represent the declared coaching functionality.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Try it right now — no API key needed:
bash curl "https://api.transition.fun/api/v1/wod?sport=run&duration=45"For personalized features (your training plan, performance data, AI coach), you need a Transition account + API key. See Getting an API Key below.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Try it right now — no API key needed:
bash curl "https://api.transition.fun/api/v1/wod?sport=run&duration=45"For personalized features (your training plan, performance data, AI coach), you need a Transition account + API key. See Getting an API Key below.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Try it right now — no API key needed:
bash curl "https://api.transition.fun/api/v1/wod?sport=run&duration=45"For personalized features (your training plan, performance data, AI coach), you need a Transition account + API key. See Getting an API Key below.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Try it right now — no API key needed:
bash curl "https://api.transition.fun/api/v1/wod?sport=run&duration=45"For personalized features (your training plan, performance data, AI coach), you need a Transition account + API key. See Getting an API Key below.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Try it right now — no API key needed:
bash curl "https://api.transition.fun/api/v1/wod?sport=run&duration=45"For personalized features (your training plan, performance data, AI coach), you need a Transition account + API key. See Getting an API Key below.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Try it right now — no API key needed:
bash curl "https://api.transition.fun/api/v1/wod?sport=run&duration=45"For personalized features (your training plan, performance data, AI coach), you need a Transition account + API key. See Getting an API Key below.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Try it right now — no API key needed:
bash curl "https://api.transition.fun/api/v1/wod?sport=run&duration=45"For personalized features (your training plan, performance data, AI coach), you need a Transition account + API key. See Getting an API Key below.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Try it right now — no API key needed:
bash curl "https://api.transition.fun/api/v1/wod?sport=run&duration=45"For personalized features (your training plan, performance data, AI coach), you need a Transition account + API key. See Getting an API Key below.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Try it right now — no API key needed:
bash curl "https://api.transition.fun/api/v1/wod?sport=run&duration=45"For personalized features (your training plan, performance data, AI coach), you need a Transition account + API key. See Getting an API Key below.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Try it right now — no API key needed:
bash curl "https://api.transition.fun/api/v1/wod?sport=run&duration=45"For personalized features (your training plan, performance data, AI coach), you need a Transition account + API key. See Getting an API Key below.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Try it right now — no API key needed:
bash curl "https://api.transition.fun/api/v1/wod?sport=run&duration=45"For personalized features (your training plan, performance data, AI coach), you need a Transition account + API key. See Getting an API Key below.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Try it right now — no API key needed:
bash curl "https://api.transition.fun/api/v1/wod?sport=run&duration=45"For personalized features (your training plan, performance data, AI coach), you need a Transition account + API key. See Getting an API Key below.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Try it right now — no API key needed:
bash curl "https://api.transition.fun/api/v1/wod?sport=run&duration=45"For personalized features (your training plan, performance data, AI coach), you need a Transition account + API key. See Getting an API Key below.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Try it right now — no API key needed:
bash curl "https://api.transition.fun/api/v1/wod?sport=run&duration=45"For personalized features (your training plan, performance data, AI coach), you need a Transition account + API key. See Getting an API Key below.
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The README encourages users to access personalized workouts, performance data, and AI coaching through a remote service but does not clearly warn that sensitive health, training, and performance information will be transmitted to a third-party API. In a coaching skill context, this omission matters because users may share injury details, schedules, and athlete metrics without understanding the privacy implications.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The README advertises plan adaptation and AI coaching features without warning that these actions may modify recommendations derived from user data or trigger remote processing of athlete history and health-related context. This can mislead users into invoking impactful features without informed consent about data use or the consequences of automated coaching outputs.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
3. Direct API
Use the API from scripts, automations, or any HTTP client. See SKILL.md for complete endpoint documentation with curl examples.
bash # Get this week's workouts
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 74% confidence
- Finding
The coach chat example encourages sending a health-related prompt ('My left knee hurts...') to a remote AI endpoint without warning that medical-adjacent or injury information will be transmitted off-device. In this skill context, that increases privacy and safety risk because users may disclose sensitive health information and over-rely on non-medical AI advice.
- Content
curl -X POST -H "X-API-Key: $TRANSITION_API_KEY"
-H "Content-Type: application/json"
-d '{"message": "My left knee hurts after long runs. Should I adjust my plan?"}'
"https://api.transition.fun/api/v1/coach/chat"text ---
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 74% confidence
- Finding
The skill documents use of environment-based secrets and shell/curl interactions with an external API but do not declare any explicit tool scope or permissions boundary. This increases the chance that an agent runtime grants broader capabilities than users expect, especially where API keys and outbound requests are involved.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill transmits sensitive training history, athlete profile information, and coach-chat content to an external service, but it does not prominently warn users about data sharing, retention, or privacy implications. In a coaching context, this data can reveal health, schedule, and behavioral information that users may not expect to leave the agent environment.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Generate a random structured workout. Each request returns a different workout.
bash curl "https://api.transition.fun/api/v1/wod?sport=run&duration=45"Parameters:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The Garmin push operation can modify or synchronize data with a third-party account, but the skill does not warn that this is an external side-effecting action. Users may unintentionally trigger changes in connected services if the agent performs this action without explicit confirmation.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh echo "" echo "=== AI Coach Chat ===" curl -s -X POST -H "X-API-Key: $KEY" \ -H "Content-Type: application/json" \ -d '{"message": "What should I focus on this week?"}' \ "$BASE/api/v1/coach/chat"
Static analysis
No suspicious patterns detected.