ClawHub
Back to skill

Security audit

Peloton Stats

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims: it uses Peloton credentials to fetch and print recent cycling statistics, with no hidden persistence, destructive actions, or unrelated data access found.

Install only if you are comfortable storing Peloton credentials locally for OpenClaw and allowing the skill to contact Peloton's unofficial API to retrieve workout history and metrics. Prefer the OpenClaw credential manager over manually editing files, and remove the stored profile if you stop using the skill.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (7)

Tainted flow: 'req' from os.environ.get (line 46, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
req.add_header("Content-Type", "application/json")
        if self.access_token:
            req.add_header("Authorization", f"Bearer {self.access_token}")
        with urllib.request.urlopen(req, timeout=15) as resp:
            return json.loads(resp.read())

    def _login(self, username: str, password: str):
Confidence
90% confidence
Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'req' from os.environ.get (line 46, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
req.add_header("Content-Type", "application/json")
        if self.access_token:
            req.add_header("Authorization", f"Bearer {self.access_token}")
        with urllib.request.urlopen(req, timeout=15) as resp:
            return json.loads(resp.read())

    def _login(self, username: str, password: str):
Confidence
90% confidence
Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The documented purpose focuses on reporting workout statistics, but the skill also relies on reading a local credential file and using stored username/password credentials without corresponding declared permissions. This is a real transparency and trust-boundary issue because local secret access is security-sensitive and should be explicitly disclosed and scoped.

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill declares no explicit tool scope or permissions even though its documented behavior requires access to environment variables and outbound network access. This weakens security review and consent boundaries because a user or platform may not realize the skill can read credentials and contact an external service.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The setup instructions tell users to store Peloton credentials, but the description does not clearly warn that those credentials and associated workout data will be transmitted to Peloton's external API. Even if this is expected for the service to function, failing to disclose external transmission reduces informed consent and can expose sensitive fitness-account data unexpectedly.

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
The skill reads Peloton credentials from environment variables and from a local OpenClaw auth-profiles file, which expands its access to sensitive local data beyond simple stats reporting. In an agent-skill context, undeclared credential harvesting behavior increases risk because users may not realize the skill can silently pull stored secrets and use them for outbound authentication.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The script accesses stored credentials and transmits them to Peloton without any explicit runtime warning, consent prompt, or clear disclosure about sensitive data handling. In a skill ecosystem, this is dangerous because users may invoke a seemingly harmless stats tool without understanding that it will retrieve secrets from local storage and perform authenticated network actions on their behalf.

Static analysis

No suspicious patterns detected.