Hevy

• Analyzed: May 12, 2026, 3:07 AM
• Findings: 1
• Version: 0.0.1
• Hash: 637d72826ca097c0e48a77c9e8439ab339daf613a2730ce8c291b757179c45b9
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is benign, providing instructions for an AI agent to interact with the `hevycli` command-line tool for fitness data analysis. All commands and instructions in `Skill.md` are directly related to querying and analyzing Hevy fitness data, including listing workouts, routines, and exercises, and exporting data to local files. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or harmful prompt injection attempts against the agent. The `go install` command for `hevycli` is a standard prerequisite setup step, not a malicious action by the skill itself.