Hevy

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 6:38 AM UTC
• Version: 0.0.1

Overview

This skill is a straightforward guide for using a Hevy command-line tool to read and analyze the user's fitness data, with some credential-handling and dependency-install cautions users should understand.

Install only if you are comfortable giving hevycli access to your Hevy account data. Prefer a reviewed pinned version instead of @latest, avoid printing or sharing API keys, be careful with config show and --debug output, and rotate the Hevy API key if it is ever exposed in chat, logs, or terminal output.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: Skill.md:14

Finding

Unpinned Third-Party CLI Dependency

Content

View full analysis

Vulnerability Details

File Location: Skill.md, line 14
Vulnerability Type: Unpinned third-party dependency installed from a mutable upstream source
Risk Level: Medium

Vulnerable Code Snippet:

bash

- User must have `hevycli` installed (`go install github.com/nsampre/hevycli@latest`)

Technical Analysis

The skill instructs users to install hevycli using the mutable Go version selector @latest. This does not identify a specific reviewed release or immutable commit. Consequently, the code downloaded and compiled when a user follows the instruction can differ from the code available when the skill was audited.

This creates a supply-chain risk: compromise of the upstream repository, maintainer account, release process, or a future malicious upstream change could cause attacker-controlled code to be installed and executed with the user's privileges. The project provides no version pin, checksum, signature verification, or provenance validation to establish that the installed dependency is the expected artifact.

Attack Path

1. An attacker compromises the upstream repository, a maintainer account, or its release process.
2. The attacker publishes a malicious version that resolves as the latest available release.
3. A user follows the documented prerequisite and runs:

   bash

   go install github.com/nsampre/hevycli@latest
   

4. The Go toolchain retrieves and compiles the compromised source.
5. The user subsequently executes the installed CLI while configuring an API key or accessing workout data.
6. The malicious CLI operates with the user's local privileges and may access data available to that process.

Impact Assessment

Successful exploitation could execute arbitrary code under the account running the CLI. Potentially exposed resources include the configured Hevy API key, retrieved fitness and workout records, environment variables, and files accessible to the user. Th ...[truncated 181 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest with a reviewed, explicit semantic version:

   bash

   go install github.com/nsampre/hevycli@vX.Y.Z
   

2. Prefer an immutable commit identifier if release tags cannot be trusted or independently verified.
3. Document the approved version and update it only after reviewing the relevant source changes and dependency graph.
4. Provide checksums or signed release information and require users to verify artifact integrity and provenance before installation.
5. Recommend running the CLI with least privilege and without unrelated sensitive environment variables or filesystem access.
6. Establish a periodic dependency-review process for security advisories, ownership changes, and unexpected modifications to the upstream project.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs users to set and inspect a Hevy API key and also documents a --debug flag, but it does not warn that config show may reveal stored credentials or that debug output can expose sensitive request details. In an agent-assisted context, this increases the chance that secrets are printed into chat, logs, terminal history, or telemetry where they can be copied or retained unintentionally.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.