ClawHub
Back to skill

Security audit

Hybrid training plan

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed training-plan API helper, but it also exposes API-key management endpoints that are broader than the stated fitness workflow.

Install only if you want an agent to access and update your Hybrid Training Plan account. Treat HYBRID_API_KEY as a sensitive secret, confirm before any log, complete, skip, or max update, and avoid asking the agent to create or revoke API keys unless you explicitly intend credential administration.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (10)

Tool Parameter Abuse

High
Category
Tool Misuse
Content
}
```

### DELETE /api/api-keys/:id
Revoke a key. Immediate effect — any subsequent request with this key returns 401.

**Response:** `{ "success": true }`
Confidence
88% confidence
Finding
A destructive credential-management operation (`DELETE /api/api-keys/:id`) is exposed through the same skill context as ordinary training-plan interactions. Even though revocation is user-scoped, an agent manipulated by prompt injection or parameter confusion could revoke legitimate keys, causing denial of service and disrupting integrations or user access.

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill invokes shell commands (`scripts/htp.sh`, `curl`, `jq`) but does not declare any explicit tool scope or allowed-tools boundary. That increases the chance an agent can execute shell access more broadly than intended, weakening least-privilege controls and making misuse or prompt-triggered command execution harder to constrain.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The activation text is broad enough to trigger on common fitness or workout-related conversation, potentially invoking the skill when the user only wants advice rather than API-backed account actions. In this context, accidental invocation matters because the skill can access and modify remote training-plan data tied to the user's account.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill documents commands that log sessions, mark days complete, skip days, and update 1RMs without clearly warning that these are remote, persistent account modifications. Users or agents may treat them like local note-taking actions, leading to unintended changes to training history, progression, or performance metrics.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The authentication section explains that bearer tokens and `htp_` API keys are accepted, but gives no guidance about not exposing them in logs, prompts, scripts, or shared environments. In an agent setting, omission of handling warnings can lead to credential leakage through transcripts, debugging output, or tool arguments, enabling unauthorized access to user data and actions.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The skill is described as helping users view and manage training plans, but the bundled API reference also exposes API-key lifecycle operations, including creation and revocation. Expanding a fitness/workout skill to credential management increases the chance that an agent could be induced to mint or manipulate long-lived secrets unrelated to the user’s immediate training task, which materially increases blast radius if the skill is prompt-injected or misused.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The API-key creation endpoint returns a raw key once, but the reference lacks a strong warning about the sensitivity of that credential or the consequences of exposing it. In an LLM/agent context, this is especially dangerous because the raw key may be surfaced in model output, persisted in chat history, or captured by logs, creating a reusable secret with ongoing access.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The script performs authenticated HTTP GET/POST requests using the HYBRID_API_KEY and sends request bodies to a remote API, but there is no confirmation prompt, user-facing notice, or explicit disclosure beyond terse implementation comments. For a CLI adapter that can retrieve and upload training data, users are not warned at runtime that their data will be transmitted to an external service.

External Transmission

Medium
Category
Data Exfiltration
Content
shift || true

htp_get() {
  curl -sf -H "Authorization: Bearer $API_KEY" "$API_URL$1"
}

htp_post() {
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The complete, skip, log-session, and set-max commands modify server-side data, but the script provides no confirmation prompt or explicit warning that these operations update persistent remote records. The usage text names the commands, but it does not disclose that these changes are immediate and affect stored user data.

Static analysis

No suspicious patterns detected.