Intervals Icu Api

• Outcome: Pass
• Latest audit: Jul 10, 2026 · 2:24 AM UTC
• Version: 2.0.1

Overview

This is a coherent Intervals.icu API guide, but users should be careful because its examples can change real training and wellness records.

Install only if you intend to let the agent help with your Intervals.icu account. Use environment variables or a secret manager for API keys, avoid pasting tokens into shared chats or logs, and require explicit confirmation before any POST, PUT, bulk, settings, wellness, or DELETE operation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README explicitly promotes creating, updating, bulk-uploading, and deleting training and wellness data but does not warn that these are state-changing operations against a real personal account. In an agent skill context, omission of confirmation and safety guidance increases the chance that an automated system or user will modify or destroy personal data unintentionally.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The authentication section shows direct use of API keys and bearer tokens in curl commands without any warning about secret handling, shell history, screenshots, logs, or secure storage. In a skill intended to be copied into terminals or automated agents, this can lead to credential leakage and subsequent unauthorized access to the athlete account.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill exposes read and bulk-update operations for wellness data, which can include sensitive health-adjacent information such as sleep, fatigue, resting HR, soreness, and notes, but it does not warn operators that this data is privacy-sensitive or that updates can overwrite personal records. In an agent context, omission of privacy and consent guidance increases the risk of unnecessary collection, broad export, or unintended modification of sensitive athlete data.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill provides numerous POST and PUT examples that create or modify activities, workouts, events, targets, and settings, but it lacks prominent cautions that these are write operations with persistent effects on an athlete's history and planning data. In an agent-assisted workflow, this can lead to accidental data corruption, duplicate entries, hidden events, or unauthorized plan changes if the agent invokes write-capable examples without explicit user confirmation.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

- `GET /athlete/{id}/events` - List planned workouts
- `POST /athlete/{id}/events` - Create event
- `PUT /athlete/{id}/events/{eventId}` - Update event
- `DELETE /athlete/{id}/events/{eventId}` - Delete event
- `POST /athlete/{id}/events/bulk` - Bulk create events

### Wellness

• Confidence: 88% confidence
• Finding: DELETE /athlete/{id}/events/{eventId}`

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.