Intervals Icu Api

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:48 AM UTC
• Version: 2.0.1

Overview

The skill is a coherent Intervals.icu API guide, but it documents live credentialed writes, bulk updates, and deletion-capable account operations without clear safety guidance.

Review this skill before using it with a real Intervals.icu account. Keep API keys and OAuth tokens out of chat transcripts, shell history, screenshots, and saved scripts where possible. Treat POST, PUT, bulk, hide/lock, sport-setting, wellness, and DELETE operations as live account changes: list and verify target records first, confirm athlete and event IDs, and keep a backup or export before destructive or bulk actions.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:591
• Finding: API Credentials Exposed Through Shell Scripts, Command Arguments, and Command History## Vulnerability Details **File Location**: `SKILL.md:591-604`, `SKILL.md:617-617`, `SKILL.md:666-670`, `SKILL.md:679-683`, and `README.md:30-37` **Vulnerability Type**: Insecure credential handling **Risk Level**: Low ### Vulnerable Code `SKILL.md:591-604`: ```bash API_KEY="YOUR_API_KEY" DATE="2024-01-15" # 1. Get completed activities ACTIVITIES=$(curl -s -H "Authorization: ApiKey $ATHLETE_ID:$API_KEY" \ "https://intervals.icu/api/v1/athlete/$ATHLETE_ID/activities?oldest=$DATE&newest=$DATE&fields=id,name,type,distance,icu_training_load") # 2. Get planned workouts for today EVENTS=$(curl -s -H "Authorization: ApiKey $ATHLETE_ID:$API_KEY" \ "https://intervals.icu/api/v1/athlete/$ATHLETE_ID/events?oldest=$DATE&newest=$DATE&category=WORKOUT") # 3. Get wellness data WELLNESS=$(curl -s -H "Authorization: ApiKey $ATHLETE_ID:$API_KEY" \ "https://intervals.icu/api/v1/athlete/$ATHLETE_ID/wellness/$DATE") ``` `README.md:30-37`: ```bash curl -H "Authorization: ApiKey YOUR_ATHLETE_ID:YOUR_API_KEY" \ https://intervals.icu/api/v1/athlete/YOUR_ATHLETE_ID **Bearer Token (OAuth):** ```bash curl -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \ https://intervals.icu/api/v1/athlete/YOUR_ATHLETE_ID ``` ### Technical Analysis The documentation instructs users to place an Intervals.icu API key or OAuth bearer token directly in shell commands or assign it as plaintext in a shell script. When the command is executed, the expanded `Authorization` header may be exposed in the `curl` process arguments to local process-inspection facilities. If users directly substitute credentials into an interactive command, those credentials can also remain in shell history. Saving the workflow with a real key embeds the credential in a plaintext file. The examples use placeholders rather than actual committed credentials, so the project itself does not disclose a live secret. The vulnerability arises when use ...[truncated 1497 chars]
• Remediation: ## Remediation Suggestions 1. Do not instruct users to paste production secrets directly into interactive commands or source-controlled scripts. 2. Retrieve credentials at runtime from a dedicated secret manager, operating-system keychain, or permission-restricted configuration file. 3. If environment variables are demonstrated, explain that they can still leak through process environments, diagnostics, child processes, or accidental logging and must not be stored in committed files. 4. Prefer a permission-restricted `curl` configuration file or an equivalent mechanism that prevents the authorization value from appearing directly in command arguments. Ensure the file is readable only by its owner and excluded from version control. 5. Add explicit warnings against committing credentials, sharing terminal transcripts, enabling shell tracing with secrets, or leaving real keys in shell history. 6. Recommend short-lived OAuth tokens and least-privilege scopes where supported. 7. Document immediate credential revocation and rotation procedures for suspected exposure. 8. Add secret-scanning rules and pre-commit checks to detect accidentally committed API keys or bearer tokens.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

- `GET /athlete/{id}/events` - List planned workouts
- `POST /athlete/{id}/events` - Create event
- `PUT /athlete/{id}/events/{eventId}` - Update event
- `DELETE /athlete/{id}/events/{eventId}` - Delete event
- `POST /athlete/{id}/events/bulk` - Bulk create events

### Wellness

• Confidence: 82% confidence
• Finding: Documenting a raw DELETE endpoint in a skill that may guide an agent or user to perform tool calls creates a real risk of parameter abuse or unintended destructive execution if event IDs or athlete IDs are wrong or attacker-controlled. The danger is amplified by the skill context because it is specifically designed to manage training calendars, so deletion is an intended capability that needs guardrails, not blind exposure.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README instructs users to place API keys and bearer tokens directly into curl commands but does not warn about protecting credentials or the sensitivity of athlete wellness and training data. This increases the chance of accidental exposure through shell history, logs, screenshots, shared terminals, or copied examples, leading to unauthorized access to personal data and account-scoped API actions.

External Transmission

Medium

• Category: Data Exfiltration

Content

**API Key Method:**
```bash
curl -H "Authorization: ApiKey YOUR_ATHLETE_ID:YOUR_API_KEY" \
  https://intervals.icu/api/v1/athlete/YOUR_ATHLETE_ID
```

• Confidence: 87% confidence
• Finding: This example shows authenticated transmission of secrets to an external service, which is expected for API usage, but it still creates security risk because the skill provides no safeguards around secret handling. In practice, users may paste real credentials into commands, exposing them via shell history or operational logging while enabling access to sensitive athlete and wellness information.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documentation advertises create, update, bulk-create, and delete event operations without any caution that these actions modify or remove athlete training plans. In an agent skill context, omission of confirmation and backup guidance makes unintended destructive actions more likely, especially if an automated system invokes documented endpoints directly.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The authentication section demonstrates direct use of API keys and bearer tokens but does not warn users not to paste secrets into chats, logs, screenshots, or shared transcripts. In an LLM/agent workflow, omission of credential-handling guidance can lead to accidental secret exposure and subsequent unauthorized access to sensitive health and training data.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Power, HR, and load data
curl -H "Authorization: ApiKey API_KEY:YOUR_API_KEY" \
  "https://intervals.icu/api/v1/athlete/YOUR_ATHLETE_ID/activities?oldest=2024-01-01&fields=name,icu_weighted_avg_watts,average_heartrate,icu_training_load,icu_atl,icu_ctl"

# Include fatigue and fitness metrics

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill includes numerous POST and PUT examples for creating, updating, and bulk-modifying activities, events, wellness, and sport settings, but it does not clearly warn users that these operations change live athlete account data. In an agent setting, this increases the chance of unintended destructive or privacy-impacting actions because users may treat examples as read-only guidance.

Static analysis

No suspicious patterns detected.