Workout Tracker

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:15 AM UTC
• Version: 1.3.7

Overview

The skill is a disclosed local workout tracker that uses a local MySQL database, with manageable setup and credential-handling risks users should understand.

Install only if you are comfortable giving the skill access to a local MySQL database containing fitness history. Use a dedicated MySQL user limited to the workout_tracker database, prefer a secret manager or interactive password entry over persistent .env files, keep any .env file chmod 600 and out of version control, and pin dependencies where possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:36

Finding

Unpinned External Package Installation Creates Supply-Chain Exposure

Content

View full analysis

Remediation

View remediation

``` 2. Generate and commit a hash-locked requirements file, then install with integrity enforcement: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 3. Include hashes for every resolved distribution and transitive dependency. Regenerate the lock file only through a documented dependency-review process. 4. Pin the Skill installation command to an immutable reviewed version: ```bash skillhub install workout-tracker@ ``` 5. Use a trusted, explicitly configured registry and avoid unreviewed mirrors or extra package indexes. 6. Install dependencies inside a dedicated virtual environment under a non-privileged account. Do not use `sudo pip install`. 7. Add automated dependency scanning and periodically review pinned versions for published security advisories before updating them. 8. Ensure documentation consistently uses the pinned, integrity-checked commands rather than retaining unpinned alternatives. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (33)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

A second description-behavior mismatch is present: the documented feature set implies broad workout functionality, while the actual behavior is reported to be mostly environment configuration and MySQL verification. Misrepresentation is dangerous because users may authorize or run the skill expecting benign tracking while it accesses local configuration and secrets.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

A second description-behavior mismatch is present: the documented feature set implies broad workout functionality, while the actual behavior is reported to be mostly environment configuration and MySQL verification. Misrepresentation is dangerous because users may authorize or run the skill expecting benign tracking while it accesses local configuration and secrets.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

The skill documentation explicitly instructs creation and sourcing of a local .env file containing database credentials. Even if intended for convenience, workflows that depend on local secret files and file-reading capabilities increase the risk of credential disclosure through agent access, accidental logging, or overbroad file permissions.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

2. 安全配置环境变量（推荐方法）

方法 A：使用 .env 文件（最安全）

bash

# 创建 .env 配置文件
cat > .workout-tracker.env << 'EOF'

Credential Access

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

This finding highlights the same credential-handling pattern: plaintext MySQL secrets are placed in a predictable local file. In an agent ecosystem with file-read capability, that makes credential exposure more plausible than in a purely manual local workflow.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

方法 A：使用 .env 文件（最安全）

bash

# 创建 .env 配置文件
cat > .workout-tracker.env << 'EOF'
MYSQL_SOCKET="/tmp/mysql.sock"
MYSQL_USER="workout_user"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Documenting secret storage in ~/.workout-tracker.env normalizes persistent plaintext credential storage in the user's home directory. If the skill or surrounding agent can read local files, compromise of that file grants database access and may expose training history or permit tampering.

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

python3 /path/to/workout-tracker/scripts/verify_setup.py

text

### 安全配置（推荐使用 .env 文件）
```bash
# 创建安全的 .env 配置文件（不上传至版本控制）
cat > ~/.workout-tracker.env << 'EOF'

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

This line continues the pattern of instructing users to store sensitive MySQL credentials in a plaintext .env file. The issue is amplified by the skill context because the static findings indicate local file/env access capability, making secret retrieval part of the reachable attack surface.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

安全配置（推荐使用 .env 文件）

bash

# 创建安全的 .env 配置文件（不上传至版本控制）
cat > ~/.workout-tracker.env << 'EOF'
# Workout Tracker 数据库配置
# ⚠️ 警告：此文件包含敏感信息，不要上传到版本控制

Credential Access

High

• Category: Privilege Escalation
• Confidence: 69% confidence

Finding

The document recommends storing database credentials in a plaintext .env file under the user's home directory and then sourcing it into the shell environment. Although it advises restrictive permissions, plaintext local secret storage still increases the risk of credential exposure through local compromise, backups, misconfiguration, or accidental disclosure.

Content

Scanner excerpt · TOOLS.md (reported line 34)May include surrounding context.

推荐配置方法（安全性从高到低）

方法 A：.env 文件（最安全）

bash

# 创建 .env 文件（不上传至版本控制）
cat > ~/.workout-tracker.env << 'EOF'

Credential Access

High

• Category: Privilege Escalation
• Confidence: 72% confidence

Finding

This snippet explicitly instructs users to place MYSQL_USER and especially MYSQL_PASSWORD values into a .env file. In the context of a local fitness tracker this is not overtly malicious, but it normalizes persistent plaintext credential handling, which can expose database access if the workstation, shell environment, or synced home directory is compromised.

Content

Scanner excerpt · TOOLS.md (reported line 36)May include surrounding context.

方法 A：.env 文件（最安全）

bash

# 创建 .env 文件（不上传至版本控制）
cat > ~/.workout-tracker.env << 'EOF'
MYSQL_SOCKET="/tmp/mysql.sock"
MYSQL_USER="workout_user"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.

md

from mysql.connector import Error

def load_env_file(env_file='.workout-tracker.env'):
    """尝试从 .env 文件加载环境变量"""
    if os.path.exists(env_file):
        print(f"📁 发现配置文件: {env_file}")
        try:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · package.json (reported line 45)May include surrounding context.

json

from mysql.connector import Error

def load_env_file(env_file='.workout-tracker.env'):
    """尝试从 .env 文件加载环境变量"""
    if os.path.exists(env_file):
        print(f"📁 发现配置文件: {env_file}")
        try:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/init_database.py (reported line 132)May include surrounding context.

python

from mysql.connector import Error

def load_env_file(env_file='.workout-tracker.env'):
    """尝试从 .env 文件加载环境变量"""
    if os.path.exists(env_file):
        print(f"📁 发现配置文件: {env_file}")
        try:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/init_database.py (reported line 155)May include surrounding context.

python

from mysql.connector import Error

def load_env_file(env_file='.workout-tracker.env'):
    """尝试从 .env 文件加载环境变量"""
    if os.path.exists(env_file):
        print(f"📁 发现配置文件: {env_file}")
        try:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/init_database.py (reported line 162)May include surrounding context.

python

from mysql.connector import Error

def load_env_file(env_file='.workout-tracker.env'):
    """尝试从 .env 文件加载环境变量"""
    if os.path.exists(env_file):
        print(f"📁 发现配置文件: {env_file}")
        try:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/verify_setup.py (reported line 13)May include surrounding context.

python

from mysql.connector import Error

def load_env_file(env_file='.workout-tracker.env'):
    """尝试从 .env 文件加载环境变量"""
    if os.path.exists(env_file):
        print(f"📁 发现配置文件: {env_file}")
        try:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/verify_setup.py (reported line 136)May include surrounding context.

python

from mysql.connector import Error

def load_env_file(env_file='.workout-tracker.env'):
    """尝试从 .env 文件加载环境变量"""
    if os.path.exists(env_file):
        print(f"📁 发现配置文件: {env_file}")
        try:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 87% confidence

Finding

The setup instructions explicitly suggest writing the MySQL password into a plaintext .workout-tracker.env file and sourcing it in the shell. This increases the chance of credential exposure through weak file permissions, accidental commits, shell/session leakage, or multi-user local access; in the workout-tracker context, database credentials may expose a user's exercise history and allow database manipulation.

Content

Scanner excerpt · scripts/verify_setup.py (reported line 49)May include surrounding context.

python

if missing:
        print(f"❌ 缺少必需的环境变量: {', '.join(missing)}")
        print("\n💡 配置方法（选择一种）:")
        print("1. 使用 .env 文件:")
        print("   echo 'MYSQL_USER=workout_user' > .workout-tracker.env")
        print("   echo 'MYSQL_PASSWORD=your_password' >> .workout-tracker.env")
        print("   source .workout-tracker.env")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill declares access to environment variables in metadata and the documentation repeatedly instructs loading local credential files, but it does not constrain tool scope with explicit permissions/allowed-tools. That increases the chance an agent can read secrets or local files beyond what a user expects, especially because database credentials are central to the workflow.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md

EOF

# 设置文件权限（仅当前用户可读）
chmod 600 .workout-tracker.env

# 加载配置
source .workout-tracker.env

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.

md

EOF

# 设置文件权限（仅当前用户可读）
chmod 600 .workout-tracker.env

# 加载配置
source .workout-tracker.env

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

md

EOF

# 设置文件权限（仅当前用户可读）
chmod 600 .workout-tracker.env

# 加载配置
source .workout-tracker.env

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

md

EOF

# 设置文件权限（仅当前用户可读）
chmod 600 .workout-tracker.env

# 加载配置
source .workout-tracker.env

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · TOOLS.md (reported line 45)May include surrounding context.

md

EOF

# 设置文件权限（仅当前用户可读）
chmod 600 .workout-tracker.env

# 加载配置
source .workout-tracker.env

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

3. 数据库用户创建

sql

-- 在 MySQL 中执行
CREATE USER IF NOT EXISTS 'workout_user'@'localhost' IDENTIFIED BY 'your_password';
GRANT INSERT, SELECT, UPDATE, DELETE ON workout_tracker.* TO 'workout_user'@'localhost';
FLUSH PRIVILEGES;
CREATE DATABASE IF NOT EXISTS workout_tracker;

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Using the generic word "done" as a completion trigger is risky because it commonly appears in normal chat and could accidentally mark workout records complete or mutate state. In conversational systems, such broad triggers are susceptible to accidental activation and adversarial prompt shaping.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Overly broad trigger phrases for plan generation and logging can cause unintended database actions from ordinary conversation. In an agent setting, ambiguous activation increases the risk of prompt-triggered side effects, accidental data writes, or manipulation by crafted conversational input.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.