Oura Ring Integration

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:39 AM UTC
• Version: 1.0.2

Overview

The skill matches its Oura health-data purpose, but it asks users to build and run unpinned third-party code that will handle OAuth secrets and sensitive biometric data.

Install only if you trust the upstream oura-cli repository and are comfortable giving a locally built binary access to Oura OAuth credentials and sensitive health data. Prefer a pinned, reviewed release or commit, protect the token file with restrictive permissions, avoid sharing terminal output containing health data or secrets, and revoke or rotate Oura OAuth credentials if exposure is suspected.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:12

Finding

Unpinned Third-Party Source Is Retrieved, Compiled, and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12-14
Vulnerability Type: Remote retrieval and execution of mutable third-party source
Risk Level: High

bash

git clone https://github.com/ruhrpotter/oura-cli.git
cd oura-cli
go build -o oura ./cmd/oura

Technical Analysis

The installation instructions clone the mutable default branch of an external GitHub repository and compile it into a local executable. They do not pin a reviewed commit or release, verify a cryptographic checksum or signature, or otherwise establish the integrity and provenance of the downloaded source.

Consequently, the effective code executed by users can change after this Skill has been reviewed. Compromise of the upstream repository, a maintainer account, or its transitive Go dependencies could insert arbitrary code into the resulting oura binary.

This is particularly sensitive because subsequent instructions run the binary with OURA_CLIENT_ID and OURA_CLIENT_SECRET present in its environment. The binary also handles OAuth tokens and sensitive profile and biometric data.

Attack Path

1. An attacker compromises the upstream repository, a maintainer account, or a dependency used during the Go build.
2. The attacker modifies the default branch to include malicious code.
3. A user follows the Skill instructions and clones the mutable default branch.
4. The user compiles the attacker-controlled source into the oura executable.
5. The user invokes ./oura auth login while OAuth client credentials are available in environment variables.
6. The malicious binary reads those credentials, captures generated OAuth tokens, or accesses Oura API responses.
7. The binary can transmit the captured credentials and sensitive health information to an attacker or perform other actions with the invoking user's local privileges.

Impact Assessment

Successful exploitation permits arbitrary code execution with the priv ...[truncated 650 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the repository to a specific, reviewed commit hash or immutable signed release rather than cloning the mutable default branch.
2. Publish an expected SHA-256 checksum for the reviewed source archive or binary and require verification before building or execution.
3. Verify signed Git tags or release artifacts against a documented, trusted maintainer key.
4. Commit and audit go.mod and go.sum, pin all dependencies, and continuously scan them for known vulnerabilities and unexpected provenance changes.
5. Prefer reproducible builds so users can confirm that published binaries correspond to the reviewed source.
6. Build and run the CLI under a dedicated, least-privileged account or sandbox with narrowly limited filesystem and network access.
7. Avoid exposing OAuth secrets longer than necessary. Ensure the application does not log environment variables or authentication responses.
8. Require OAuth token files to use restrictive permissions, such as owner-only read and write access, and document token revocation procedures.
9. Review the pinned CLI source specifically for credential handling, token storage, outbound network destinations, and command execution before recommending it to users.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This skill handles highly sensitive health and biometric data including sleep, heart rate, SpO2, stress, readiness, and profile data, but the description does not warn users about the sensitivity of the data being accessed and exposed in CLI output. In an agent setting, this increases the risk of over-collection, unintended disclosure in logs, screenshots, transcripts, or downstream tool outputs without informed user consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs users to set OAuth client credentials in environment variables and states that tokens are stored in ~/.config/oura-cli/config.json, but it does not warn about the local persistence and sensitivity of these secrets. This can lead to credential exposure through shell history, shared machines, backups, permissive filesystem permissions, or agent workflows that inspect local files.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.