T08 · Insecure Dependencies
Error
- Location
SKILL.md:84- Finding
Execution of an Unpinned Remote npm Package with Access to Sensitive Athlete Data
- Content
View full analysis
- Remediation
View remediation
Security audit
Coach Skill
Security checks for vulnerabilities and agentic risk
Overview
This endurance-coaching skill is purpose-aligned, but its Strava setup asks for sensitive OAuth material and runs an unpinned npm tool that handles private activity data.
Review before installing. The skill does not show evidence of deception, exfiltration, or destructive behavior, but you should not paste Strava Client Secrets or OAuth redirect URLs into chat, and you should avoid running unpinned `npx claude-coach` commands unless you independently trust and pin the package. If you use Strava sync, understand that up to two years of activity history may be stored locally and ask how to delete or revoke the stored data and tokens. Treat training, testing, caffeine, hydration, and nutrition numbers as general coaching ranges, not medical advice.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:68- Finding
OAuth Secrets and Authorization Codes Passed Through Command-Line Arguments and Conversation Input
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (8)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly instructs the user to reveal their Strava Client Secret to the agent. Client secrets are sensitive credentials intended to remain private to the application owner; exposing them in chat or to an LLM-backed tool can enable unauthorized API use, token issuance, and downstream account or data compromise. Because the skill also uses the secret immediately in CLI commands, the exposure is operational rather than hypothetical.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill directs syncing two years of Strava activity history and storing it locally without an explicit privacy notice or consent language about scope, retention, and sensitivity. Endurance activity history can reveal location patterns, routines, home/work inference, health signals, and event participation, so bulk collection increases privacy risk if the machine, database, or downstream logs are exposed.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This section gives progression guidance and a concrete long-session build example that could be followed literally by users, but it lacks a prominent safety qualifier about medical status, injury history, age, and the need to individualize load. In a coaching skill, prescriptive endurance progression without strong screening and caution language can contribute to overuse injury or unsafe training escalation, especially for beginners or users returning from illness or injury.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file presents minimum weekly hours, distances, and demanding key workouts for Ironman, 70.3, and marathon training in a normative way, without a prominent warning that these loads may be unsafe for users lacking medical readiness or an adequate training base. Because this skill is explicitly for personalized endurance coaching, users may treat these figures as authoritative targets, increasing the risk of injury, overtraining, cardiovascular events, or dangerous exertion.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This file gives specific carbohydrate, fluid, sodium, heart-rate, and caffeine targets for long endurance events without a clear user-facing warning that these ranges must be individualized based on body size, medical conditions, heat tolerance, sweat rate, medication use, and prior gut training. In a coaching skill, users may treat these values as prescriptive medical-grade advice; misapplication can contribute to dehydration, hyponatremia, GI distress, overexertion, or unsafe caffeine intake during prolonged events.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This section prescribes an explicitly advanced, high-intensity VO2max swim workout without nearby safety guidance, screening criteria, or adaptation rules for less-trained, injured, or fatigued users. In a coaching skill that may generate personalized training plans, omission of scaling and contraindication guidance can contribute to overexertion, aggravation of injury, or unsafe training recommendations if surfaced directly to users.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file gives multiple maximal or all-out field testing protocols (30-minute threshold run, 20-minute FTP test, CSS time trials) without screening guidance, contraindications, or advice to stop if symptoms occur. In a coaching skill, users may treat these as actionable instructions and attempt high-intensity testing despite injury, illness, inexperience, or cardiovascular risk, increasing the chance of acute harm or overexertion.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 91% confidence
- Finding
The skill describes exchanging OAuth codes for access tokens and storing resulting data locally, which confirms it is handling authentication material. Even if the literal phrase is informational, the surrounding workflow collects credentials and redirect URLs in-chat, creating a credential-access pattern where sensitive tokens or code-bearing URLs may be exposed to the agent, logs, or other tooling. In a coaching skill, this is more dangerous because credential handling is ancillary to the core function and can be implemented without exposing secrets to the model.
- Content
md This will: 1. Exchange the code for access tokens 2. Fetch 2 years of activity history 3. Store everything in `~/.claude-coach/coach.db`
Static analysis
No suspicious patterns detected.