Coach Skill

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:42 AM UTC
• Version: 1.0.0

Overview

This endurance-coaching skill is purpose-aligned, but its Strava setup asks for sensitive OAuth material and runs an unpinned npm tool that handles private activity data.

Review before installing. The skill does not show evidence of deception, exfiltration, or destructive behavior, but you should not paste Strava Client Secrets or OAuth redirect URLs into chat, and you should avoid running unpinned `npx claude-coach` commands unless you independently trust and pin the package. If you use Strava sync, understand that up to two years of activity history may be stored locally and ask how to delete or revoke the stored data and tokens. Treat training, testing, caffeine, hydration, and nutrition numbers as general coaching ranges, not medical advice.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:84
• Finding: Execution of an Unpinned Remote npm Package with Access to Sensitive Athlete Data<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:79-84`, `SKILL.md:107-113`, `SKILL.md:129-134`, `SKILL.md:206-211`, `SKILL.md:497-502`, `reference/queries.md:3-7` **Vulnerability Type**: Unpinned third-party package execution and supply-chain exposure **Risk Level**: High ### Vulnerable Code ```markdown ### Step 2: Generate Authorization URL Run the auth command to generate the OAuth URL: ```bash npx claude-coach auth --client-id=CLIENT_ID --client-secret=CLIENT_SECRET ``` ``` ```markdown ### Step 4: Exchange Code and Sync Run these commands to complete authentication and sync (the CLI extracts the code from the URL automatically): ```bash npx claude-coach auth --code="FULL_REDIRECT_URL" npx claude-coach sync --days=730 ``` ``` ```markdown ### Refreshing Data To get latest activities before creating a new plan: ```bash npx claude-coach sync ``` ``` ```markdown ## Database Access The athlete's training data is stored in SQLite at `~/.claude-coach/coach.db`. Query it using the built-in query command: ```bash npx claude-coach query "YOUR_QUERY" --json ``` ``` ```markdown ### Step 2: Render to HTML After writing the JSON file, render it to an interactive HTML viewer: ```bash npx claude-coach render plan.json --output plan.html ``` ``` The same unpinned query invocation also appears in `reference/queries.md`: ```markdown Run these queries using the claude-coach CLI: ```bash npx claude-coach query "YOUR_QUERY" --json ``` ``` ### Technical Analysis The Skill repeatedly instructs the agent to execute `claude-coach` through `npx` without specifying an exact package version, integrity digest, trusted registry, or verified publisher. Depending on the local npm configuration and cache, `npx` can retrieve the current package release from a remote registry and execute it immediately. This creates a mutable code-execution channel: the package executed at Skill invocation time may differ from the package that existed when the Skill was audi ...[truncated 2673 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `claude-coach` to an exact, audited version in every invocation, rather than relying on the latest registry release. 2. Prefer a project-local installation governed by a committed lockfile and npm integrity metadata. 3. Document the package's official registry URL, publisher identity, source repository, and release-verification process. 4. Require an explicit user confirmation before downloading or executing the package. 5. Install and audit the dependency separately instead of allowing `npx` to download and execute it in one operation. 6. Run synchronization in a sandbox with access limited to: - The Strava API endpoints required for OAuth and activity retrieval. - A dedicated configuration directory. - `~/.claude-coach/coach.db`. - Explicit plan input and output paths. 7. Deny access to unrelated home-directory files, SSH material, browser profiles, and other credential stores. 8. Keep the manual-data workflow available without package installation or network access. 9. Add update controls so a new package release is reviewed before the pinned version is changed. 10. Validate and escape query and output arguments in the CLI implementation, although that implementation was not included in the audited project. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:68
• Finding: OAuth Secrets and Authorization Codes Passed Through Command-Line Arguments and Conversation Input<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:68-84`, `SKILL.md:91-113` **Vulnerability Type**: Sensitive credential exposure through process arguments, shell history, logs, and agent transcripts **Risk Level**: Medium ### Vulnerable Code ```markdown Then ask for the secret: ``` questions: - question: "Now enter your Client Secret from the same page" header: "Client Secret" options: - label: "I have my Client Secret" description: "Enter the secret via 'Other'" ``` ### Step 2: Generate Authorization URL Run the auth command to generate the OAuth URL: ```bash npx claude-coach auth --client-id=CLIENT_ID --client-secret=CLIENT_SECRET ``` ``` ```markdown ### Step 3: Get the Redirect URL Use **AskUserQuestion** to get the URL: ``` questions: - question: "Paste the entire URL from your browser's address bar" header: "Redirect URL" options: - label: "I have the URL" description: "Paste the full URL (starts with http://localhost...) via 'Other'" ``` ### Step 4: Exchange Code and Sync Run these commands to complete authentication and sync (the CLI extracts the code from the URL automatically): ```bash npx claude-coach auth --code="FULL_REDIRECT_URL" npx claude-coach sync --days=730 ``` ``` ### Technical Analysis The Skill directs the user to submit a Strava Client Secret through the agent's question interface and to paste the complete OAuth redirect URL into the conversation. It then inserts both the Client Secret and the redirect URL into command-line arguments. Command-line arguments are not an appropriate secret-transport mechanism. Depending on the operating system and execution environment, arguments may be exposed through: - Process-listing and process-inspection interfaces while the command runs. - Shell command history. - Agent tool-call records and conversation transcripts. - Terminal capture, debugging output, telemetry, and centralized logs. - Error reports that reproduce the comm ...[truncated 2103 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not request the Client Secret or full redirect URL through a general conversation field. 2. Use a masked, non-logged secret-input mechanism with explicit controls preventing transcript and telemetry retention. 3. Implement a localhost OAuth callback that receives and exchanges the authorization code directly, rather than asking the user to paste the redirect URL. 4. Do not pass secrets through command-line arguments. Use one of the following: - A protected operating-system keychain. - A file descriptor or standard input with echo disabled. - A dedicated credential helper. - A configuration file readable only by the current user. 5. If environment variables are unavoidable, ensure they are injected directly into the process rather than printed in a shell command, and account for environments where process variables are inspectable. 6. Redact the Client Secret, authorization code, access token, and refresh token from tool calls, logs, errors, and transcripts. 7. Store cached tokens with restrictive filesystem permissions and document their location, retention, and deletion procedure. 8. Provide clear instructions for revoking Strava access and rotating the Client Secret after suspected disclosure. 9. Minimize OAuth scopes and request only the Strava permissions required to analyze training history. 10. Add automated checks that prevent credentials and redirect query parameters from appearing in generated output or diagnostic logs. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (8)

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The skill explicitly instructs the user to reveal their Strava Client Secret to the agent. Client secrets are sensitive credentials intended to remain private to the application owner; exposing them in chat or to an LLM-backed tool can enable unauthorized API use, token issuance, and downstream account or data compromise. Because the skill also uses the secret immediately in CLI commands, the exposure is operational rather than hypothetical.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill directs syncing two years of Strava activity history and storing it locally without an explicit privacy notice or consent language about scope, retention, and sensitivity. Endurance activity history can reveal location patterns, routines, home/work inference, health signals, and event participation, so bulk collection increases privacy risk if the machine, database, or downstream logs are exposed.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This section gives progression guidance and a concrete long-session build example that could be followed literally by users, but it lacks a prominent safety qualifier about medical status, injury history, age, and the need to individualize load. In a coaching skill, prescriptive endurance progression without strong screening and caution language can contribute to overuse injury or unsafe training escalation, especially for beginners or users returning from illness or injury.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The file presents minimum weekly hours, distances, and demanding key workouts for Ironman, 70.3, and marathon training in a normative way, without a prominent warning that these loads may be unsafe for users lacking medical readiness or an adequate training base. Because this skill is explicitly for personalized endurance coaching, users may treat these figures as authoritative targets, increasing the risk of injury, overtraining, cardiovascular events, or dangerous exertion.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This file gives specific carbohydrate, fluid, sodium, heart-rate, and caffeine targets for long endurance events without a clear user-facing warning that these ranges must be individualized based on body size, medical conditions, heat tolerance, sweat rate, medication use, and prior gut training. In a coaching skill, users may treat these values as prescriptive medical-grade advice; misapplication can contribute to dehydration, hyponatremia, GI distress, overexertion, or unsafe caffeine intake during prolonged events.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This section prescribes an explicitly advanced, high-intensity VO2max swim workout without nearby safety guidance, screening criteria, or adaptation rules for less-trained, injured, or fatigued users. In a coaching skill that may generate personalized training plans, omission of scaling and contraindication guidance can contribute to overexertion, aggravation of injury, or unsafe training recommendations if surfaced directly to users.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The file gives multiple maximal or all-out field testing protocols (30-minute threshold run, 20-minute FTP test, CSS time trials) without screening guidance, contraindications, or advice to stop if symptoms occur. In a coaching skill, users may treat these as actionable instructions and attempt high-intensity testing despite injury, illness, inexperience, or cardiovascular risk, increasing the chance of acute harm or overexertion.

Credential Access

High

• Category: Privilege Escalation

Content

This will:

1. Exchange the code for access tokens
2. Fetch 2 years of activity history
3. Store everything in `~/.claude-coach/coach.db`

• Confidence: 91% confidence
• Finding: The skill describes exchanging OAuth codes for access tokens and storing resulting data locally, which confirms it is handling authentication material. Even if the literal phrase is informational, the surrounding workflow collects credentials and redirect URLs in-chat, creating a credential-access pattern where sensitive tokens or code-bearing URLs may be exposed to the agent, logs, or other tooling. In a coaching skill, this is more dangerous because credential handling is ancillary to the core function and can be implemented without exposing secrets to the model.

Static analysis

No suspicious patterns detected.