Security audit

Endurance Coach

Security checks for vulnerabilities and agentic risk

Overview

The skill’s coaching purpose is coherent, but it asks agents to run mutable npm commands and persist sensitive athlete data, including hidden coach notes, without enough user control.

Review this skill before installing. It is not shown to contain a destructive payload, but it can persist detailed fitness, health-adjacent, life-context, and coaching notes locally, can sync Strava history, and teaches the agent to execute a mutable npm CLI. Install only if you are comfortable with those data flows, pin or vet the endurance-coach package before use, and require the agent to ask before syncing, saving notes, or storing any hidden coaching analysis.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:435
Finding: Unpinned npm Package Retrieval and Execution
Content: View full analysis
--laps npx -y endurance-coach@latest expand plan.yaml --verbose ``` ### Technical Analysis The Skill instructs the Agent to execute `endurance-coach@latest` through `npx -y`. If the package is not already available locally, `npx` retrieves it from the configured npm registry and immediately executes it. The `-y` option suppresses the normal installation confirmation. The `@latest` tag is mutable. Consequently, the code executed during a future Skill invocation may differ from the code that existed when this project was audited. The project provides no exact version pin, lockfile, vendored package, or integrity hash that would constrain or verify the downloaded payload. Several commands also use bare `npx endurance-coach`, which does not establish a reviewed immutable version. This creates the same fundamental trust problem when package resolution results in a download or selects an unexpected version. The network access needed for optional Strava synchronization is consistent with the Skill’s stated purpose. However, automatically downloading and executing the latest package release exceeds the minimum predictable privilege necessary to perform that synchronization or render a plan. ### At ...[truncated 1611 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:263
Finding: Shell Command Injection Through Athlete-Controlled Interview Content
Content: View full analysis
\ --reflection="" \ --notes="" \ --confidence= ``` ### Technical Analysis The prescribed command embeds athlete-derived reflection text and generated coach notes directly into a shell command using double-quoted arguments. Double quotes prevent basic word splitting but do not disable every form of shell evaluation. In common POSIX-compatible shells, command substitution constructs such as `$(command)` and backticks remain active inside double quotes. Embedded double quotes may also terminate the intended argument and introduce additional shell syntax if escaping is not applied correctly. The reflection is derived from user-provided interview content. Coach notes may quote or closely reproduce that content. Therefore, untrusted text can reach a command-execution boundary. The placeholders also do not specify any mandatory escaping or a non-shell process API. ### Attack Path 1. An attacker supplies crafted workout feedback containing shell syntax, for example a command-substitution expression. 2. The Agent summarizes or copies the crafted content into the athlete reflection or coach notes. 3. The Agent follows the Skill’s persistence instructions and interpolates that text into the documented shell command. 4. The shell parses the interpolated string before launching `npx`. 5. Command substitutions or injected shell metacharacters are evaluated with the privileges of the Agent process. 6. The injected command reads, modifies, deletes, or transmits resources available to the Agent user. For example, merely surrounding an untrusted value with double quotes does not neutralize this shell construct: ```text $(attacker-controlled-command) ``` ...[truncated 962 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (57)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.
md
| @reference/templates.md | When using or editing templates | Template syntax and examples |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 405)May include surrounding context.
md
| @reference/templates.md | When using or editing templates | Template syntax and examples |

Session Persistence

Medium

Category: Rogue Agent
Confidence: 73% confidence
Finding: The skill is designed around persistent local storage of athlete context, synced Strava history, interviews, triggers, and internal coaching notes across sessions. Session persistence is not inherently malicious, but in this context it increases risk because the persisted data includes sensitive personal, behavioral, and health-adjacent information without strong disclosure, minimization, or retention controls.
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: endurance-coach description: Create personalized triathlon, marathon, and ultra-endurance training plans. Use when athletes ask for training plans, workout schedules, race preparation, or coaching advice. Can sync with Strava to analyze training history, or work from manually provided fitness data. Generates periodized plans with sport-specific workouts, zones, and race-day strategies. --- # Endurance Coach: Endurance Training Plan Skill

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill directs the agent to read and write ~/.endurance-coach/Athlete_Context.md, which is described as containing race history, life context, injuries, family constraints, and coaching guidance, but it never requires explicit user consent or warns that this information will be stored persistently on disk. This creates a privacy risk because sensitive personal and health-adjacent information may be retained locally without the user's informed awareness.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill instructs syncing Strava data into a local SQLite database and using it for analysis, but it does not include a clear disclosure that external training history will be imported and stored locally. Users may not realize that detailed workout, heart-rate, and training-load data could persist beyond the current session and become accessible to other local processes or users.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The skill instructs the agent to run npx endurance-coach ... without pinning an exact package version. npx may fetch the latest published package at execution time, so a compromised or malicious package update could execute arbitrary code in the user's environment and access local files such as the athlete database and context documents.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: This unpinned npx endurance-coach foundation call allows resolution of whatever package version is current at runtime. If the npm package or its dependency chain is hijacked, the agent could run attacker-controlled code with access to local training data and user context files.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: Running npx endurance-coach training-load without a pinned version creates a supply-chain execution path. Because this skill also handles private athlete records, successful package compromise would expose both code execution and sensitive data access.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The unversioned npx endurance-coach hr-zones command trusts the latest npm state at runtime. In an agent setting, that is dangerous because it can silently change behavior over time and execute unreviewed code on behalf of the user.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The skill's interview workflow depends on npx endurance-coach interview --list without version pinning. That permits arbitrary package updates to alter or abuse the command, especially risky because it touches workout history and may trigger sync behavior.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: This npx endurance-coach interview <selected_id> invocation is another runtime fetch-and-execute path. Because the skill encourages repeated use and access to athlete data, an attacker only needs one compromised release to gain code execution and persistent access to sensitive information.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The npx endurance-coach interview --latest command is unpinned and may auto-sync external data, increasing attack surface. A malicious package version could exfiltrate Strava-derived data, local SQLite contents, or modify stored interview records.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The manual workflow uses npx endurance-coach interview --manual without pinning. Even in non-Strava mode, this can still execute attacker-controlled package code in the local environment and access manually entered health and training data.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: npx endurance-coach activity-record is unpinned and processes user workout details that may be sensitive. A compromised npm release could persist, alter, or exfiltrate that data while appearing to perform the expected activity-record function.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The interview-save command is invoked via unpinned npx, creating a direct path for arbitrary code during persistence of athlete reflections and coach notes. Because it writes data, a malicious version could also tamper with records or implant misleading notes.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The hidden-note persistence step uses unpinned npx endurance-coach preliminary-note-save, again exposing the system to supply-chain compromise. This is especially concerning because it stores internal evaluative data and likely runs with filesystem access to user-specific coaching artifacts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly instructs generation of a 'preliminary coach note' that is hidden from the athlete, stored silently, and used to shape future questioning. Storing undisclosed evaluative notes about a user is a privacy and transparency problem because it creates persistent profiling without informed consent.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: npx endurance-coach triggers list is unpinned and could execute unexpected code while enumerating trigger settings. Even seemingly read-only commands are dangerous in an npx model because installation and package lifecycle scripts can run before the command itself.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The trigger configuration command npx endurance-coach triggers list is another unpinned runtime package execution path. Repeated copies of the same pattern throughout the skill increase exposure and make it more likely an agent will invoke a dangerous command in practice.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The command npx endurance-coach triggers set ... is unpinned and writes configuration state, so a malicious package could both execute code and alter athlete trigger settings in harmful ways. This could affect future coaching interactions and stored training metadata.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: Even though later commands use npx -y, they still do not pin an exact version, so they remain vulnerable to remote package substitution or malicious updates. Here the command is used for rendering plans, which could still execute arbitrary code and access nearby plan or context files.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: npx -y endurance-coach@latest schema is effectively unpinned because @latest resolves dynamically. That means behavior can change unexpectedly and a compromised latest release could execute arbitrary code under the agent's privileges.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: This final unpinned npx usage repeats the same supply-chain risk pattern in a high-frequency reminder section, making actual invocation more likely. Because the skill also reads and writes local athlete files, package compromise would have meaningful confidentiality and integrity impact.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.