ClawHub

Strava Api

Security checks across malware telemetry and agentic risk

Overview

This skill matches its stated Strava purpose: it authorizes Strava, stores a local token, and fetches workout activity data without hidden or unrelated behavior.

Install only if you trust the publisher with Strava OAuth credentials and activity data. Review STRAVA_TOKEN_PATH if you want the refresh token stored somewhere else, keep the token file private, and use loopback mode only with a localhost redirect URI.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill documentation describes capabilities that use environment variables, local token storage, shell execution, file read/write, and network access, but it does not declare permissions or boundaries for those operations. This creates a real security gap because an agent or reviewer cannot easily distinguish expected OAuth/token handling from broader unrestricted access, increasing the chance of over-privileged execution and unsafe secret or file exposure.

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal