Security audit
fitness-coach
Security checks for vulnerabilities and agentic risk
Overview
The skill's requirements, instructions, and storage behavior are coherent with a local fitness-coach; it requests no external credentials or installs and only reads/writes files inside its own skill directory.
This skill appears to be what it claims: a local fitness coach that reads its packaged reference files and stores user profile, logs, caches, and weekly reports under the skill's data/ folder. Before installing or using it: (1) be aware it will ask for personal health data (height, weight, injuries, etc.) and store that data in the skill's directory — confirm the install path and file permissions you are comfortable with; (2) there are no external credentials or network endpoints declared, but verify your runtime does not implicitly sync the skill directory to cloud backups if you want the data kept local; (3) persona claims (certifications/experience) are part of the role-played coach and not independently verified; (4) if you later uninstall, delete the skill's data/ folder to remove stored logs and reports.
Static analysis
No suspicious patterns detected.