ClawHub
Back to skill

Security audit

Wahoo Fitness Cloud API

Security checks across malware telemetry and agentic risk

Overview

This is a coherent Wahoo workout-sync skill, but it handles sensitive fitness, GPS, and OAuth data that users should protect locally.

Install only if you are comfortable storing Wahoo OAuth tokens, FIT files, workout history, heart-rate/power data, and GPS traces on this machine. Set WAHOO_BASE_DIR to a private, non-synced location, keep it out of source control and backups you do not trust, review the requirements.txt dependency name before installing, and avoid running OAuth setup in terminals whose output is logged or shared.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The README promotes syncing workouts, FIT files, and detailed sensor/GPS data into a local SQLite database without explicitly warning that this is sensitive health and location information. Users may enable the skill or store/export the resulting database without understanding the privacy risk, increasing chances of unintended exposure of home/work routes, biometrics, and training history.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The setup instructions tell users to configure API credentials but do not clearly warn that client secrets, OAuth tokens, and related material are stored on disk under the Wahoo base directory. That omission can lead users to place the base directory in insecure or synced locations, accidentally back it up, or expose long-lived credentials to other local users and processes.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill documentation does not prominently warn that synchronization downloads FIT files and writes workout data, tokens, and a SQLite database to local storage. Because the data involved is health and location-related, silent persistence increases privacy risk and could expose sensitive personal information on shared or insufficiently secured systems.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.