Security audit

RUNSTR Fitness

Security checks across malware telemetry and agentic risk

Overview

This skill appears intended for RUNSTR fitness analysis, but it asks for a full Nostr private key and persists sensitive health summaries without enough safeguards.

Install only if you are comfortable giving an agent access to sensitive RUNSTR health data and a Nostr private key. Use a dedicated RUNSTR/Nostr identity rather than your main nsec, avoid pasting secrets into reusable chat contexts or command arguments, and explicitly tell the agent not to store health summaries unless you want that information retained.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 86% confidence
Finding: The skill assures users that their private key is not stored, logged, or transmitted, yet it instructs the agent to retain derived health summaries from decrypted private data for future conversations. Even if the raw nsec is not persisted, long-term storage of sensitive health inferences contradicts the privacy expectation and expands exposure of confidential fitness, mood, and journal data.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The fallback Node.js method passes the secret key as a command-line argument, which can be exposed through shell history, process listings, telemetry, or agent logs. This directly undermines the claim that the nsec is never stored, logged, or transmitted and creates a real credential leakage path for the user's Nostr private key.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The invocation text is broad enough to activate on generic health, mood, or coaching requests, which can cause the agent to solicit or use RUNSTR-linked sensitive data when the user did not clearly intend that integration. Because the skill handles private health and credential material, overbroad triggering increases the chance of unnecessary collection and exposure.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill instructs users to provide their nsec, which is a private key, without a strong warning that this credential grants control over their Nostr identity and should generally never be shared with an AI agent. Requesting a long-lived private key from users creates a severe account-compromise and privacy risk well beyond the stated fitness use case.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The skill explicitly tells the agent to store a health summary derived from decrypted private fitness backups for future conversations. This creates ongoing retention of sensitive health, mood, and habit data, increasing the blast radius of accidental disclosure, misuse by other tools, or compromise of conversation memory.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.