ClawHub
Back to skill

Security audit

bike-fit-estimator

Security checks for vulnerabilities and agentic risk

Overview

This bike-fit skill is coherent and offline, but users should treat its fit and pain guidance as educational rather than medical or professional advice.

Install only if you want offline bike sizing and fit heuristics. Make small, reversible adjustments, stop if symptoms worsen or handling feels unstable, and use a qualified bike fitter or clinician for persistent pain, numbness, injury history, or symptoms off the bike.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README presents sizing, positioning, and pain-adjustment guidance as actionable self-service advice, including symptom-based fit changes, but does not warn that incorrect adjustments can worsen pain, cause loss of control, or mask issues needing medical or professional evaluation. In a physical setup domain like cycling ergonomics, omission of safety limits increases the chance that users will apply heuristics beyond their competence or continue riding through potentially serious symptoms.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The CLI emits symptom-based fit and pain-adjustment advice, including recommendations that affect body position and explicitly reference persistent numbness, pain, and when to seek medical help, but it does not present a clear, general safety disclaimer at point of use. In this skill context, users may treat the output as authoritative health or biomechanical guidance and make repeated physical adjustments that could worsen pain, delay appropriate care, or create riding-safety issues.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

This reference provides specific self-fit adjustment instructions, body measurement formulas, and pain-to-adjustment guidance without a prominent upfront safety warning that incorrect application can worsen pain, cause overuse injury, or delay medical evaluation. In this skill context, users are likely to act directly on the advice while buying or setting up a bike, which increases the chance of harmful self-adjustments despite the later note about seeking professional or medical help.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.