coach
Fail
Audited by Snyk on Feb 28, 2026
Risk Level: HIGH
Full Analysis
HIGH W007: Insecure credential handling detected in skill instructions.
- Insecure credential handling detected (high risk: 1.00). This skill asks users to paste Strava Client ID/Client Secret and full redirect URLs and instructs embedding those values directly into CLI commands (e.g., npx claude-coach auth --client-id=... --client-secret=... --code="FULL_REDIRECT_URL"), which requires the LLM to handle and output secrets verbatim.
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The skill's Option A "Strava Integration" clearly fetches and syncs user activity data from the public third-party site strava.com (stored in ~/.claude-coach/coach.db) and then runs and interprets SQL queries from reference/queries.md on that untrusted, user-generated activity data to drive assessment and plan-generation, so external content can materially influence decisions and tool use.
Audit Metadata