strava

The skill's purpose and commands are coherent for Strava access, but its install and auth model are high risk. It instructs users to run an unpinned raw GitHub installer that fetches an unverifiable binary from a personal repo, then passes Strava client credentials to that binary; this is suspicious supply-chain and credential-forwarding risk, not confirmed malware.

No direct evidence of embedded malware is present in the shown jq computations and configuration/documentation fragment. The primary security concern is the documented agent-skill installation approach that downloads a remote script and executes it immediately (`curl ... | sh`), which is a high-impact supply-chain execution vector. Separately, the configuration examples include plaintext secret/token fields, creating an operational risk for accidental credential exposure if users copy/paste without proper secret management. Review and verify the fetched installer script (pinning/integrity checks) and inspect the actual skill/CLI implementation for logging/exfiltration behaviors.