endurance-coach
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill requires extensive interaction with the local environment by running various shell commands via
npx endurance-coachandnpx -y endurance-coach@latest. These commands manage authentication, sync external data, retrieve athletic statistics, query databases, and render HTML output. - [INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection vulnerability surface due to its data ingestion model coupled with high-privilege capabilities.
- Ingestion points: Untrusted data is retrieved from Strava into the local SQLite database (
~/.endurance-coach/coach.db), including user-controlled fields like activity names and descriptions. It also reads free-form text from post-workout interviews. - Boundary markers: No boundary delimiters (such as XML tags or triple quotes) or negative constraints are instructed to isolate external activity content from coaching instructions.
- Capability inventory: The agent can execute local shell commands (
npx endurance-coach), execute arbitrary SQL commands via thequeryaction, and modify files on the local filesystem (Athlete_Context.md). - Sanitization: No input sanitization, filtering, or validation is performed on the data fetched from the external fitness platform before it is rendered into the coaching prompt context.
Audit Metadata