speediance@1.0.9
VERIFIED· install onlyPublisher claims: "Read completed workouts (summaries and full per-set detail), browse and export the exercise catalog, and push custom training programs to your Speediance (Gym Monster) smart cable machine via its cloud API. Authenticates with your account credentials, caches a session token in your OS user-cache directory (override with an exported SPEEDIANCE_TOKEN_CACHE), and makes outbound HTTPS requests to the Speediance cloud API. Reads and emits structured data. It writes local files only in these cases: the session token cache; config.json when you run `config set`, which stores the value you give it (including a password) as plain JSON with owner-only permissions; and the exercise catalog that the `library` command saves (default library.json). Ships as a single static binary — no Python or other runtime required. Use when the user asks for their Speediance or Gym Monster workout data, wants to look up exercises, or wants to create a training program on the machine." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-13 and scored it 87/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationsStatic findings
"%w: set %s and %s (exported env vars, or a .env in the working directory), "+Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.…dential/config file (working directory, or your OS user-config dir)" - ".env — optional env file in the working directory; only the SPEEDIANCE_EMAIL, SPEEDI…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.those keys are read; the file is parsed into a map and any other keys are ignored, so a stray `.env`Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.description: "Path to config.json (overrides discovery: working dir, then OS user-config dir). Read from the exported environment only, never from .env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.warnings = append(warnings, fmt.Sprintf("%s in .env is ignored: path settings must be exported", key))Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.description: "Override the token cache file location (default: OS user-cache dir). Read from the exported environment only, never from .env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.You can also put these four variables in a gitignored **`.env`** file in the working directory —Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.