ClawHub
Back to skill

Security audit

健康追踪

Security checks for vulnerabilities and agentic risk

Overview

This is a simple health-tracking skill that stores user-entered health records locally in a plaintext JSON file, with no evidence of hidden network, credential, or destructive behavior.

Install only if you are comfortable with water, sleep, step, and similar health records being saved as a local plaintext JSON file. Avoid shared or synced workspaces unless you control access, and delete the JSON file when you no longer want the history retained.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill stores sensitive health-related data in a local JSON file with no privacy notice, consent flow, retention policy, or file-permission hardening. Health data can reveal habits, sleep patterns, and activity levels, so silent persistence increases the risk of unintended disclosure to other local users, backups, or processes.

Static analysis

No suspicious patterns detected.