ClawHub
Back to skill

Security audit

Huckleberry

Security checks across malware telemetry and agentic risk

Overview

This skill appears to provide the advertised Huckleberry baby-tracking integration, but it requires account credentials and can read and update sensitive child activity records.

Install only if you are comfortable giving this skill Huckleberry login credentials and allowing it to read and update baby activity, growth, and history records. Prefer protected environment variables or a tightly permissioned credentials file, do not commit the credential file, consider pinning or reviewing the GitHub dependency, and verify important entries in the Huckleberry app.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
83% confidence
Finding
The skill requires access to sensitive credentials through environment variables and a local credentials file, but it does not declare this capability in a permissions model. Hidden or undeclared secret access weakens user consent and reviewability, especially for a skill that also performs authenticated writes to a third-party backend.

Tp4

High
Category
MCP Tool Poisoning
Confidence
88% confidence
Finding
The skill description understates its actual capabilities: beyond simple baby-activity logging, it can enumerate children, retrieve historical data, read growth data, and directly modify Firestore records. This mismatch is dangerous because users or agent platforms may grant trust based on a narrower description while the skill has broader read/write access to sensitive family data.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The setup instructs users to store account email/password and then use those credentials for direct backend access and record modification, but it does not prominently warn about privacy, credential sensitivity, or the risks of direct data mutation. In a family-tracking context, this exposes sensitive household and child-related information and increases the chance of unsafe handling of credentials.

Credential Access

High
Category
Privilege Escalation
Content
timezone = os.environ.get("HUCKLEBERRY_TIMEZONE", "America/Los_Angeles")
    
    if not email or not password:
        config_path = Path.home() / ".config" / "huckleberry" / "credentials.json"
        if config_path.exists():
            with open(config_path) as f:
                creds = json.load(f)
Confidence
81% confidence
Finding
credentials.json

YARA rule 'agent_skill_remote_bootstrap_execution': Remote script or code download followed by execution/bootstrap installation [agent_skills]

High
Category
YARA Match
Content
1. Install the API:
   ```bash
   # Install from GitHub (required for bottle feeding support until next PyPI release)
   pip install git+https://github.com/Woyken/py-huckleberry-api.git
   # or with uv:
   uv pip install git+https://github.com/Woyken/py-huckleberry-api.git
   ```
Confidence
92% confidence
Finding
pip install git+https://; pip install git+https://

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.