ClawHub
Back to skill

Security audit

ClawCoach Food

Security checks for vulnerabilities and agentic risk

Overview

This food-logging skill is purpose-aligned and disclosed, with local meal storage after confirmation, but users should understand it may analyze broad food-like prompts and store dietary history locally.

Install only if you want ClawCoach to analyze meal photos or food descriptions and keep a local dietary log. Review ambiguous photo or casual food prompts before confirming, and remember that confirmed meals are stored under ~/.clawcoach/food-log.json using your local ClawCoach profile for targets.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Vague Triggers

Medium
Confidence
94% confidence
Finding
The skill instructs activation whenever a user sends a photo, unless context clearly suggests otherwise. That is overly broad for a food-logging skill and can cause unintended interception of unrelated user images, increasing privacy risk and the chance of processing sensitive content without clear user intent.

Vague Triggers

Medium
Confidence
91% confidence
Finding
Triggers like "I ate [food]" or ordinary food descriptions overlap with normal conversation and may activate the skill during casual discussion rather than a request to log data. In this skill, that can lead to unintended meal parsing, confirmation prompts, and eventual persistence of health-related data if the user responds casually.

Session Persistence

Medium
Category
Rogue Agent
Content
- Ask: "confirm? (yes / edit / redo)"

3. **Handle response:**
   - **"yes" / "confirm"** — Write the meal to `~/.clawcoach/food-log.json` with status "confirmed"
   - **Correction** (e.g., "the rice was brown rice" or "it was more like 8oz") — recalculate and present updated totals
   - **"redo"** — ask for a new photo or text description
Confidence
87% confidence
Finding
The skill persists meal and nutrition data to a local JSON file, creating session-to-session retention of potentially sensitive health and dietary information. While storage is core to the feature, the specification lacks safeguards such as consent language, retention limits, validation for edits/deletes, and protections against cross-session misuse or accidental modification of prior entries.

Static analysis

No suspicious patterns detected.