ClawHub
Back to skill

Security audit

health-memory

Security checks across malware telemetry and agentic risk

Overview

This skill does what it says, but it automatically sends sensitive health summaries to a third-party memory service without clear consent or retention controls.

Review before installing. Only use this with a BlueColumn account you trust, and do not let it store medical or fitness details unless the user has clearly opted in. Prefer explicit, narrow notes over automatic conversation summaries, and confirm how BlueColumn handles retention and deletion.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

High
Confidence
95% confidence
Finding
The skill is explicitly designed to store health and fitness information in a third-party persistent memory service, but it does not present a clear warning or consent step before encouraging storage. Health-related data is sensitive in many contexts, and silently sending it to an external service increases privacy, compliance, and trust risks, especially when the workflow normalizes automatic persistence.

Ssd 3

Medium
Confidence
92% confidence
Finding
The workflow instructs the agent to store a summary after every interaction, which can easily capture sensitive health details in plain language without filtering, minimization, or renewed consent. In a health-memory skill, this context makes the behavior more dangerous because repeated automatic summaries can accumulate a detailed longitudinal health profile in external persistent storage.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.