ClawHub
Back to skill

Security audit

Step

Security checks across malware telemetry and agentic risk

Overview

This is a local step-tracking command that stores user-entered wellness notes on the user's machine, with no evidence of network access, credential use, hidden execution, or destructive behavior.

Install only if you are comfortable keeping step, goal, reminder, and related wellness notes in plaintext under `~/.local/share/step/`. Avoid entering highly sensitive medical details, and delete or protect exported files if you use the export feature.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Context-Inappropriate Capability

Low
Confidence
88% confidence
Finding
The export function aggregates all locally stored health-related logs into JSON, CSV, or TXT files without any confirmation, minimization, or sensitivity warning. This increases the chance of accidental data exposure because broad exports create convenient secondary copies of potentially sensitive activity data that may be easier to share, sync, or leak.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
User-provided health/activity information is written persistently to plaintext log files under the home directory without any explicit disclosure, retention policy, or sensitivity notice. In a health-oriented skill context, silent long-term storage is risky because users may enter sensitive data they do not expect to remain on disk and be readable by other local processes or backups.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The export routine creates additional plaintext copies of aggregated health logs without warning the user about the privacy implications. In the context of a step/health skill, this is more dangerous because exported files are easier to redistribute, sync, or leave behind than the original application data store.

VirusTotal

52/52 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.