ClawHub
Back to skill

Security audit

Breathe

Security checks for vulnerabilities and agentic risk

Overview

The skill is a static breathwork reference with no hidden system access, but its advanced breathing and cold-exposure guidance needs review for user safety.

Review this skill as health-adjacent guidance, not medical advice. It appears technically simple and non-invasive, but users with cardiovascular, respiratory, neurologic, pregnancy, panic/anxiety, or fainting risks should avoid advanced retention, hyperventilation, and cold-exposure practices unless cleared by a qualified professional.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill presents breathwork techniques as quick-reference guidance for stress relief, anxiety, sleep, and athletic performance, but it omits important safety warnings for practices that can be risky in some contexts. In particular, Wim Hof-style hyperventilation and cold exposure can cause dizziness, loss of consciousness, or injury, and presenting breath control as a tool for panic or anxiety without caution may worsen symptoms or delay appropriate medical care.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This section gives detailed hyperventilation and breath-retention instructions for the Wim Hof method, including prolonged holds and cold-exposure progression, but lacks a general medical safety disclaimer or guidance to consult a clinician before practice. Because these exercises can trigger dizziness, fainting, panic, arrhythmia, or exacerbate cardiopulmonary and neurologic conditions, omission of broad contraindications materially increases the chance of user harm.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The routines section combines multiple advanced techniques, including Kapalabhati, Wim Hof, and 4-7-8 breath holds, into daily schedules without an overall safety disclaimer or user screening guidance. In a wellness skill intended for self-guided use, that context makes the omission more dangerous because users may follow these routines unsupervised despite contraindications or poor tolerance.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.