ClawHub
Back to skill

Security audit

纪念日管理

Security checks for vulnerabilities and agentic risk

Overview

This is a local personal date manager that stores user-entered dates in its own JSON file and shows no evidence of hidden network access, credential use, or unrelated behavior.

Install only if you are comfortable keeping personal dates, relationships, and notes in a local JSON file under the skill directory. Be careful with delete commands because records are removed without an undo flow, and review the optional Python dependencies before installing them.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
86% confidence
Finding
The trigger conditions are broad enough to activate on ordinary conversation about dates, holidays, birthdays, reminders, or cultural events. In this skill, broad activation is more dangerous because activation can lead to persistent storage and destructive operations like update/delete, increasing the chance of accidental data collection or unintended actions.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill persists sensitive personal records such as birthdays, family relationships, memorial dates, and notes in a local JSON file but provides no privacy warning, retention notice, or consent language. These data points can reveal personal identity, family structure, beliefs, and important dates that could be misused if exposed or retained unexpectedly.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The documented delete operation appears permanent, yet there is no warning or confirmation requirement. This makes accidental or mis-triggered deletion more likely, especially in a skill with broad triggers and persistent user data.

Static analysis

No suspicious patterns detected.