ClawHub
Back to skill

Security audit

Habit Coach

Security checks for vulnerabilities and agentic risk

Overview

This habit-tracking skill is coherent and locally scoped, but users should avoid its unnecessary dependency install and understand it saves habit entries on disk.

Install only if you are comfortable with a Chinese-language habit tracker that stores your habit entries locally. Do not enter highly sensitive personal or health details unless you are comfortable keeping them in a local JSON file, and avoid running the documented `pip install requests` step because the current script does not need it.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Note
Location
SKILL.md:28
Finding

Unnecessary and Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 28–32
Vulnerability Type: Uncontrolled third-party dependency installation
Risk Level: Low

Vulnerable Code

markdown
## 前置条件

```bash
pip install requests
text

The same installation requirement is repeated in `SKILL.md` at lines 115 and 145 and in `references/habit_coach_guide.md` at line 7.

### Technical Analysis

The documentation instructs users to install `requests` without a version constraint, integrity hash, lock file, or trusted package-index configuration. However, `scripts/habit_coach_tool.py` imports only Python standard-library modules and does not use `requests`. The dependency therefore introduces unnecessary supply-chain exposure.

An unpinned installation resolves whichever compatible release the configured Python package index provides at installation time. The resulting component can consequently differ from the version reviewed by the Skill author. Risk increases if the user's package manager is configured to use a compromised or untrusted mirror, if a dependency in the resolved package graph is compromised, or if a future release is malicious.

This finding does not establish that the legitimate `requests` package is malicious. The issue is requiring an unnecessary and uncontrolled external installation.

### Attack Path

1. A user follows the Skill's setup instructions.
2. The user executes `pip install requests`.
3. `pip` queries the package indexes configured in the user's environment.
4. Because no version or integrity hash is specified, `pip` selects the currently resolved compatible distribution and dependencies.
5. If the selected index, distribution, release, or transitive dependency has been compromised, malicious installation or runtime behavior may execute under the user's account.
6. The malicious component obtains the same operating-system access available to the Python or `pip` process.

### Impact Assessment

Successful exploitation could execut
...[truncated 469 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove every pip install requests instruction because the current implementation does not use that package.
  2. Remove requests from all dependency documentation, including SKILL.md lines 115 and 145 and references/habit_coach_guide.md line 7.
  3. If a future feature genuinely requires an external package:
    • Pin an audited version.
    • Use a lock file with cryptographic hashes.
    • Install from a documented, trusted package index.
    • Review direct and transitive dependencies.
    • Run installation and execution without administrative privileges.
  4. Add automated dependency analysis to ensure documentation and lock files contain only packages imported or otherwise required by the implementation.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
81% confidence
Finding

The skill instructs the agent to run local Python scripts and install dependencies, which implies file read/write capability, but it does not declare any explicit tool scope or permissions boundary. This can lead to overbroad execution in hosts that rely on manifest-style declarations for containment, increasing the chance of unintended filesystem access or writes beyond the habit-tracking task.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown file contains user-facing instructions, examples, and expected output almost entirely in Chinese, which effectively imposes a specific language on users. Under the policy, locale or language constraints should either be optional, user-selected, or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The file's natural-language content is entirely in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking or region-specific audience. Under the language/locale policy, forcing a specific language without opt-in is a policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

Natural-language strings in the docstring and command descriptions are exclusively Chinese, and the runtime usage/error text is also Chinese. Under the stated policy, forcing a specific language without offering a locale choice can be a language-policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The tool persists raw user-provided habit inputs into a local JSON file without any visible notice, consent flow, retention control, or data minimization. While this is not an exploit primitive by itself, it creates a privacy risk because users may enter sensitive personal routines, health-related goals, or other personal data that remains on disk unexpectedly.

Content

No source excerpt is available for this finding.