ClawHub
Back to skill

Security audit

Floreo

Security checks for vulnerabilities and agentic risk

Overview

Floreo appears purpose-built for journaling, but users should review it because it can involve persistent monitoring, broad local note imports, and optional external sync of sensitive personal data with unclear boundaries.

Install only if you want an autonomous life-logging system. Before enabling automation, confirm exactly which folders, repositories, calendars, and services it will watch or sync; keep external sync off unless needed; use least-privilege API keys; preview bulk imports; and document how to disable or remove cron jobs, watchers, stored tokens, and imported data.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Confidence
86% confidence
Finding
The phrase 'Write an entry to my Floreo work domain for today' is broad and action-oriented, which increases the chance of accidental invocation by a user or another agent. Because the skill performs persistent filesystem writes, unintended triggering can create or modify local records without clear confirmation.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The bulk-import instructions direct reading all markdown files from a personal-notes directory and writing them into the skill's data store without an upfront warning or explicit per-run consent boundary. This can sweep highly sensitive local content into a new searchable corpus and increase exposure through later exports, reports, or integrations.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The manifest explicitly promotes 'Autonomous life journaling' and 'Auto-detects activities' but does not define scope limits, monitored sources, trigger conditions, or exclusions. In a personal analytics skill with file watching, calendar access, and Git/GitHub integration, that ambiguity can lead users to enable broad monitoring they do not fully understand, increasing privacy and over-collection risk.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The feature list advertises optional watchers and 'Scheduled shell scripts for insights and reporting' without any explicit warning that the skill may monitor local files and execute commands. In the context of a local-first journaling tool with open connections to external services, this combination raises meaningful risk of unintended surveillance, sensitive data capture, or dangerous command behavior if users install it without clear disclosure.

Static analysis

No suspicious patterns detected.