ClawHub
Back to skill

Security audit

IBD Companion

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed local health-record tracker that stores sensitive IBD data in a private SQLite database and does not show hidden network, persistence, or destructive behavior.

Install only if you are comfortable keeping IBD health records in a local SQLite file protected by filesystem permissions rather than encryption. Keep the database and backups private, use a dedicated 0700 directory, and enable any external reminder integration only after deciding what reminder metadata may be visible to other apps or synced services.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (15)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The code substantially matches the declared purpose in its main function: it stores private IBD-related data in a local SQLite database, enforces local file permissions, logs symptoms and factors, tracks treatment/checkup plans, and generates descriptive evidence-bounded summaries/analysis. However, it also includes reminder-management features, including fields and commands to link reminders to an external system (default 'apple_reminders') and update reminder statuses. While the script states it sends no external notifications and does not itself call external services, this external-system linkage is an undeclared capability adjacent to the stated purpose. Therefore this is a mild but real description/behavior mismatch rather than a major one.

Content

No source excerpt is available for this finding.

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding

The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Lp1

High
Category
MCP Least Privilege
Confidence
55% confidence
Finding

The skill uses 'file_read' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Lp1

High
Category
MCP Least Privilege
Confidence
55% confidence
Finding

The skill uses 'file_write' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Lp1

High
Category
MCP Least Privilege
Confidence
55% confidence
Finding

The skill uses 'shell' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This code identifies review records by matching the Chinese term '复查', which embeds a specific language assumption into core behavior. The same file also hard-codes Chinese user-facing text such as '输注前验血', but does not offer user opt-in, fallback handling, or documentation that the skill is intentionally Chinese-only.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This code seeds the database with Chinese display names and aliases in METRICS and FACTOR_TERMS, and also sets the default timezone to Asia/Shanghai. Because the file provides no user opt-in or locale-selection mechanism, it imposes a specific language/locale policy across the skill.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill is described as private/local and says no external notifications are sent, but it includes commands to link reminders to an external system and mark them as sent. Even if this file does not perform network I/O itself, persisting external reminder IDs and workflow state creates an integration point that can leak sensitive health-event metadata or mislead users about the system's privacy guarantees.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The code supports external reminder-system integration (external_system, external_id, sent-style status tracking) despite the stated purpose being a local private SQLite tracker. In a health-data context, even indirect integration can expose treatment schedules, checkups, and reminder timing to third-party apps, expanding the privacy boundary beyond what users may expect.

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/test_ibd_storage.py (reported line 150)May include surrounding context.

python
for script in ("ibd_db.py", "ibd_care.py"):
            with self.subTest(script=script):
                path = self.root / (script + ".sqlite3")
                result = subprocess.run([sys.executable, str(Path(__file__).parent / script), "--db", str(path), "init"], capture_output=True, text=True)
                self.assertEqual(result.returncode, 0, result.stderr)
                self.assertIn("database", json.loads(result.stdout))
                self.assertIn("sensitive health data", result.stderr)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/test_ibd_storage.py (reported line 156)May include surrounding context.

python
self.assertIn("sensitive health data", result.stderr)
                unsafe = self.root / (script + ".unsafe")
                unsafe.mkdir(mode=0o755)
                result = subprocess.run([sys.executable, str(Path(__file__).parent / script), "--db", str(unsafe / "record.sqlite3"), "init"], capture_output=True, text=True)
                self.assertEqual(result.returncode, 2)
                self.assertEqual(result.stdout, "")
                self.assertIn("0700", result.stderr)