ClawHub
Back to skill

Security audit

Timesheet - Time Tracking

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent timesheet.io CLI helper, but users should be careful with its documented delete and export commands.

Install only if you intend to let the agent use your authenticated timesheet.io CLI. Review IDs before asking it to delete projects, tasks, or tags, and handle exported reports as potentially sensitive business or billing data.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
This markdown file instructs users to run `timesheet projects delete <id>` as part of normal usage, but it does not warn that the action may be destructive or irreversible. Under the markdown-specific warning criterion, skills should disclose behaviors that can affect user data or system integrity.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill documentation includes `timesheet tasks delete <id>` with no cautionary note, despite this operation affecting user data. Markdown skill descriptions should warn users when documented actions can remove or alter their data.

Missing User Warnings

Medium
Confidence
81% confidence
Finding
The skill describes exporting timesheet data to CSV/XLSX files but does not warn that these files may contain sensitive work-history or billing information. Markdown guidance should disclose behaviors that affect user privacy or data handling.

Missing User Warnings

Low
Confidence
87% confidence
Finding
The markdown lists `timesheet tags delete <id>` as a normal command example but gives no indication that it removes user-managed metadata. Even if lower impact than project or task deletion, it still modifies user data and should be disclosed.

Static analysis

No suspicious patterns detected.