ClawHub
Back to skill

Security audit

Cn Diet Tracker

Security checks across malware telemetry and agentic risk

Overview

This is a simple local diet tracker that stores entries in a disclosed local JSON file and shows no network, credential, or hidden behavior.

Install only if you are comfortable storing food, calorie, timestamp, and note data unencrypted on this machine at ~/.qclaw/workspace/diet.json. Be cautious on shared or synced systems, and remove that file manually if you no longer want the records retained.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill stores diet logs in a local JSON file containing health-related personal data, but it does not clearly warn users about that persistence or its privacy implications. Health and dietary records can be sensitive, and silent local storage increases the risk of unintended exposure on shared systems, backups, or synced home directories.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.