Cn Habits Tracker

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:50 AM UTC
• Version: 1.2.6

Overview

This is a small local Chinese habit-tracking skill that writes only its own habits JSON file, with some data-loss risks but no hidden network, persistence, or privilege behavior found.

Review the deletion behavior before use: deleting a habit removes its stored records and there is no built-in undo or backup. The tracker also has a local data-integrity bug around reused habit IDs after deletions, so keep a copy of ~/.qclaw/workspace/habits.json if the records matter to you.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/habits.py:68

Finding

Habit Identifier Reuse Causes Silent Data Overwrite and Record Reassignment

Content

View full analysis

Vulnerability Details

File Location: scripts/habits.py, lines 68–69; related deletion logic at lines 232–233
Vulnerability Type: Predictable identifier reuse and data-integrity corruption
Risk Level: Medium

Vulnerable Code

python

habit_id = len(data["habits"]) + 1
data["habits"][str(habit_id)] = {
    "name": name,
    "goal": goal,
    "unit": unit,
    "created": today_str(),
    "id": habit_id
}

Related deletion logic:

python

del data["habits"][habit_id]
data["records"] = [r for r in data["records"] if r.get("habit_id") != habit_id]

Technical Analysis

New identifiers are derived from the number of currently stored habits rather than from a monotonic counter, the highest existing identifier, or a collision-resistant value. Deleting any habit other than the one with the highest identifier can create a gap while leaving a higher identifier in use.

A later addition computes len(data["habits"]) + 1, which can equal an identifier that is still occupied. Assigning the new habit to that dictionary key silently replaces the existing habit. Because records belonging to the overwritten habit are not removed during this replacement, those historical records are subsequently interpreted as belonging to the newly added habit.

Attack Path

1. Add two habits, producing identifiers 1 and 2.
2. Record one or more check-ins for the habit with identifier 2.
3. Delete the habit with identifier 1.
4. Add a new habit.
5. The identifier calculation returns 2 because only one habit remains.
6. The new habit is written to key 2, silently overwriting the existing habit.
7. Historical records referencing identifier 2 remain and are displayed or reported as records of the new habit.

Impact Assessment

Exploitation requires the ability to invoke the local habit-management commands or otherwise influence the local data workflow. It does not grant additiona ...[truncated 357 chars]

Remediation

View remediation

Remediation Suggestions

Replace count-based identifier generation with one of the following:

• Generate max(existing_numeric_ids, default=0) + 1.
• Store and atomically increment a persistent next_habit_id counter.
• Use UUIDs for habit identifiers.

Before insertion, explicitly verify that the generated identifier is not already present and fail safely if a collision is detected. Consider validating referential integrity between habits and records during loading and before saving.

Add regression tests covering:

1. Adding multiple habits.
2. Deleting a non-highest identifier.
3. Adding another habit.
4. Confirming that no existing habit is overwritten.
5. Confirming that historical records remain associated with their original habit.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill documents executable commands that read and write a local JSON file, but it does not declare any explicit tool scope or permissions. This creates an authorization and transparency gap: users and hosting systems cannot easily tell that the skill modifies local files, increasing the chance of unintended file access or writes if the implementation is broader than the documentation suggests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The title and all user-facing instructions are presented as a Chinese-only habit tracker, and the name explicitly labels it as a CN/中文 skill. The file does not indicate that other languages are supported or that the Chinese locale is an optional or justified constraint.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The module docstring describes the skill as providing daily check-ins, streak counting, and statistical reports. However, the code also implements destructive state management by deleting habits and all associated records, which is not reflected in the stated description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script permanently deletes a habit and all associated records immediately when --delete is used, with no confirmation prompt, soft-delete, backup, or undo path. In a local CLI context this creates a real integrity risk: accidental invocation, scripting mistakes, or misuse by another local process can irreversibly destroy user data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file describes data-affecting behavior, including deleting habits and storing data in a local JSON file, but provides no explicit warning about modification of user data or the impact of deletion. For markdown files, user-facing descriptions should disclose behaviors that affect user data or system state.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill is presented as a local habit-tracking utility, but the manifest content also advertises an external AI branding service and website. Promoting a separate commercial service is not justified by the stated purpose of tracking habits and reminders.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module description, CLI help text, and user-facing messages are all fixed in Chinese, which imposes a specific language/locale by default. The file does not offer user opt-in for language selection or explain that the tool is intentionally limited to a Chinese-speaking or region-specific context.

Content

No source excerpt is available for this finding.