Security audit
Cn Todo Tracker
Security checks across malware telemetry and agentic risk
Overview
This is a simple local Chinese todo-list skill that stores tasks in a disclosed JSON file and shows no hidden, network, credential, or destructive behavior.
Install only if you are comfortable with the skill storing your todo text locally at ~/.qclaw/workspace/todos.json. It does not appear to send data elsewhere, but tasks may contain private information, so avoid putting secrets in the todo list.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
65/65 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.