ClawHub
Back to skill

Security audit

Personal Sleep Coach

Security checks for vulnerabilities and agentic risk

Overview

This sleep-coaching skill is mostly coherent, but it can automatically read and update persistent personal sleep records from broad triggers without a clear consent or review step.

Install only if you are comfortable with the agent keeping a persistent local sleep log. Before using it, consider narrowing activation to explicit sleep-tracking requests and requiring confirmation before any write to `knowledge/personal/sleep.md`.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
94% confidence
Finding
The trigger list is overly broad for a personal-data-handling skill, including everyday terms like 'tired', 'fatigue', 'rest', and 'alarm' that can appear in many unrelated conversations. This can cause the skill to activate outside clear sleep-tracking intent and then read or update personal sleep memory unexpectedly, increasing privacy and integrity risk.

Natural-Language Policy Violations

Medium
Confidence
88% confidence
Finding
The operational instructions and user-facing guidance are written in Russian, which implies a fixed language/locale for the skill. The file does not indicate that the user can choose another language or that the Russian-only behavior is required for a documented regional purpose.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill instructs the agent to update a persistent personal file whenever the user mentions sleep data, but it provides no disclosure, consent flow, or confirmation before modifying stored personal information. In a personal-health-adjacent context, silent persistence of behavioral data can violate user expectations and lead to unauthorized retention or corruption of sensitive history.

Static analysis

No suspicious patterns detected.