ClawHub
Back to skill

Security audit

Habits Tracker

Security checks across malware telemetry and agentic risk

Overview

This is a local habit-tracking CLI that stores user-entered habits and logs on the user's machine, with no evidence of network access, hidden execution, or deceptive behavior.

Installers should understand that habit names, notes, dates, and medication or health-related routines may be stored locally under ~/.config/habit-tracker. Use care with sensitive notes, and only add cron reminders or event integrations when you intentionally want scheduled local checks.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The skill description is broad enough that it could activate on loosely related productivity, routine, or self-improvement requests rather than explicit habit-tracking intents. Overbroad activation can cause unintended tool suggestions or actions, increasing the chance of irrelevant command generation and inappropriate persistence of user data.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The instruction to act whenever a user asks for habit advice lacks constraints requiring explicit user intent to use the local CLI. This can lead the agent to over-activate, propose commands when only general advice was requested, and potentially steer users into storing personal routine or health-adjacent data locally without clear consent.

Vague Triggers

Low
Confidence
83% confidence
Finding
The phrase 'event-based triggers' is underspecified and leaves unclear what events are allowed to invoke the skill. Ambiguous trigger wiring can cause accidental or excessive invocations in integrated environments, especially if mapped to unrelated task completions or automation events.

VirusTotal

58/58 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.