ClawHub
Back to skill

Security audit

Weekly Meal Planner

Security checks across malware telemetry and agentic risk

Overview

This is a simple local meal-planning skill whose only notable side effect is saving the generated plan to a local JSON file.

Before installing, be aware that running the script creates or overwrites menu_plan.json in the directory where it is run. Avoid running it from a shared or sensitive folder if household budget or preference details should remain private.

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The skill writes menu_plan.json to disk even though its stated behavior is to generate and output a weekly menu and shopping list. This creates an undeclared side effect that can expose user inputs such as household size, budget, taste preference, and generation timestamp to other local users or processes, especially in shared or sandboxed environments.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.