ClawHub

Meditate

Security checks across malware telemetry and agentic risk

Overview

The skill is a local-only reflection helper that keeps conversation-derived memory, with clear limits against commands, network access, and acting on the user's behalf.

Install only if you are comfortable with an agent keeping local reflection memory in ~/meditate/ based on your conversations. Review or delete those files if they contain sensitive personal or work patterns, and use the built-in feedback controls to exclude topics or reduce/pause proactive meditations.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill explicitly persists user-derived information under `~/meditate/` (for example profile, topics, insights, feedback, and archive data) but does not include a clear user-facing consent/notice mechanism before writing those files. Even though the scope is local-only and the skill forbids external exfiltration, silent persistence of behavioral and preference data creates privacy and retention risk, especially on shared machines or when users do not expect long-term storage.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The Personal Profile section explicitly encourages observing relationship mentions, calendar behavior, habits, and wellbeing signals, which are privacy-sensitive inferences about a user’s personal life and mental state. Even though framed as helpful reflection, the skill provides no consent boundary, minimization rule, or warning against profiling sensitive attributes, making it likely to normalize intrusive monitoring and retention of behavioral patterns.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal