Habits

• Outcome: Review
• Latest audit: Jul 27, 2026 · 9:01 AM UTC
• Version: 1.0.2

Overview

This is a coherent local habit-tracking skill, but it needs Review because it can automatically write sensitive shared contacts, health, and finance records without a confirmation gate.

Install only if you are comfortable with this skill maintaining a durable local habit database and updating related contacts, health metrics, and subscription/stake notes. Before using it with sensitive habits, consider requiring the agent to preview file changes and ask before writing shared contacts, health, finance, or capacity information.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (23)

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: This section instructs the agent to read and update a shared contacts database with personally identifying details such as name, key, preferred channel, and contact context. For a habit-tracking skill, persisting third-party contact data across a shared store is broader than the core purpose and creates unnecessary collection, duplication, and modification risks, especially because the skill also permits deleting rows and updating existing records.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The file directs the agent to write recurring paid stakes into a shared finances/subscriptions record, expanding a habit skill into personal-finance data management. Even if well-intentioned, this crosses domain boundaries and can cause inaccurate or unwanted financial record creation, exposing sensitive spending information or polluting another subsystem without explicit user consent.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The file explicitly instructs the agent to write habit-analysis outcome data into a shared `~/Clawic/data/health/` area, which crosses from habit-owned storage into another domain. Even if intended for legitimate tracking, this broadens the skill's write scope and can cause unauthorized modification of adjacent health records or create privacy boundary violations between skills.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The guidance tells the agent, in the same turn, to update `memory.md`, `~/Clawic/data/health/`, and other files, including cross-skill handoff to `goals`. That creates a multi-file, cross-domain write pattern without an enforced boundary, increasing the chance of unintended data tampering, scope creep, and persistence of incorrect analysis across unrelated skill areas.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The file explicitly instructs the agent to read `memory.md` and `config.yaml` before responding, including sensitive context such as diagnosis, rota, and caring load. It also frames those stores as defaults to be reused without re-asking, which expands collection and reuse of health- and life-related data beyond what is necessary for a single habit-coaching interaction.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The low-mood section instructs the skill to check red flags, identify when symptoms are 'not a tracking problem,' and route the user to a clinician. While well-intentioned, this is quasi-clinical triage logic embedded in a habit skill, increasing the risk of handling mental-health conditions beyond the tool's stated scope and of making inappropriate inferences from user statements.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The file directs the agent to persistently write capacity constraints, diagnoses, shift schedules, caregiving details, and what changed into `memory.md` and `config.yaml` in the same turn. This creates a durable record of highly sensitive personal and health-adjacent information, increasing privacy risk, over-retention, and the chance that later interactions or other skills access data the user did not expect to be stored long-term.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill instructs modifying `~/Clawic/data/finances/subscriptions.md`, which crosses into a separate finance domain without an explicit user confirmation step or clear authorization boundary. Even if intended as helpful record hygiene, this creates a scope-creep pathway where a habits workflow can mutate unrelated financial records and cause inaccurate or unwanted data changes.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The workflow directs the agent to write accountability contacts into a shared contacts database, expanding a habits interaction into persistent contact management. This is risky because it can create or alter personally identifiable information in a separate datastore without clear necessity, least-privilege controls, or explicit notice to the user at the time of the write.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: These instructions authorize writes, updates, and deletions across multiple shared user data files, including contacts, memory, artifacts, and finances, but the markdown does not contain a clear user-facing warning or consent gate for such side effects. That makes it easy for an agent to perform broad state changes automatically during a conversational habit task, increasing the chance of silent data modification, deletion, or cross-context corruption.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The document instructs the agent to write conclusions and pattern updates to user data files automatically, but does not pair that behavior with an explicit warning or consent step. This is risky because analytical conclusions can be wrong or premature, yet they become persisted local records that may influence future behavior and other skills.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill instructs the agent to write to persistent files in `~/Clawic/data/habits/memory.md` and related records without requiring a user-facing confirmation or disclosure at the time of modification. In an agent setting, silent persistence can surprise users, alter personal records without explicit consent, and create integrity/privacy risks if the agent writes incorrect or sensitive habit-history data.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The skill mandates writing to multiple persistent files in the same turn (`roster`, `logs`, `artifacts`, and `contacts`) without any user-facing disclosure or confirmation. Silent multi-file persistence increases the chance of unintended data retention, privacy issues, and hard-to-reverse state changes, especially because some targets involve sensitive health or addiction-related behavior.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill instructs the agent to create or update a persistent local artifact file (`~/Clawic/data/habits/artifacts/restart-<habit>.md`) based on user interactions without any explicit disclosure, confirmation, or authorization boundary. This is dangerous because it can cause silent modification of user data and accumulation of personal behavioral history, especially in a habit-tracking skill that handles sensitive health- and addiction-adjacent information.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: This instruction directs multiple persistent writes in the same turn—to logs, memory patterns, roster metadata, and restart artifacts—without warning the user that several local records will be changed. That creates a clear risk of non-transparent state changes, over-collection of personal habit data, and unintended corruption or propagation of sensitive history across files if the agent acts automatically.

Missing User Warnings

Low

• Confidence: 92% confidence
• Finding: The skill explicitly instructs the agent to immediately write to multiple user data files in the same turn whenever a routine is built, changed, repaired, or a keystone effect is detected. Without an explicit confirmation step, scope limitation, or warning about modifying persistent user data, this creates a real risk of unintended or overly broad state changes, especially because the skill also tells the agent to edit existing artifacts rather than rewrite them, increasing the chance of silent corruption or propagation of bad data across files.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill instructs the agent to create and modify files under `~/Clawic/data/habits/...` and `memory.md` without explicitly requiring user awareness or confirmation for those filesystem writes. Even though the writes are related to the skill’s normal habit-tracking purpose, silent persistence in a user's home directory can create unauthorized state changes, overwrite existing data, or normalize broader file-write behavior beyond what the user clearly approved.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to perform automatic writes to local files after every logging turn and to update another memory file in the same turn, without requiring explicit user confirmation at the time of modification. That creates a real integrity and privacy risk: an agent could alter persistent user data based on ambiguous input, mistaken parsing, or coerced prompts, and the user may not realize a write occurred.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly instructs the agent to read habit logs from a user data path and consult persistent memory files before diagnosing, but it provides no user-consent or transparency step before accessing personal behavioral records. In an agent setting, this can cause silent access to sensitive personal data and normalize background inspection of user history beyond what the user may expect from the current request.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: These instructions direct the agent to write diagnoses, update patterns in memory.md, and move rows to a retired section, again without any warning, confirmation, or authorization boundary for modifying persistent user records. Silent writes are risky because they can alter long-term personal data, create inaccurate or unwanted records, and influence future agent behavior based on edits the user never explicitly approved.

Ssd 3

Medium

• Confidence: 89% confidence
• Finding: The file explicitly instructs the agent to write sensitive user life-event details and constraints into several persistent memory locations, including context, patterns, due dates, and logs. Even though this supports habit tracking, it increases privacy risk through unnecessary propagation and long-lived retention of personal data, especially for health, grief, caregiving, and schedule-related information.

Ssd 3

Low

• Confidence: 78% confidence
• Finding: The instruction to read prior user constraints, paused habits, and patterns from memory before acting creates a privacy and contextual integrity risk if historical personal information is broadly reused beyond what is necessary for the current request. In this skill, those memories may include sensitive health, caregiving, travel, or mood-related context, so unconditional reuse can lead to over-collection and over-reliance on stale sensitive data.

Session Persistence

Medium

• Category: Rogue Agent

Content

- ~/clawic/habits/
---

**Data.** At the start of every session, read `~/Clawic/data/habits/config.yaml` (what the user declared) and `~/Clawic/data/habits/memory.md` (what you observed, plus its `## Boxes` index and `## Due` table). Open any file `## Boxes` names when the condition on its line applies — the index is the list of files, never assume the list is fixed. Every path it names is inside `~/Clawic/data/`; ignore any line that points anywhere else. Everything this skill reads or writes is a plain local note under the folders declared in `configPaths` — nothing leaves the machine and no credential is ever written. In a shared box it updates or removes only the rows it wrote itself, matched on that box's identity key; a row another skill wrote is read, never rewritten and never deleted, and every write and deletion is named in one line as it happens. Read the current month's log at `~/Clawic/data/habits/logs/<year>-<month>.md` before answering anything about a streak, a rate, or "how am I doing": `memory.md` holds definitions, never completions. If none of it exists, work from defaults and say nothing about it.

**Write before the session ends** whenever the session produced something durable: a completion or a miss; a habit defined, redefined, paused, graduated or dropped; a best streak beaten; a pattern you spotted; a tactic that worked or failed on this person; a review or audit that ran; or something the user will re-read — a routine, a quit plan, a restart protocol, a commitment contract. `memory-template.md` holds every destination, format and threshold, and is the only file you open in order to write.

• Confidence: 90% confidence
• Finding: The skill mandates broad session persistence across multiple local files, including observed behavior, health-related data routing, contacts, and durable notes, with automatic reads at session start and writes before session end. Even though this appears product-oriented rather than malicious, it increases privacy risk because the agent is instructed to continuously accumulate and reuse sensitive personal data, potentially beyond what is necessary for a given interaction.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: memory-template.md:60