Journal

• Outcome: Review
• Latest audit: Jul 27, 2026 · 8:56 AM UTC
• Version: 1.0.2

Overview

The skill appears local and purpose-built, but it should be reviewed because it automatically stores sensitive journal-derived data across several personal files.

Install only if you are comfortable with an assistant maintaining a persistent local journal system, including sensitive metadata such as mood ratings, avoided topics, prompt history, reviews, work notes, and limited shared health or finance records. Review the configured paths and read-scope settings before use, and treat the journal folder as highly private local data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (19)

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to write a user's mood rating into `~/Clawic/data/health/mood.md`, which is outside the journal's primary storage and falls into a more sensitive health-related record. This creates a cross-domain data flow from journaling into health tracking without a clear consent check at capture time, increasing privacy risk and the chance of silently creating sensitive medical-adjacent records.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The file instructs the agent to store compensation data in a finances datastore, which extends the skill into personal-finance handling outside its stated journaling scope. Because compensation is highly sensitive, this cross-scope write increases privacy risk and may cause sensitive financial data to be stored or organized without clear user awareness.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The file instructs the agent to store compensation data in a finances datastore, which extends the skill into personal-finance handling outside its stated journaling scope. Because compensation is highly sensitive, this cross-scope write increases privacy risk and may cause sensitive financial data to be stored or organized without clear user awareness.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill description contains very broad activation phrases such as wanting to 'write,' 'vent,' 'get something out of their head,' or asking for help when 'stuck.' These overlap heavily with ordinary conversation and sensitive emotional contexts, increasing the chance the skill is invoked when the user intended a different capability, including support or note-taking flows with different safety boundaries.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill directs the agent to write and append persistent journal files automatically, including collision handling and file creation behavior, without an explicit user-facing notice that durable data will be modified. Silent persistence is risky because users may believe they are only chatting, while the agent is creating or altering records on disk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The post-capture workflow expands writes beyond the entry itself into `health/mood.md`, `memory.md`, and read-scope state, again without an explicit warning or per-destination consent. Because these auxiliary files can encode sensitive emotional state, habits, and privacy preferences, the hidden persistence broadens the data footprint and raises the risk of unintended disclosure or overcollection.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This instruction directs the agent to persist highly sensitive mental-health-adjacent journal content and related workflow artifacts to files, but it does not clearly require user awareness or consent about retention, later discoverability, or where the data will surface. In a journaling skill, this is especially risky because entries may contain trauma, conflict, shame, or crisis-related material, so silent persistence can create significant privacy and safety harm if exposed, synced, searched, or reused later.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill instructs the agent to infer crisis-routing details by reading country information from a profile file without an explicit privacy disclosure or user confirmation. Even if used for safety-oriented escalation, accessing profile data behind the scenes expands processing of sensitive personal context and may surprise users during a highly vulnerable interaction.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: These lines instruct retention of escalation notes and memory records tied to crisis-like or sensitive observations, while explicitly controlling what is quoted but not clearly warning that sensitive metadata is still being retained. In this skill context, even minimal records about escalation events, dates, observations, and actions can reveal mental-health crises, abuse concerns, or other deeply sensitive states if later accessed, correlated, or surfaced.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The template example includes `entry_language: german` as if it were a normal default, while the surrounding text says preferences should only be written when the user states them. In a journaling skill, silently imposing a language preference can alter user data handling and produce incorrect or unwanted writes, especially for multilingual users.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The file instructs the agent to persist highly sensitive journaling content and related metadata to specific local paths, including grief letters, health-related series, decisions, and practice history, without any explicit requirement to warn the user, obtain consent, or confirm storage expectations. In a journaling skill, this is particularly risky because users may disclose intimate mental-health, relationship, or medical information and may not realize it is being written into durable files that could later be searched, synced, or exposed.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly directs the agent to persistently record prompt outcomes, user-defined no-go topics, and user-invented prompts without any indication that the user is informed or has consented. In a journaling context, these fields can reveal sensitive emotional triggers, avoidance areas, and behavioral patterns, creating a privacy risk and enabling silent profiling over time.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill explicitly instructs the agent to append review output into persistent journal files (`reviews/<year>.md`) as part of normal operation, but it does not require an explicit user confirmation at write time. Because journal content is sensitive and persistent, automatic modification can surprise the user, overwrite expected workflows, or create privacy/integrity issues if the review is run on the wrong scope or with mistaken inferences.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This instruction directs the agent to perform multiple writes in the same turn across several persistent files (`reviews`, `memory.md`, `decisions`, annual artifacts, and due tables) without a consolidated warning or confirmation step. Bulk writes increase the chance of unintended data corruption, privacy exposure, or propagation of incorrect analysis across the user's journal system, especially because the skill also directs reading from broad personal-history sources.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The markdown directs automatic writes to several files and datastores in the same turn, including contacts and finances paths, without an explicit warning or confirmation before modifying data. This is dangerous because it can cause silent, broad side effects across sensitive personal stores, especially when a user believes they are only journaling.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The instruction to read prior memory files and a no-go file before offering prompts establishes ongoing retention and reuse of sensitive journaling interaction history. Because journaling commonly involves mental health, relationships, conflict, and other intimate topics, this creates a meaningful privacy and data-handling risk if done without explicit notice, consent, and strict scoping.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The skill instructs the agent to log rejected prompts and retain that interaction history for future decision-making, which is a form of longitudinal behavioral tracking. Even if intended to improve personalization, it silently accumulates data about what topics or framing the user avoids, which may itself be sensitive in a journaling product.

Ssd 3

Medium

• Confidence: 86% confidence
• Finding: The guidance contemplates identifying patterns from prior entries and surfacing them to the user, which can amount to profiling based on deeply personal writing. Although framed as a journaling aid and tempered by caution about not surprising the user, the surrounding skill context makes the inferred patterns especially sensitive and potentially invasive if generated or stored without clear consent.

Ssd 3

Medium

• Confidence: 98% confidence
• Finding: The instruction to write prompt outcomes, no-go topics, and user-created prompts into persistent memory in the same turn mandates immediate storage of potentially sensitive data without any gating step. In a journal skill, no-go topics may directly encode trauma, conflict, health, or other intimate boundaries, so persistent capture materially increases harm in the event of misuse, overreach, or compromise.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.