ClawHub
Back to skill

Security audit

Quit Weed

Security checks for vulnerabilities and agentic risk

Overview

This skill is not malicious, but it persistently records sensitive cannabis-use and mood/sleep details locally and includes overconfident withdrawal guidance that users should review before use.

Review this skill before installing if you share a device, use cloud backup or sync, or do not want substance-use and mood/sleep notes saved in plaintext under ~/quit-weed/. Treat its cessation content as general coaching, not medical advice, and seek professional or urgent help for severe distress, self-harm thoughts, psychosis, chest pain, dehydration, inability to sleep for multiple days, or other concerning symptoms.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:18
Finding

Plaintext Persistence of Sensitive Substance-Use and Health Data

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:18-25, 52-56, 69-74; assets/memory-template.md:4-23
Vulnerability Type: Sensitive data stored in plaintext without prescribed access controls
Risk Level: Medium

Complete Vulnerable Snippets

From SKILL.md:18-25:

markdown
Memory lives in `~/quit-weed/`. Created on first use.

\`\`\`
~/quit-weed/
├── memory.md          # Status, goal mode, quit date, streak, preferences
├── logs/
│   ├── cravings.md    # Craving entries: timestamp, intensity, trigger, context
│   └── smoke.md       # Smoke events (if reduce mode): timestamp, amount, trigger
├── checkins.md        # Daily check-ins: mood, sleep, craving count, notes
├── triggers.md        # Identified trigger patterns and replacement strategies
└── plan.md            # Active quit/reduce plan
\`\`\`

From SKILL.md:52-56:

markdown
When user reports a craving, log it with:
- Timestamp
- Intensity (1-10)
- Trigger (time of day, emotion, situation, social context)
- What they did about it

From SKILL.md:69-74:

markdown
Once per day (or when prompted), log:
- Mood (1-10)
- Sleep quality (1-10)
- Craving count today
- Any notes

This builds the data for pattern analysis.

From assets/memory-template.md:4-23:

markdown
## Status
- **Goal mode:** (quit / reduce / break)
- **Quit date:** (YYYY-MM-DD HH:MM)
- **Streak start:** (YYYY-MM-DD)
- **Previous attempts:** (count)
- **Last smoke:** (YYYY-MM-DD HH:MM)

## User Context
- **Typical usage:** (e.g. "daily, evenings, 2-3 joints")
- **Primary triggers:** (to be filled as patterns emerge)
- **Replacement behaviors:** (to be filled)
- **Reason for quitting:** (user's own words)

## Preferences
- **Check-in frequency:** (daily / every other day / weekly)
- **Tone:** (supportive / tough love / casual)
- **Money saved tracking:** (yes/no, monthly spend amount)

## Notes
(free-form agent notes — patterns observed, what works, what doesn't)

Technical Analysis

The ski ...[truncated 2155 chars]

Remediation
View remediation

Remediation Suggestions

  1. Create ~/quit-weed/ with owner-only permissions (0700) and every data file with mode 0600, independent of the user's default umask.
  2. Verify ownership and permissions before every read or write, and refuse unsafe symlinks or files owned by another account.
  3. Obtain explicit user consent before enabling persistent tracking and clearly enumerate the categories of information that will be retained.
  4. Minimize collection by avoiding unrestricted notes and storing only fields necessary for the requested tracking function.
  5. Provide configurable retention periods, selective record deletion, full data export, and secure account-level deletion controls.
  6. Offer encrypted-at-rest storage where the execution environment supports safe key management.
  7. Warn users that local backup, cloud synchronization, and shared-account configurations may copy or expose the records.
  8. Document the security boundary accurately: “no external requests” prevents direct transmission by the skill but does not protect against other local software or filesystem access.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly stores highly sensitive health and substance-use behavior data under ~/quit-weed/, including cravings, smoke events, mood, sleep, and recovery status, but the user-facing description does not clearly warn users about this local persistence. That creates a privacy risk because users may disclose sensitive addiction and mental-health-adjacent information without informed consent, and other local users, backups, sync tools, or endpoint monitoring software could access these files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This guidance gives behavioral reduction advice for cannabis use without any screening or warning that self-management may be unsafe for some users, including those who are pregnant, have severe withdrawal, or have co-occurring psychiatric or medical conditions. In a cessation-coaching skill, users may treat this as personalized health advice and delay appropriate clinical care or follow an unsuitable tapering plan.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The statement that cannabis withdrawal is 'never medically dangerous' and 'you won't die from it' is overly absolute and lacks qualification or guidance about when to seek professional help. In a cessation-support skill, users may rely on this advice to dismiss severe symptoms, co-occurring mental health crises, dehydration, suicidality, or other conditions that need prompt medical evaluation.

Content

No source excerpt is available for this finding.