Security audit

ADHD Body Doubling

Security checks across malware telemetry and agentic risk

Overview

This skill appears purpose-aligned for ADHD body-doubling, with local session history as the main privacy consideration.

Install only if you are comfortable with the skill saving body-doubling session details locally, including task descriptions, energy levels, blockers, and outcomes. Avoid entering confidential work, health, financial, or personal details unless you are comfortable with them being retained on your device, and periodically review or delete the local history directory if needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The protocol explicitly instructs the skill to persist detailed session history under a local path, including task descriptions, energy levels, blockers, and outcomes, but the skill metadata does not disclose any persistent storage behavior. This creates an undisclosed data-retention risk and can expose sensitive productivity or mental-health-adjacent information to other local users, backups, or later compromise.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The protocol goes beyond transient body-doubling support by directing the system to perform longitudinal pattern recognition over accumulated user behavior, such as completion rates, energy patterns, and task resistance. Even if intended as a coaching feature, this amounts to behavioral profiling that is not clearly necessary for the stated purpose and increases privacy sensitivity if retained over time.

Missing User Warnings

Low

Confidence: 90% confidence
Finding: The README explicitly states that session history is stored under a local path and describes analytics derived from those sessions, but it does not warn users that their task descriptions, work habits, or other potentially sensitive productivity data may be persisted on disk. In the context of a body-doubling/accountability skill, users are likely to enter personal, business, or confidential work details, so silent retention increases privacy risk even if there is no direct exfiltration described.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The skill advertises many broad natural-language triggers such as 'I can't focus', 'I'm stuck', and 'help me start', which can cause the skill to activate in conversations where the user did not explicitly request this workflow. Unintended invocation can redirect user interactions, capture sensitive context into the skill's session flow, or initiate persistence features without clear user intent.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill states that it 'tracks session history' but does not provide an upfront, user-facing privacy notice or consent mechanism near the feature description. Users may disclose sensitive productivity, health, or work information during sessions without realizing it may be stored locally for later retrieval.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill explicitly documents a local storage path and the categories of tracked session data, but still does not present an upfront privacy warning or consent step. Because the stored fields include behavioral patterns, energy levels, and completion history, this can create privacy risk if the device is shared, compromised, or if users were unaware that these details would be retained.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The history section describes collecting a broad set of detailed behavioral and productivity data without any accompanying privacy notice, warning, or consent flow. Because users may reveal sensitive work content, habits, and energy patterns during support sessions, silent retention materially increases privacy and trust risk.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The script collects free-form user task descriptions and writes them to a persistent history file under the user's home directory without clearly warning the user before soliciting the data or obtaining consent. In this skill context, those entries can reveal sensitive personal, work, health, financial, or productivity information, and local persistence increases the risk of later disclosure through other local users, backups, sync tools, or compromised applications.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.