ClawHub
Back to skill

Security audit

Fasting Tracker

Security checks across malware telemetry and agentic risk

Overview

This is a local, instruction-only fasting tracker whose behavior matches its stated purpose, with some usability and health-safety cautions.

Install only if you are comfortable with local fasting logs, schedules, reminders, and background tracking. Use explicit commands, confirm before starting or ending a fast when possible, and do not rely on the skill as medical advice, especially for extended fasts or if you have health conditions, medication interactions, pregnancy, or eating-disorder history.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger phrase list includes common natural-language phrases such as "start fast" and "how long fasting," which can plausibly appear in ordinary conversation and cause accidental invocation. In a health-related skill that records state and may set background tracking or reminders, unintended activation can create unwanted logging, notifications, or confusion about whether a fast has been started or ended.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The usage examples rely on ambiguous conversational phrases like "Start a fast" and "begin fasting" without strong activation boundaries, increasing the chance that normal discussion is interpreted as a command. Because this skill changes persistent health-tracking state, accidental invocation can lead to incorrect records, misleading progress data, and unintended background behavior.

Shadow Command Trigger

Medium
Category
Trigger Abuse
Confidence
79% confidence
Finding
The trigger "start fast" begins with the built-in verb "start," creating a shadow-command conflict that can interfere with command routing or cause the skill to be launched when the user intended a different built-in action. In this skill's context, that can unexpectedly initiate fasting timers or background tracking, which is more problematic than a purely informational misfire because it alters persistent user state.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.