ClawHub
Back to skill

Security audit

Stress Relief

Security checks across malware telemetry and agentic risk

Overview

This is a local, instruction-only stress relief skill with sensitive wellness logging, but no executable code, network access, credentials, or hidden behavior.

Safe to install for ordinary use, with privacy caution: only log stress details you are comfortable storing locally, review or delete local notes if your agent platform supports it, and seek professional or emergency help for crisis situations.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The trigger phrases are common emotional expressions like 'stressed out' and 'overwhelmed' that are likely to appear in ordinary conversation, which can cause unintended activation. In a mental-health-adjacent skill, accidental invocation is more sensitive because it may initiate stress logging or expose wellness-related functionality when the user did not explicitly consent in that moment.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill advertises automatic tracking of stress events and collection of context, intensity, and symptoms, which are sensitive mental-health-related data points, but it does not present a clear up-front disclosure about what is collected, how long it is retained, and when logging occurs. Although the file later claims data stays local, the warning is not prominent where data collection is introduced, which increases the risk of uninformed consent and mishandling of sensitive personal information.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.