ClawHub
Back to skill

Security audit

Ai Companion Diet

Security checks across malware telemetry and agentic risk

Overview

This diet-tracking skill stores personal health and meal data locally as part of its advertised purpose, with no evidence of hidden network transfer or unsafe installation behavior.

Install only if you are comfortable keeping weight, meal, activity, and body-metric history as plaintext files in the skill's local data directory. Avoid using it on shared machines, and delete the local data folder when you no longer want those records retained.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill declares no permissions, yet its documented behavior includes reading and writing local files such as user_data.json, daily records, and history files. This creates a transparency and least-privilege problem: users and reviewers are not clearly informed that personal health data will be persisted to disk, increasing the risk of unintended data exposure or misuse.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill collects and stores sensitive health-related information, including weight, diet logs, activity, and body metrics, but does not provide an explicit privacy notice, retention policy, access controls, or handling safeguards. Because this data is highly sensitive, inadequate disclosure and protection can lead to privacy harm, unauthorized access, and regulatory/compliance issues if the files are exposed or shared.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The script collects and stores sensitive health data including sex, age, height, weight, target weight, activity level, and weight history in local JSON files without any notice, consent flow, access control, or retention safeguards. In a diet/health companion context, this data is particularly sensitive, so local plaintext persistence increases privacy risk if the host is shared, compromised, or backed up to less secure locations.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.