ClawHub

TimeCamp

Security checks across malware telemetry and agentic risk

Overview

This TimeCamp skill appears purpose-aligned, but it can access sensitive employee activity and user data with weak scoping and privacy guidance.

Install only if you intend to let the agent use your TimeCamp account. Treat the API key as sensitive, confirm the requested TimeCamp action before any write or bulk read, and avoid using employee activity or all-user queries unless you are authorized to access that monitoring data.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The trigger list includes broad terms like "tracking," "hours," "timer," and "tasks list," which can cause the skill to activate for generic productivity or scheduling queries unrelated to TimeCamp. This increases the chance that the agent will invoke a capability that can read or modify time-tracking data when the user did not intend to use this integration.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill explicitly instructs use of datasets such as `computer_activities` and `users`, which can expose employee activity monitoring data and personal details, but it provides no privacy warning, consent requirement, or access-control guidance. In a time-tracking context, these datasets are especially sensitive because they can reveal work patterns, applications used, and identifiable staff information at scale.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal