ClawHub
Back to skill

Security audit

Cycle Sync Training

Security checks for vulnerabilities and agentic risk

Overview

The skill is not malicious, but it handles menstrual-cycle health data and persistent storage without clear consent, retention, or privacy controls.

Review before installing. Use this only if you intentionally want cycle-based fitness guidance, and do not log menstrual, symptom, mood, or energy data unless you understand where the Supabase backend stores it, who can access it, and how to delete it. A safer version should ask for consent, narrow its trigger to explicit cycle-related requests, and document retention and sharing controls.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

High
Confidence
95% confidence
Finding
The trigger explicitly says to invoke this skill for general women's workout planning even when the user does not mention menstrual cycle topics. That can cause the agent to infer or center sensitive reproductive-health context without clear user intent, leading to inappropriate handling of health data and potentially discriminatory or privacy-invasive responses.

Missing User Warnings

High
Confidence
97% confidence
Finding
The skill processes highly sensitive health data, including menstrual phase, symptoms, mood, energy, and cycle dates tied to a user_id, but provides no user-facing notice about storage, sharing, retention, or consent. In the documented flow, this data is sent through the MCP server and stored in Supabase, creating meaningful privacy and compliance risk if users are not clearly informed and given control.

Static analysis

No suspicious patterns detected.