ClawHub
Back to skill

Security audit

Beaverhabits

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Beaver Habits API helper that uses a user-provided token to list and update habit completions.

Before installing, set BEAVERHABITS_API_KEY only in a trusted environment and use the default Beaver Habits service or a self-hosted SERVER_URL you control over HTTPS. The skill can read your habit list and mark habits done or undone through that API token.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
70% confidence
Finding

Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Content

Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.

md
## Usage Instructions

- When the user asks to list, show, or check habits, always respond with the ASCII overview table (not a plain list).
- After completing or uncompleting a habit, always re-render the overview table to show the updated state.
- Resolve habit names → IDs via list_habits. Never ask the user for a habit_id.
- Default to today's date for completions unless specified. Use `date_fmt=%d-%m-%Y`.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill instructs users to use a permanent API token in Authorization headers for network requests but does not warn that this credential is long-lived and will be transmitted to a remote server, including potentially self-hosted instances via SERVER_URL. This increases the risk of credential misuse or exfiltration if the endpoint is untrusted, misconfigured, or observed in logs/proxies.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The skill sends an Authorization bearer token to an external endpoint using curl, which is a real external transmission of sensitive credentials. This is expected for an API integration, but it becomes dangerous because SERVER_URL is configurable and could point to an attacker-controlled or insecure host, causing token disclosure.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

Step 1 — Get all habits:

bash
curl -s -H "Authorization: Bearer $BEAVERHABITS_API_KEY" \
  "${SERVER_URL:-https://beaverhabits.com}/api/v1/habits"

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

md
Mark a habit as done (or undone) for a specific date.

Parameters:
- `habit_id` (resolved): Automatically resolved by calling list_habits and matching the user's habit name. Never ask the user for this value.
- `date` (required): Date in DD-MM-YYYY format
- `done` (optional): true to complete, false to uncomplete (default: `true`)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

md
Mark a habit as done (or undone) for a specific date.

Parameters:
- `habit_id` (resolved): Automatically resolved by calling list_habits and matching the user's habit name. Never ask the user for this value.
- `date` (required): Date in DD-MM-YYYY format
- `done` (optional): true to complete, false to uncomplete (default: `true`)