ClawHub
Back to skill

Security audit

Diet Logger

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward diet-log helper that writes meal entries to a disclosed Obsidian/iCloud Markdown folder.

Install only if you want meal records written to the disclosed Obsidian/iCloud folder. If that path is not your vault, edit the script path before use; the logs may persist locally and sync through iCloud.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill documentation clearly instructs the agent to run a local Python script that reads and writes files, but the skill does not declare those capabilities as permissions. This creates a transparency and policy-enforcement gap: an agent or reviewer may underestimate the skill's ability to modify user data in the Obsidian vault, increasing the risk of unintended file access or writes.

Static analysis

No suspicious patterns detected.