Security audit

Birthday Reminder

Security checks for vulnerabilities and agentic risk

Overview

The skill is a local birthday manager with some documentation and privacy clarity issues, but I found no evidence of hidden execution, exfiltration, credential use, or destructive behavior.

Before installing, expect this skill to store birthday records locally, including names and birth years if provided. Review or fix the birthdays.md versus birthdays.json mismatch so you know where data is retained, and only use it if local persistence of this personal information is acceptable.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The overall purpose substantially matches birthday management: the script adds birthdays, lists upcoming birthdays, checks reminders, and computes age-related information. However, there is a clear resource mismatch: the description explicitly says birthdays are stored in /home/clawd/clawd/data/birthdays.md, while the code uses /home/clawd/clawd/data/birthdays.json. That is a material inconsistency in accessed resources. Additionally, the code includes a remove capability not declared in the description. The natural-language understanding mentioned in the description is not present in this code chunk; this may be handled elsewhere, so it is a weaker mismatch than the file-path discrepancy. Because the primary purpose aligns but the storage target is materially different, this should be flagged as a mismatch.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description presents a full birthday-management skill with natural-language understanding, storage, lookup, upcoming birthday checks, and age calculation. The supplied code chunk is much narrower: it is a standalone reminder script intended for cron jobs. It only loads existing birthday data from a JSON file, checks whether birthdays are 7, 1, or 0 days away, and prints reminder messages. While age-related output is partially supported, the core declared behaviors of remembering birthdays from user utterances, answering questions like 'Wann hat X Geburtstag?', and storing data in a markdown file are not implemented here. The resource usage also materially differs because the code accesses birthdays.json instead of the declared birthdays.md.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill clearly instructs reading from and writing to a persistent file, but it declares no tool scope or permission boundary. That creates unnecessary ambiguity about what filesystem access the skill requires and weakens enforcement, increasing the chance of over-privileged execution or unsafe tool use if the runtime grants broader defaults.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The activation rule 'use when the user mentions birthdays' is overly broad for a skill that persists personal data. It could trigger in ordinary conversation and lead to unintended file reads/writes, surprise data retention, or disclosure of stored birthday information when the user did not clearly request birthday management.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill stores personally identifiable information—names and dates of birth—in a persistent local file without a clear user-facing warning or consent step. Users may unknowingly cause sensitive personal data to be retained, which raises privacy and compliance risks and makes accidental over-collection more likely.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The top-level usage text says users can run add "Name" DD.MM.YYYY, implying the supplied year is meaningful for age calculation. In add_birthday, the parsed date's year is discarded and only the optional --year-born argument is stored, so the documented command behavior contradicts what the code actually preserves.

Description-Behavior Mismatch

Medium

Confidence: 98% confidence
Finding: The manifest says birthdays are stored in /home/clawd/clawd/data/birthdays.md, but the code hardcodes /home/clawd/clawd/data/birthdays.json. This is a direct description-behavior mismatch that affects where user data is actually persisted and what file format is used.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: This code file contains user-facing output in German, such as the invalid-date error message, and similar hard-coded German strings appear throughout the CLI. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.

Description-Behavior Mismatch

Medium

Confidence: 98% confidence
Finding: The manifest says birthdays are stored in /home/clawd/clawd/data/birthdays.md, but this script reads from /home/clawd/clawd/data/birthdays.json. That is a direct mismatch between the skill's claimed storage behavior and the implemented code, which could cause the skill to operate on a different data source than users expect.

Natural-Language Policy Violations

Low

Confidence: 78% confidence
Finding: Natural-language policy review applies to all file types. The skill description says it manages birthdays with natural language, but all example utterances and expected patterns are German-only, with no indication that users can choose another language or that the restriction is intentionally region-specific.

Natural-Language Policy Violations

Low

Confidence: 96% confidence
Finding: The reminder messages are emitted only in German string literals, which imposes a specific language on all users of the skill. The policy allows locale constraints only when they are clearly documented and justified or when the user is given a choice, neither of which appears here.

Static analysis

No suspicious patterns detected.