ClawHub
Back to skill

Security audit

Baby Tracker

Security checks across malware telemetry and agentic risk

Overview

This is a coherent local baby-tracking skill, but it can store sensitive baby care and health details on disk.

Install only if you are comfortable keeping baby-care, routine, and possible health data in local files. Protect the data directory, use dry-run before large imports, avoid unnecessary raw source_text or notes when privacy matters, and periodically review or delete generated records and charts.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill explicitly recommends preserving the original user message in `--source-text`, which can store sensitive health and infant-care details verbatim in a local CSV without a privacy warning or minimization guidance. Raw message retention increases exposure of unnecessary personal data and may capture incidental secrets or free-text notes beyond what is needed for tracking.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The import instructions encourage ingesting Huckleberry CSV exports and preserving original row text and structured details locally, but they do not clearly warn users that third-party app exports may contain sensitive baby health history and personal notes. This creates a meaningful privacy risk because users may import and persist large volumes of medical/behavioral data without informed consent about local storage and retention.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.