ClawHub
Back to skill

Security audit

ADHD Daily Planner

Security checks across malware telemetry and agentic risk

Overview

This is an informational ADHD planning skill with no evidence of code execution, data access, persistence, or exfiltration, though users should treat the medication and crisis-planning sections as non-medical support only.

Safe to install from a security perspective: it appears to be informational markdown only. Before relying on it, understand that it is not medical care; use medication notes only for tracking or questions to discuss with a prescriber, and seek local emergency or crisis support for self-harm risk, danger, or acute mental-health distress.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly asks whether the person is in 'crisis mode' and gives behavioral guidance ('Skip planning, identify ONE smallest possible action') without any disclaimer that it is not a mental-health crisis resource or instructions to seek urgent professional help when appropriate. In a planning/wellness-oriented skill aimed at neurodivergent users, people may reasonably rely on it during acute distress, which can delay access to appropriate crisis support.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The medication section includes a field asking whether a 'tomorrow adjustment' is needed, which can be interpreted as encouraging self-adjustment of prescription medication without clinician oversight. In a mental health/ADHD support skill, users may be especially likely to rely on this guidance, creating risk of unsafe dosing changes, adverse effects, or delayed medical care.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.