ClawHub
Back to skill

Security audit

matter-day-reminder

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent local birthday and anniversary reminder skill, with privacy and dependency hygiene issues users should understand before use.

Install only if you are comfortable storing friends' and family members' dates, preferences, and relationship notes in local unencrypted files. Keep the reminder-data directory private, avoid committing it to public repos, do not place real SMTP passwords in shared config files, and update the Node dependencies before using shared or untrusted contact files.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (22)

Known Vulnerable Dependency: js-yaml==4.1.1 — 4 advisory(ies): CVE-2026-84375 (js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources); CVE-2026-59869 (js-yaml: YAML merge-key chains can force quadratic CPU consumption); GHSA-5p4m-2wfm-xmqj (JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026) +1 more

High
Category
Supply Chain
Confidence
97% confidence
Finding

The lockfile pins js-yaml to version 4.1.1, and the referenced advisories indicate parser-level denial-of-service issues caused by adversarial YAML inputs that trigger excessive CPU consumption. If any part of this skill or its supporting scripts parses untrusted or user-influenced YAML, an attacker could cause hangs or resource exhaustion; even if only used in tooling, the vulnerable dependency remains a real supply-chain weakness.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: js-yaml==4.1.1 — 4 advisory(ies): CVE-2026-84375 (js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources); CVE-2026-59869 (js-yaml: YAML merge-key chains can force quadratic CPU consumption); GHSA-5p4m-2wfm-xmqj (JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026) +1 more

High
Category
Supply Chain
Confidence
97% confidence
Finding

The file declares js-yaml 4.1.1, which is flagged with multiple advisories for CPU exhaustion issues during YAML parsing. If any script in this skill parses attacker-controlled or even semi-trusted YAML, an attacker could trigger denial of service through excessive CPU consumption; the package being in helper scripts lowers exposure somewhat, but does not remove the risk because skill assets and tooling often process external content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill explicitly states that contact information and preferences are stored locally and that an email service may be used, but it does not warn users that they are handling sensitive personal data. This can lead users to record names, birthdays, relationships, interests, and reminder content without informed consent or awareness of privacy and transmission risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README states that personal contact information, birthdays, anniversaries, preferences, and relationship details are stored locally in Markdown files, but it does not prominently warn users that this is sensitive personal data. Users may store third-party personal information without understanding retention, access, backup, or exposure risks, especially because examples include detailed profile data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The README includes example trigger phrases such as “最近有什么重要日子吗？” that are broad, natural-language requests likely to overlap with ordinary conversation. In an agent environment, this can cause accidental invocation of the skill in contexts where the user did not intend to access or expose personal contact/date data, increasing privacy and misrouting risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger keywords include broad everyday phrases such as ‘礼物建议’、‘祝福语生成’、‘联系人管理’, which can cause the skill to activate in contexts where the user did not intend to invoke it. Because the skill handles personal relationship data and may create or modify local files, accidental invocation increases the risk of unintended data collection, storage, or reminder-related actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill stores personal data locally, may send notifications via email, and uses AI generation based on sensitive relationship and preference information, but it does not clearly warn users about what data is collected, where it is stored, or how it may be transmitted. This creates privacy and consent risks, especially because contact details, birthdays, preferences, and SMTP credentials may be exposed through local files, logs, backups, or outbound notification channels.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

文档规定农历输入“必须统一”为中文格式，并整体以中文作为固定交互与输出形式，没有说明可根据用户偏好选择其他语言或本地化格式。这构成了语言/locale 约束，但未见用户选择、显式 opt-in，亦无区域合规性等必要性说明。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file is entirely authored in Chinese, including field values and headings, with no indication that the skill is region-specific or that users can choose another language. Under the policy rules, a fixed language/locale without opt-in or documented justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This JSON eval file contains multiple Chinese-only prompts, assertions, and expected outputs that implicitly require the skill to operate in Chinese. Under the policy, forcing a specific language without user opt-in or a documented regional justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown file presents all user-facing schema documentation exclusively in Chinese, including headings, field explanations, and examples. Under the policy rule for natural-language violations, forcing a specific language without user opt-in can be a locale policy issue when no alternative language option or justification is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This code's user-facing descriptions and generated content are written in Chinese only, and the templates throughout the file likewise produce Chinese-language output by default. That creates a language policy concern because the skill forces a specific language/locale without any visible user opt-in or configurable alternative.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

L009-L015 的注释将 isLeapMonth 描述为有效输入参数，表示该函数应区分普通月与闰月的农历日期。但 L016-L019 实际仅调用 Lunar.fromYmd(lunarYear, lunarMonth, lunarDay)，完全未使用 isLeapMonth，因此对“闰八月初五”这类输入的行为与文档承诺不一致。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

该技能清单明确支持农历生日，而闰月是农历日期的重要组成部分。L058-L063 的注释将该函数表述为通用农历日期到阳历日期转换，但 L064-L066 仅接受月和日并直接调用同样不处理闰月参数的 lunarToSolar，与“农历日期”这一注释语义存在实质偏差。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

L190-L195 的注释暗示该函数可用于一般农历生日计算；同时本文件的 parseLunarDate 在 L168-L172、L179-L183 会返回 isLeapMonth。但 L196-L212 的生日计算接口没有 isLeapMonth 参数，内部仅按月/日转换，导致代码文档与模块实际可正确支持的农历生日范围不一致，尤其对闰月生日会产生错误或歧义。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script prints formatted reminders and a full JSON dump of reminder records to stdout when run directly, which can expose personal data such as contact names, relationships, and important dates in logs, terminals, CI output, or calling systems. In the context of a personal social-assistant skill, this data is inherently sensitive, so unconditional stdout emission increases privacy risk even if there is no remote attacker primitive in this file alone.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The quick-start flow encourages immediate entry of a friend's details without warning that this creates persistent local records containing personal information. While not an active exploit, it increases the likelihood of inadvertent collection and storage of third-party personal data without user awareness.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

This JavaScript file contains user-facing natural-language text entirely in Chinese, including the file header and test descriptions, with no indication that language choice is configurable or limited to a justified region-specific context. Under the policy, forcing a specific language without user opt-in is a locale/language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

This JavaScript file uses Chinese-only natural-language comments, examples, error messages, and formatted return strings such as "农历..." throughout the skill. The stated policy forbids forcing a specific language or locale unless the user is offered a choice or the locale restriction is clearly documented and justified; neither appears here.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
86% confidence
Finding

The dependency uses a caret range (^4.1.1), which allows future minor and patch releases to be installed. This weakens reproducibility and can introduce unexpected or compromised upstream changes during later installs, though by itself it is mainly a supply-chain hygiene issue rather than an immediately exploitable flaw.

Content

Scanner excerpt · scripts/package.json (reported line 11)May include surrounding context.

json
"test-lunar": "node test-lunar.js"
  },
  "dependencies": {
    "js-yaml": "^4.1.1",
    "lunar-javascript": "^1.7.7"
  }
}

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
83% confidence
Finding

The lunar-javascript dependency is also specified with a caret range, so installs are not fully deterministic and may pull in newer releases than originally tested. This increases supply-chain exposure and operational risk, although no direct package-specific exploit is shown in this finding alone.

Content

Scanner excerpt · scripts/package.json (reported line 12)May include surrounding context.

json
},
  "dependencies": {
    "js-yaml": "^4.1.1",
    "lunar-javascript": "^1.7.7"
  }
}

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The script's user-visible messages and labels are hard-coded in Chinese, including warnings and reminder output, with no option to select another language. This creates a language/locale policy concern because the skill imposes a specific language without user opt-in.

Content

No source excerpt is available for this finding.