ClawHub
Back to skill

Security audit

Track

Security checks for vulnerabilities and agentic risk

Overview

The skill locally records habit data and is purpose-aligned, though its description overstates available features and users should be aware it creates persistent personal tracking files.

Install only if you want an agent to keep local habit records. Treat casual mentions of habits or goals carefully and ask for confirmation before logging; also note that many advertised features are not actually included in this package.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding
The code does implement a narrow subset of the declared description: it tracks habit completions by storing entries locally. However, the declared purpose describes a broader system for habits, goals, progress, streaks, visual trends, and accountability reminders. This code chunk does not track goals, compute progress, maintain streaks, generate visualizations or trends, or send reminders. Its actual behavior is limited to appending habit records to a JSON file. Because the declared description materially overstates the implemented capabilities and the primary behavior here is much narrower than advertised, this is a mismatch.

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill describes file read/write behavior via local storage under `memory/track/` but does not declare any explicit tool scope or permissions. That creates an authorization transparency gap: the agent may access filesystem capabilities without a clearly constrained contract, increasing the chance of unintended data access or writes beyond the user’s expectation.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The activation language is broad enough that ordinary conversation about goals, progress, or accountability could trigger the skill when the user did not intend persistent tracking. In a skill that writes personal habit and goal data to local storage, overbroad activation can lead to unwanted collection, retention, or modification of sensitive personal information.

Static analysis

No suspicious patterns detected.