ClawHub
Back to skill

Security audit

What Should We Do?

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent activity-planning assistant, but it can use location, calendars, stored contacts, scheduled reminders, and outbound messages with broad triggers and limited confirmation detail.

Review this skill before installing. Use it only if you are comfortable storing activity preferences, routines, group membership, and contact details in the workspace. Before allowing calendar, Places, Telegram, or cron actions, confirm the exact data, recipients, messages, and reminders, and avoid storing third-party contact details unless those people have agreed.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (10)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
---
name: whatdo
description: "What should we do? Smart activity discovery with live weather, local movie showtimes, streaming recommendations, game library matching, group profiles, routines & traditions, favorites/blacklists, business hours, ratings filtering, Quick Mode for instant suggestions, calendar integration (Google Calendar + cron reminders), group invites via Telegram/message channels, and RSVP tracking. Helps you stop scrolling and start living. Use when someone says 'what to do', 'bored', 'fun', 'tonight', 'date night', 'things to do', 'activity ideas', 'entertainment', 'adventure', 'what should
Confidence
80% confidence
Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Vague Triggers

Medium
Confidence
98% confidence
Finding
The manifest advertises very broad triggers like 'fun', 'tonight', and 'bored', which can cause the skill to activate in many unrelated conversations. That raises the risk of unintended execution of privacy-impacting behaviors such as reading location, preferences, calendar data, or initiating planning flows without sufficiently specific user intent.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The quick reference repeats ambiguous high-collision phrases and maps them directly to actions, including Quick Mode behavior that suppresses clarifying questions. In context, accidental invocation is more dangerous because the skill is designed to immediately inspect weather, location, history, preferences, and calendars.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill instructs the agent to read USER.md for location and use stored personal data before generating suggestions, but it does not present a prominent privacy notice or obtain clear consent first. Because these checks are part of the default workflow, users may not realize their location, habits, and group data are being processed.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
- If it's 11pm → probably "right now" or "tonight" and lower energy
- If they said "date night" → that answers who's coming, load the date_night group profile
- If a group profile has dietary info → factor it in automatically
- If weather is terrible → lean toward indoor suggestions without asking

## Live Weather Integration
Confidence
84% confidence
Finding
The skill explicitly directs the agent to infer user preferences and alter recommendations 'without asking', which reduces user awareness and control over how personal and group data is used. In combination with automatic weather, calendar, and profile checks, this can lead to silent processing and action selection based on sensitive attributes.

Ssd 3

Medium
Confidence
94% confidence
Finding
The instruction to 'display group profile with contacts' normalizes revealing stored Telegram handles, phone numbers, and email addresses in ordinary responses. This creates unnecessary exposure of third-party personal data and increases the chance of disclosure to the wrong person or channel.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# Create a calendar event via Google Calendar API (REST)
curl -s -X POST 'https://www.googleapis.com/calendar/v3/calendars/primary/events' \
  -H "Authorization: Bearer $GOOGLE_CALENDAR_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
92% confidence
Finding
The Google Calendar example transmits event metadata, attendee emails, location, and preference-derived notes to an external service. While expected for calendar integration, it is still a real data-exfiltration surface because sensitive personal and third-party information is sent off-platform and could be over-shared in descriptions or attendees.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill includes direct invite-sending and reminder workflows to third parties, but the warning and consent model is weak relative to the action's sensitivity. Sending messages to stored contacts can affect non-users and expose event details or relationship data if triggered with insufficient verification.

External Transmission

Medium
Category
Data Exfiltration
Content
**Text Search** (best for specific types):
```bash
curl -s -X POST 'https://places.googleapis.com/v1/places:searchText' \
  -H "Content-Type: application/json" \
  -H "X-Goog-Api-Key: $GOOGLE_PLACES_API_KEY" \
  -H "X-Goog-FieldMask: places.displayName,places.formattedAddress,places.rating,places.userRatingCount,places.priceLevel,places.googleMapsUri,places.types,places.currentOpeningHours" \
Confidence
79% confidence
Finding
Google Places requests send user-location-derived search context to a third-party provider, which is an external transmission of personal context. In this skill, the risk is elevated because nearby suggestions are driven from user location and could be performed automatically in default flows.

Ssd 3

Medium
Confidence
90% confidence
Finding
The first-time setup encourages collecting and persisting friends' identities, group membership, and preferences for later use without a clear necessity or consent model for those third parties. That expands the data footprint and creates avoidable privacy and retention risks.

Static analysis

No suspicious patterns detected.