ClawHub
Back to skill

Security audit

TODO List Pro

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward local todo-list helper that stores task state in a disclosed SQLite file and does not show hidden, network, credential, or system-persistence behavior.

Before installing, understand that the skill will create and maintain a local SQLite todo database and can permanently delete todo rows only after explicit confirmation. Use the default path unless you intentionally set TODO_LIST_DB_PATH or --db-path to a specific test or custom database file.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill instructs use of an environment variable (`TODO_LIST_DB_PATH`) to alter file-write behavior, but it does not declare any explicit tool scope or permissions boundary. That can let the agent operate on an unexpected filesystem target if the runtime honors attacker-influenced environment values, increasing the risk of unintended reads/writes or persistence outside the intended database location.

Natural-Language Policy Violations

Medium
Confidence
92% confidence
Finding
The instruction says to use this file when the user expresses actions in conversational Chinese or mixed Chinese-English phrasing, which encodes a language-specific behavior. There is no accompanying opt-in, alternative language option, or documented justification that this skill is intended only for a Chinese-specific context.

Session Persistence

Medium
Category
Rogue Agent
Content
## Test Isolation

- Point `TODO_LIST_DB_PATH` at a temporary file during local tests.
- Do not write tests against the user's real `~/.work_report_summary` directory.
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.