ClawHub
Back to skill

Security audit

Calorie Tracker

Security checks across malware telemetry and agentic risk

Overview

The skill is a coherent calorie tracker, but it silently keeps sensitive food and goal history in a local memory file without clear user consent or deletion controls.

Review this skill before installing if you are comfortable with it storing calorie goals, eating patterns, preferences, label data, recipes, and restaurant favorites in ~/calories/memory.md. Consider deleting that file or avoiding the skill if you do not want long-term local retention of food and health-adjacent history, or if calorie tracking could be medically or emotionally unsafe for you.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
86% confidence
Finding
The description 'Track calories and macros conversationally. Auto-adapts to your goals and style.' is broad and lacks clear trigger boundaries, which can cause the skill to activate in loosely related health, diet, or body-image contexts. In a health-adjacent skill, ambiguous activation increases the chance of unsolicited guidance in sensitive situations such as eating disorders or contraindicated populations.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill instructs persistent storage of health-related user data in '~/calories/memory.md' but does not require a clear, upfront disclosure that sensitive dietary goals, patterns, and possible health indicators will be retained locally. Because this data can reveal health status or eating-disorder-related behavior, undisclosed persistence creates meaningful privacy and safety risk.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill explicitly encourages persistent storage of packaged foods, homemade recipes, restaurant favorites, and repeated meal history, but provides no notice about retention, consent, or deletion controls. Food history can reveal sensitive health, religious, lifestyle, and location-linked patterns, so silently building a long-term library increases privacy risk if users are unaware or if the data is later exposed or repurposed.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.