ClawHub
Back to skill

Security audit

ADHD external brain

Security checks for vulnerabilities and agentic risk

Overview

This is a text-only ADHD productivity helper with disclosed memory and task-planning behavior, though some trigger phrases are broad enough to activate unintentionally.

Safe to install if you want a conversational ADHD task and memory assistant. Before using it heavily, check how your agent stores and deletes Memory_Box and Task_Pool entries, and avoid saving highly sensitive information unless retention controls are clear.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger phrase "review" is extremely generic and commonly appears in normal conversation, making unintended skill invocation likely. In a stateful assistant that stores memory and manages tasks, accidental activation can lead to unrequested capture, planning behavior, or reminder flows that the user did not intend to invoke.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger "deadline" is also a broad everyday term that may appear in ordinary discussion without intending to activate the skill. Because this skill includes escalation reminders and task management behavior, false activations could create or alter task context unexpectedly.

Vague Triggers

Low
Confidence
78% confidence
Finding
Using "etc." in the trigger description leaves the activation scope underspecified, which can cause inconsistent implementations or overly permissive matching by downstream systems. Ambiguous trigger scope increases the chance of accidental memory capture in a skill designed to save user thoughts immediately.

Static analysis

No suspicious patterns detected.