ClawHub
Back to skill

Security audit

Timer Alert Tool Free

Security checks across malware telemetry and agentic risk

Overview

The skill is mainly a local timer/reminder helper, but its activation scope is confused and overbroad while it asks for command execution and background process control.

Install only if you want an agent to run local background timer commands, and use it for explicit timer/reminder requests. Review the package because its trigger text includes unrelated content-writing use cases and the timer script referenced by the instructions was not present in the inspected artifact.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Intent-Code Divergence

Medium
Confidence
94% confidence
Finding
The capability coverage text mixes unrelated triggers such as marketing copy, title optimization, and content creation into a timer/reminder skill. This broad, internally inconsistent trigger scope can cause the agent to invoke the skill in contexts unrelated to timing, increasing the chance of unintended exec-based actions and confusing tool routing.

Vague Triggers

High
Confidence
97% confidence
Finding
The skill advertises an overly broad and contradictory activation scope, including non-timer scenarios, while also being allowed to use exec. In an agent ecosystem, this can lead to accidental invocation in unrelated conversations and execution of background commands without a clear user need, expanding the attack surface and creating opportunities for misuse.

Missing User Warnings

Medium
Confidence
83% confidence
Finding
The documentation includes a kill operation for running timers but does not clearly warn that it destructively cancels active reminders and may cause the user to miss important events. In an agent setting, destructive process-management instructions without an explicit confirmation or warning increase the risk of accidental interruption of legitimate tasks.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.