ClawHub
Back to skill

Security audit

HabitTracker Conversational Habit Tracking

Security checks for vulnerabilities and agentic risk

Overview

This is a local habit-tracking skill with disclosed local storage and no evidence of hidden network access, exfiltration, or destructive behavior, though it has a real coding bug and overstates some features.

Install only if you are comfortable with habit data being stored locally in a JSON file. Avoid exposing this library directly to untrusted inputs until the date-key validation bug is fixed, and do not rely on advertised reminder or trend-analysis features unless separately implemented.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
src/habit-tracker.js:15
Finding

Prototype Pollution Through an Unvalidated Date Key

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Tp4

High
Category
MCP Tool Poisoning
Confidence
83% confidence
Finding

The core purpose mostly aligns: the code tracks habits, computes streaks, provides a weekly report, and supports a daily check-in summary. However, the description also claims reminders and agent conversation/accountability behavior, which are not present in the supplied code. Additionally, the code reads and writes a local JSON data file via fs, which is an undeclared resource access under the provided permissions list. This is a meaningful description/behavior mismatch, though not a completely different primary purpose.

Content

No source excerpt is available for this finding.

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · README.md (reported line 62)May include surrounding context.

md
**USE AT YOUR OWN RISK.**

- The author(s) are NOT liable for any damages, losses, or consequences arising from 
  the use or misuse of this software — including but not limited to financial loss, 
  data loss, security breaches, business interruption, or any indirect/consequential damages.
- This software does NOT constitute financial, legal, trading, or professional advice.
- Users are solely responsible for evaluating whether this software is suitable for

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

md
**USE AT YOUR OWN RISK.**

- The author(s) are NOT liable for any damages, losses, or consequences arising from 
  the use or misuse of this software — including but not limited to financial loss, 
  data loss, security breaches, business interruption, or any indirect/consequential damages.
- This software does NOT constitute financial, legal, trading, or professional advice.
- Users are solely responsible for evaluating whether this software is suitable for

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The skill writes habit data to a local JSON file via fs.writeFileSync, but the code provides no confirmation prompt, logging, print statement, or explanatory comment/docstring disclosing that persistent local storage occurs. For a code file, this is a safety-relevant file write that lacks visible user disclosure in the file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.