Habitica

• Outcome: Pass
• Latest audit: Jul 10, 2026 · 2:57 AM UTC
• Version: 0.1.3

Overview

This is a disclosed Habitica CLI integration that can read and change your Habitica account, so it is acceptable but should be used deliberately.

Install only if you are comfortable giving an agent a Habitica API token that can read and modify your Habitica account. Keep ~/.habitica private, avoid committing or sharing it, and require explicit confirmation before delete, party-send, quest-accept, cast, cron, or bulk scoring actions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill documents shell-based execution but declares no corresponding permissions or capability boundaries. That mismatch hides the real execution surface from reviewers and users, making it easier for state-changing commands against the user's Habitica account to run without clear authorization expectations.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The manifest frames the skill as a simple task-tracker integration, but the documented behavior extends into profile access, social messaging, quest actions, skill casting, and cron triggering. This description-behavior mismatch can mislead users and orchestrators into invoking a much more privileged skill than intended, increasing the chance of unauthorized account changes or privacy exposure.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest and top-level description suggest a narrow task-management purpose, but the command set exposes broader account, inventory, party, guild, quest, and gameplay functions. This scope inflation is dangerous because users may consent to a task skill without realizing it can inspect or affect unrelated parts of their Habitica account.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill includes write operations unrelated to checking off tasks, such as sending party chat, casting abilities, accepting quests, and forcing cron. These are materially different actions with user-visible consequences, and presenting them inside a task skill increases the risk of accidental or over-broad execution.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The script exposes broad account-management and gameplay capabilities well beyond the manifest's stated task-tracking purpose, including inventory, party, guild, skills, quests, history, and cron operations. This violates least privilege and increases the chance an agent can take unexpected actions on a user's Habitica account that the user did not intend when invoking a habit tracker.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The party-send command allows the skill to transmit arbitrary messages to other users, which is unrelated to habit/task management and creates an outbound communication channel. In an agent setting, this can be abused to spam, socially engineer party members, or relay user/account data externally through in-game chat.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skills/cast functionality can alter gameplay state, spend MP, damage tasks, buff party members, or affect shared party outcomes, none of which is justified by a habit-tracker integration. Because these actions are state-changing and sometimes social, an agent could materially affect the user's account or party without clear authorization.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Quest acceptance and daily cron execution both modify account or party state outside the declared task-management scope. These actions can trigger irreversible gameplay consequences such as joining quests or advancing the in-game day, potentially harming the user or their party if invoked unintentionally.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger terms include common everyday words and phrases like '习惯', '待办', and requests to check off tasks, which can match ordinary conversation too broadly. Over-broad triggers make unintended invocation more likely, potentially causing account reads or writes when the user did not mean to engage the Habitica integration.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documented interface exposes destructive and state-changing operations like create, update, delete, score, party-send, cast, quest-accept, and cron without warning that they modify live Habitica data. Lack of clear warnings and safeguards increases the chance of accidental loss, unwanted social actions, or irreversible account state changes.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Task deletion is destructive and performed immediately with no confirmation, dry-run, or recycle/undo behavior. In an agent workflow, a misparsed task ID or prompt-influenced action could permanently remove user data with little opportunity for recovery.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The quest-accept flow automatically accepts a pending quest as soon as the command is run, without warning the user about the state change or possible party impact. In an agent context, automatic acceptance is risky because the user may have asked only to inspect status, not commit to participation.

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.