Security audit

Habit Flow

Security checks across malware telemetry and agentic risk

Overview

HabitFlow is a coherent habit tracker, but its reminder synchronization can turn habit text into shell commands and it creates persistent outbound messaging paths that users should review carefully.

Install only if you are comfortable with a habit tracker storing data under ~/clawd/habit-flow-data and, when enabled, creating clawdbot cron jobs that send reminders or coaching to a chat channel. Do not sync reminders for habit names or reminder messages from untrusted users until the shell command construction is fixed, and review the exact notification destination before enabling reminders or proactive coaching.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (35)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill declares no permissions, yet the documentation clearly indicates access to environment-like capabilities, local files, installation flows, and scheduled job management. This is dangerous because users and host platforms cannot make an informed trust decision when the effective capability surface is broader than declared, increasing the chance of silent data access or side effects.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented behavior goes substantially beyond a simple habit tracker: it can set up cron jobs, perform proactive messaging, write files, and run initialization scripts, while the declared purpose does not prominently disclose these actions. This mismatch is dangerous because users may invoke or install the skill expecting passive tracking, but the skill can create persistent automation and external communications with privacy and integrity consequences.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The documentation contradicts itself about whether cron jobs are created automatically during installation or require manual initialization. This is dangerous because operators may unintentionally deploy persistent scheduled tasks or, conversely, fail to understand when automation becomes active, undermining informed consent and safe operational control.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The guide documents a capability for scheduled, proactive outbound messaging to external channels, which expands the skill from user-invoked habit tracking into autonomous cross-channel delivery. Even if intended as a coaching feature, this broadens the trust boundary and can surprise users by sending content outside the active interaction context, creating privacy and consent risks.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: Automatically delivering to the user's 'last active channel' is risky because channel selection is implicit rather than explicitly confirmed at send time. If the last active channel is shared, sensitive, or unintended, habit-related messages could be disclosed to the wrong audience or platform.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The guidance explicitly tells the agent to use every available notification channel, including desktop notifications, in an isolated reminder-triggered session without requiring user confirmation or channel scoping. This can cause messages to be broadcast more broadly than the user intended, creating privacy leakage and out-of-scope actions relative to a habit-tracking skill.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The script provisions scheduled coaching jobs that proactively send messages and even image-bearing content to the user, which goes beyond simple reminder synchronization. In a habit-tracking skill this may be product-intended, but it still creates unsolicited outbound messaging behavior and persistent automation that can surprise users or be abused if enabled without clear consent.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The example trigger phrase "I want to start tracking meditation" is broad natural language that closely resembles ordinary conversation, so it could cause unintended activation of the HabitFlow skill when the user is merely discussing goals. In an agent ecosystem where skills may take actions or create records, overly generic invocation language increases the chance of accidental state changes and confusion.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The uninstall section includes recursive deletion commands (rm -rf) for both the skill directory and the user data directory, but it does not clearly warn that these commands permanently delete files and history. Users may copy-paste them without understanding the consequence, leading to accidental loss of habit data or deletion of the wrong path if environment assumptions differ.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README advertises WhatsApp reminders and cron-based syncing, which implies outbound messaging and scheduled background actions, but it does not clearly warn users that the skill may transmit reminder content externally or create persistent scheduled jobs. In an agent skill context, hidden or poorly disclosed external notifications can surprise users, leak behavioral metadata, or cause unwanted messages if enabled without informed consent.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The activation phrases are broad, everyday statements such as general wellness or progress comments, without clear boundaries for when the skill should not activate. In context, this can cause over-triggering and unintended logging, habit creation, or reminder setup based on ambiguous user text, especially because the skill also supports persistence and automation.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill description does not prominently warn that it may create scheduled cron jobs and proactively message users through external channels. This is dangerous because proactive outbound communication and persistence mechanisms materially change the privacy and autonomy risk profile, and users may not realize the skill can continue acting after the initial interaction.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The documented auto-activation triggers are broad everyday phrases such as logging activities or asking for reminders, which can easily appear in normal conversation and unintentionally invoke the skill. In an agent environment, this can cause unintended habit creation, logging, reminder changes, or disclosure of personal progress data without a clear, deliberate user action.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The guide includes a one-line `rm -rf ~/clawd/habit-flow-data` reset command with only a brief warning, but it does not clearly emphasize irreversibility, backup requirements, or safe alternatives. Users may copy-paste it during troubleshooting and permanently delete all habit history, reminders, and configuration data.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The documented activation phrases are broad, everyday utterances such as 'I meditated today' and 'show my streaks', which increases the chance the skill will trigger unintentionally in normal conversation. In a cross-channel assistant context (WhatsApp, web UI, Mac app), unintended invocation can cause privacy-sensitive habit data to be surfaced or modified when the user did not explicitly intend to operate the skill.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The guide promotes automatic delivery to the last active channel without a prominent warning that this may expose private coaching or habit data in an unintended chat, workspace, or device context. Because these messages may include behavioral patterns, streaks, risks, and visualizations, accidental disclosure can create meaningful privacy harm.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The installer runs an initialization script that explicitly may create data directories and set up cron jobs, but it provides no disclosure of what changes will be made, no preview, and no user confirmation before modifying system state. Silent or under-disclosed persistence mechanisms like cron are security-relevant because they can create ongoing execution paths, surprise users, and expand the blast radius if the initialization logic is compromised or behaves unexpectedly.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documentation explicitly includes a `--send` mode for proactive coaching messages but does not warn that this action can trigger outbound, user-facing communications and process potentially sensitive habit data. In a habit-tracking context, unexpected notifications can create privacy and trust issues, especially if messages are sent automatically or to the wrong recipient/channel.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The cron sync commands are documented as adding, updating, removing, and auto-fixing scheduled jobs without clearly warning that they make persistent system-level changes. This can lead operators or downstream agents to modify cron unexpectedly, causing unintended recurring execution, message sending, or operational side effects.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The example shows reminder synchronization and WhatsApp delivery as an automatic follow-on action without explicitly warning that data will be sent through an external messaging channel. In a habit-tracking skill, this can cause unintended outbound communications, privacy surprises, or messages sent to a previously active channel the user did not expect.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The natural-language logging example treats a casual user statement as sufficient to persist tracked habit data, but it does not disclose that the statement will be recorded. This creates a consent and transparency issue: users may not realize conversational text is being converted into stored behavioral records.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The persona-switch example modifies the user's persistent configuration directly after a conversational request, without an explicit confirmation that a saved preference is being changed. Persistent state changes without confirmation can surprise users and may be abused if a message is misinterpreted or triggered indirectly.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The bulk logging example writes multiple dated entries to persistent habit history based on parsed natural language, but it does not warn the user that several records will be created. If the parse is wrong or the user did not intend archival updates, this can corrupt progress data and streak calculations across multiple dates.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The reminder update example omits an explicit warning that reminders will go to the user's last active chat channel, which may be external and privacy-sensitive. This can lead to unintended messages being sent to a channel the user did not mean to use, potentially exposing habit or wellness information.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The reminder instructions omit any warning that the system may broadcast through every available channel, so users are not informed that reminder content could appear on multiple devices or platforms. In a habit tracker, reminder content may reveal sensitive health, wellness, or behavioral information, making silent multi-channel delivery a meaningful privacy risk.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/check_cron_jobs.ts:49

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/sync_reminders.ts:59

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/coaching-engine.ts:185