Security audit

Habit Flow

Security checks for vulnerabilities and agentic risk

Overview

HabitFlow is a coherent habit tracker, but its reminder system creates persistent scheduled agent jobs using unsafe shell command strings and user-controlled reminder content.

Install only if you are comfortable reviewing and controlling its cron jobs. Avoid untrusted habit names, reminder messages, recipients, channels, or timezone values until the shell command construction is fixed with argument-array execution and strict validation. Pin dependencies with a lockfile before production use, and audit any scheduled jobs it creates.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/sync_reminders.ts:53
Finding: Shell Command Injection Through Habit and Reminder Data
Content: View full analysis
0) { for (const time of habit.reminderSettings.times) { const [hour, minute] = time.split(':'); const cronExpression = `${minute} ${hour} * * *`; // Build the reminder message with completion check const customMessage = habit.reminderSettings.message; const defaultReminderText = `🎯 Reminder: Time for your ${habit.name}\n\nTarget: ${habit.targetCount} ${habit.targetUnit || 'session'}\n\nQuick log: Reply 'done', 'skipped', or 'missed'`; // Message includes a check to skip if habit already completed today const message = `Before sending the reminder, check if the habit was already completed today: cd "${SKILL_DIR}" && npx tsx scripts/get_stats.ts --habit-id ${habit.id} --period 1 --format json If "completedDays" is 1 (already completed today), just reply NO_REPLY. Othe ...[truncated 3996 chars]
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: scripts/sync_reminders.ts:88
Finding: Persistent Scheduled-Agent Prompt Injection Through Custom Reminder Content
Content: View full analysis
config > default) const deliveryChannel = habit.reminderSettings.channel || 'last'; const deliveryTo = habit.reminderSettings.to || config.phoneNumber; // Build cron command const cronParts = [ 'clawdbot cron add', `--name "${cronName}"`, `--cron "${cronExpression}"`, `--tz "${config.timezone}"`, '--session isolated', `--message "${message.replace(/"/g, '\\"')}"`, '--deliver' ]; // Add delivery target if (deliveryTo) { cronParts.push(`--to "${deliveryTo}"`); } else { cronParts.push(`--channel ${deliveryChannel}`); } const cronCommand = cronParts.join(' '); execSync(cronCommand, { stdio: 'pipe' }); ``` The custom content is accepted directly from command-line input: ```ts .option('--reminder-message ', 'Custom reminder message') .option('--reminder-channel ', 'Delivery channel: last (default), whatsapp, telegram, d ...[truncated 2455 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: package.json:14
Finding: Unpinned Third-Party Dependencies Installed Without a Lockfile
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (344)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: Although the path is fully specified, the use of rm -rf in user-facing docs is still dangerous because users frequently adapt commands and may execute them from the wrong environment. The primary risk is accidental local destruction rather than malicious exploitation.
Content: Scanner excerpt · INSTALL.md (reported line 234)May include surrounding context.
bash
# Remove from workspace rm -rf ~/clawd/skills/habit-flow # Or remove from shared directory rm -rf ~/.clawdbot/skills/habit-flow

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: Although the path is fully specified, the use of rm -rf in user-facing docs is still dangerous because users frequently adapt commands and may execute them from the wrong environment. The primary risk is accidental local destruction rather than malicious exploitation.
Content: Scanner excerpt · INSTALL.md (reported line 234)May include surrounding context.
bash
# Remove from workspace rm -rf ~/clawd/skills/habit-flow # Or remove from shared directory rm -rf ~/.clawdbot/skills/habit-flow

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: This shared-path rm -rf command can remove functionality relied upon by multiple agents and may be executed without the user understanding the scope. The danger comes from destructive semantics and multi-agent impact, not from hidden adversarial behavior.
Content: Scanner excerpt · INSTALL.md (reported line 237)May include surrounding context.
rm -rf ~/clawd/skills/habit-flow

Or remove from shared directory

rm -rf ~/.clawdbot/skills/habit-flow

text
### Keep or Remove Data

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: This shared-path rm -rf command can remove functionality relied upon by multiple agents and may be executed without the user understanding the scope. The danger comes from destructive semantics and multi-agent impact, not from hidden adversarial behavior.
Content: Scanner excerpt · INSTALL.md (reported line 237)May include surrounding context.
rm -rf ~/clawd/skills/habit-flow

Or remove from shared directory

rm -rf ~/.clawdbot/skills/habit-flow

text
### Keep or Remove Data

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: Deleting ~/clawd/habit-flow-data removes all stored habit records and related configuration, causing irreversible data loss if no backup exists. In a habit-tracking skill, that context makes destruction of historical data especially harmful because the stored history is a core user asset.
Content: Scanner excerpt · INSTALL.md (reported line 250)May include surrounding context.
Remove all data (complete removal):

bash
rm -rf ~/clawd/habit-flow-data

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: Deleting ~/clawd/habit-flow-data removes all stored habit records and related configuration, causing irreversible data loss if no backup exists. In a habit-tracking skill, that context makes destruction of historical data especially harmful because the stored history is a core user asset.
Content: Scanner excerpt · INSTALL.md (reported line 250)May include surrounding context.
Remove all data (complete removal):

bash
rm -rf ~/clawd/habit-flow-data

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: This variant highlights a meaningful trust/transparency issue: the declared purpose emphasizes user-facing habit tracking, but the documented behavior also includes cron inspection, job repair, reminder sync, and other operational actions on the host environment. Those admin-like capabilities materially broaden what the skill can do and should be disclosed because they affect system state outside ordinary conversation assistance.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: This variant highlights a meaningful trust/transparency issue: the declared purpose emphasizes user-facing habit tracking, but the documented behavior also includes cron inspection, job repair, reminder sync, and other operational actions on the host environment. Those admin-like capabilities materially broaden what the skill can do and should be disclosed because they affect system state outside ordinary conversation assistance.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This variant highlights a meaningful trust/transparency issue: the declared purpose emphasizes user-facing habit tracking, but the documented behavior also includes cron inspection, job repair, reminder sync, and other operational actions on the host environment. Those admin-like capabilities materially broaden what the skill can do and should be disclosed because they affect system state outside ordinary conversation assistance.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: This variant highlights a meaningful trust/transparency issue: the declared purpose emphasizes user-facing habit tracking, but the documented behavior also includes cron inspection, job repair, reminder sync, and other operational actions on the host environment. Those admin-like capabilities materially broaden what the skill can do and should be disclosed because they affect system state outside ordinary conversation assistance.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: This variant highlights a meaningful trust/transparency issue: the declared purpose emphasizes user-facing habit tracking, but the documented behavior also includes cron inspection, job repair, reminder sync, and other operational actions on the host environment. Those admin-like capabilities materially broaden what the skill can do and should be disclosed because they affect system state outside ordinary conversation assistance.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: This variant highlights a meaningful trust/transparency issue: the declared purpose emphasizes user-facing habit tracking, but the documented behavior also includes cron inspection, job repair, reminder sync, and other operational actions on the host environment. Those admin-like capabilities materially broaden what the skill can do and should be disclosed because they affect system state outside ordinary conversation assistance.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.
md
npx tsx scripts/view_habits.ts --active --format markdown

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 301)May include surrounding context.
md
npx tsx scripts/init_skill.ts

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 329)May include surrounding context.
md
npx tsx scripts/init_skill.ts

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 330)May include surrounding context.
md
npx tsx scripts/init_skill.ts

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 312)May include surrounding context.
md
npx tsx scripts/check_cron_jobs.ts

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 315)May include surrounding context.
md
npx tsx scripts/check_cron_jobs.ts

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: rm -rf ~/clawd/habit-flow-data is a destructive command that permanently deletes all application data. Although it is documented as a reset operation, users may copy-paste it without backups or confirmation, resulting in irreversible loss of habit history and configuration.
Content: Scanner excerpt · docs/DEPLOYMENT.md (reported line 249)May include surrounding context.
Reset Everything

bash
# WARNING: This deletes all data! rm -rf ~/clawd/habit-flow-data # Skill will reinitialize on next use

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: rm -rf ~/clawd/habit-flow-data is a destructive command that permanently deletes all application data. Although it is documented as a reset operation, users may copy-paste it without backups or confirmation, resulting in irreversible loss of habit history and configuration.
Content: Scanner excerpt · docs/DEPLOYMENT.md (reported line 249)May include surrounding context.
Reset Everything

bash
# WARNING: This deletes all data! rm -rf ~/clawd/habit-flow-data # Skill will reinitialize on next use

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · docs/MULTI_USER_BOT_MODE.md (reported line 263)May include surrounding context.
md
- [ ] Add `getUserDataDir()` to storage.ts - [ ] Update all file path constants to use dynamic paths - [ ] Add `HABITFLOW_USER_ID` environment variable support - [ ] Update SKILL.md with user detection logic - [ ] Test single-user mode (backwards compatibility) - [ ] Test multi-user mode (isolated data)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · docs/PROACTIVE_COACHING_ARCHITECTURE.md (reported line 346)May include surrounding context.
npx tsx scripts/check_cron_jobs.ts --auto-fix

Test version tracking

rm ~/clawd/habit-flow-data/.skill-version npx tsx scripts/init_skill.ts # Should treat as first install

text

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The technical notes state that 'All analysis happens locally (privacy-first)', which conveys a local-only privacy posture. However, the same feature section explicitly describes generated coaching messages being delivered through cron jobs and WhatsApp, so the documentation presents a misleading picture of what leaves the local environment.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · INSTALL.md (reported line 15)May include surrounding context.
Or shared installation (for multiple agents):

bash
mkdir -p ~/.clawdbot/skills cd ~/.clawdbot/skills git clone https://github.com/tralves/habit-flow-skill.git habit-flow cd habit-flow

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · INSTALL.md (reported line 154)May include surrounding context.

Verify installation location:
bash
# Check workspace installation ls ~/clawd/skills/habit-flow/SKILL.md # Or check shared installation ls ~/.clawdbot/skills/habit-flow/SKILL.md

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/check_cron_jobs.ts:49

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/sync_reminders.ts:59

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/coaching-engine.ts:185

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T01 · Skill Instruction Hijacking

T08 · Insecure Dependencies

SkillSpector

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Or remove from shared directory

Tool Parameter Abuse

Or remove from shared directory

Tool Parameter Abuse

Tool Parameter Abuse

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Ae1

Ae1

Ae1

Ae1

Ae1

Ae1

Tool Parameter Abuse

Reset Everything

Tool Parameter Abuse

Reset Everything

Self-Modification

Tool Parameter Abuse

Test version tracking

Intent-Code Divergence

Session Persistence

Skill Enumeration

Static analysis

Shell command execution detected (child_process).

Shell command execution detected (child_process).

Shell command execution detected (child_process).