ClawHub
Back to skill

Security audit

MindLogger

Security checks for vulnerabilities and agentic risk

Overview

MindLog has a coherent journaling purpose, but it asks for credentials through Telegram and installs recurring automation without clear security controls or removal steps.

Install only if you are comfortable giving this skill ongoing access to your MindLog API key, Telegram bot token, Telegram chat ID, journal entries, and weekly reports. Before use, require a secure secret-entry/storage method, explicit opt-in for Telegram delivery and weekly analysis, and a documented way to disable scheduled jobs and delete or rotate stored credentials.

A.I.G

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T06 · System Persistence

Error
Location
SKILL.md:68
Finding

Recurring Cron Jobs Establish Cross-Session Persistence

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:13
Finding

Sensitive Credentials Are Collected Through Chat and Stored in Unspecified Configuration

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (11)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill instructs users to send highly sensitive credentials, including a Telegram bot token and API key, over Telegram without any security warning or safer onboarding channel. If the chat, bot, logs, or intermediating systems are compromised, these secrets can be reused to impersonate the bot, access external services, and exfiltrate user data.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

Line L005 explicitly frames MindLog as only storing and returning entries, with all analysis outside its scope. However, the later skill definition includes weekly entry analysis and report generation (L180-L183, L201-L252), which directly contradicts that stated characterization of the skill's behavior.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
94% confidence
Finding

The skill is instructed to autonomously contact the user and request sensitive credentials immediately upon registration, without waiting for approval. Autonomous secret solicitation increases the risk of surprise credential harvesting behavior, user confusion, and accidental disclosure to an untrusted or misconfigured skill.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md
## Onboarding

When this skill is first registered, immediately and automatically send the following message to the user via Telegram — do not wait to be asked, do not confirm registration first, just send it:

1. Send: "To set up MindLog I need three things — reply with them one per line:
   1. MindLog API key (from mindlogger.app)

Ssd 3

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The onboarding flow automatically solicits and stores multiple secrets immediately upon registration without prior confirmation or a trust-establishing step. This increases the chance of accidental disclosure, social-engineering-style credential harvesting, and unsafe storage of credentials before the user has explicitly approved the integration.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

  1. Send a test Telegram message:
    text
    POST https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage
{ "chat_id": "${TELEGRAM_CHAT_ID}", "text": "MindLog test: Setup complete." }
    • If fails: "Telegram send failed. Check your bot token is correct and the bot has been started."

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.

  1. Send a test Telegram message:
    text
    POST https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage
{ "chat_id": "${TELEGRAM_CHAT_ID}", "text": "MindLog test: Setup complete." }
    • If fails: "Telegram send failed. Check your bot token is correct and the bot has been started."

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 162)May include surrounding context.

  1. Send a test Telegram message:
    text
    POST https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage
{ "chat_id": "${TELEGRAM_CHAT_ID}", "text": "MindLog test: Setup complete." }
    • If fails: "Telegram send failed. Check your bot token is correct and the bot has been started."

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill sends personal journal entries to external services for storage, analysis, and Telegram delivery, but does not clearly disclose that sensitive personal content will leave the local agent context and be processed by third parties. This undermines informed consent and increases privacy risk if users believe their entries remain local or are not analyzed externally.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The weekly report workflow forwards the full week's journal entries into an analysis step and then delivers a synthesized report through Telegram, creating broad secondary use of sensitive personal data. Even if intended functionality, this materially increases exposure because intimate content is processed and retransmitted beyond the original storage context.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

This transmission delivers potentially sensitive psychological pattern reports over Telegram, an external messaging platform, without explicit privacy warning or consent language nearby. Even if Telegram is the chosen channel, sending intimate analysis results to a third-party service increases confidentiality risk if accounts, chats, or bot access are compromised.

Content

Scanner excerpt · SKILL.md (reported line 246)May include surrounding context.

HTTP Call 2 — Deliver report via Telegram:

text
POST https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage

{
  "chat_id": "${TELEGRAM_CHAT_ID}",

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

The summary at L272 describes retrieving the daily prompt with a GET, while the concrete API specification for that action uses POST ${MINDLOG_BASE_URL}/api/prompt/trigger at L109-L113. This is an active documentation contradiction that could mislead implementers about the intended behavior.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn
Code
suspicious.prompt_injection_instructions
Location
SKILL.md:201