ClawHub
Back to skill

Security audit

child-screen-time

Security checks across malware telemetry and agentic risk

Overview

This skill does what it claims, but it persistently stores sensitive child and behavior records with only minimal privacy disclosure and weak user controls.

Review this carefully before installing. It appears local-only and I found no network upload, destructive behavior, or hidden execution, but it records sensitive information about children in a predictable file under the user home directory. Use pseudonyms if possible, protect or periodically delete ~/.screen_time.json, and avoid placing the home directory in shared or synced environments unless that exposure is acceptable.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill documentation describes functionality that reads from and writes to a local file (`~/.screen_time.json`) while declaring no permissions. That mismatch is a real security and transparency issue because users and hosting platforms may not realize the skill persists data, including sensitive household and child behavior records, to disk.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill stores identifying and behavioral data about children on disk but does not clearly warn users about this persistence. Because the stored data includes names, ages, usage history, rewards, deductions, and compliance-related behavior, local disclosure or unintended sharing could expose sensitive child profile information.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The script persistently stores sensitive child-related data, including names, ages, activity logs, behavior/compliance indicators, and inferred discipline history, in a predictable file under the user's home directory. This creates a privacy and confidentiality risk because the data is retained without user notice, minimization, access controls, or secure file permissions, making it easier for other local users, backups, or synced services to expose the information.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.