ClawHub
Back to skill

Security audit

chore-wheel-genius

Security checks across malware telemetry and agentic risk

Overview

This is a local chore-assignment CLI that stores household chore data in one disclosed JSON file and does not show hidden network, credential, destructive, or background behavior.

Before installing, know that this tool creates and updates ~/.chore_wheel.json with household members, ages, skills, assignments, and completion history. Deleting that file resets the tool and removes its history. For children or teens, treat the age-based chore suggestions as rough guidance, not safety approval for cooking, chemicals, tools, yard equipment, repairs, or babysitting.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill documentation describes a CLI tool that reads and writes persistent data (`~/.chore_wheel.json`) but does not declare corresponding permissions. Undeclared file access weakens transparency and consent, making it harder for users or platforms to assess what local resources the skill modifies.

Missing User Warnings

Low
Confidence
81% confidence
Finding
The README states that data is stored in the user's home directory and suggests deletion to reset, but gives no warning that the tool modifies persistent files under `~`. This can surprise users, lead to unintended data loss, and normalizes direct manipulation of home-directory files without safeguards or backup guidance.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The guide assigns and normalizes chores for minors, including potentially hazardous tasks such as cooking, bathroom cleaning, yard work, minor home repairs, and babysitting, but it does not include safety warnings, supervision requirements, or hazard exclusions. In the context of a chore-assignment tool that may operationalize this guidance automatically, omission of these safeguards could lead caregivers to assign unsafe tasks based solely on age bands.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.