ClawHub
Back to skill

Security audit

Co-Parenting Custody Calendar

Security checks for vulnerabilities and agentic risk

Overview

This skill is an offline custody-calendar calculator whose sensitive outputs are expected for its purpose, with privacy caution needed around exported calendars and logs.

Use this locally and treat generated calendars, names, travel periods, birthdays, and dispute logs as sensitive family records. Avoid syncing or sharing ICS files through cloud calendars or unsecured channels unless necessary, and have any court-facing language reviewed by a qualified family-law attorney.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The README explicitly promotes ICS calendar export and ready-made evidence/log entries for custody arrangements, which inherently involve sensitive family data such as children's schedules, parent identities, travel periods, and dispute history. Although the tool is offline, the documentation does not warn users about privacy risks from sharing, syncing, emailing, or storing these artifacts in third-party calendar systems or court/dispute workflows, making inadvertent disclosure reasonably likely.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.