ClawHub
Back to skill

Security audit

elder-care-coordinator

Security checks for vulnerabilities and agentic risk

Overview

This is an offline elder-care coordination skill that stores sensitive care information locally, with privacy risks that are disclosed but not technically protected.

Install only if you are comfortable keeping elder-care details in an unencrypted local JSON file. Store the state file in a private directory, avoid public or loosely shared sync folders, and verify CLI behavior before relying on generated emergency cards or visit briefs.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Memory Manipulation

High
Category
Memory Poisoning
Confidence
85% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

md
## Common Pitfalls

1. **The group chat as the source of truth.** Chats are where commitments go to die: no owner, no due date, buried in 40 messages about grandkids. Every commitment in chat that matters gets one line here (`task add`), even if it feels bureaucratic.
2. **Rotation without a backup rule.** "We take turns calling" fails the first week someone travels. Every rotation entry needs a swap rule (notify the group + find replacement OR the task defaults to the next person — pick one, state it).
3. **Recording sensitive data in a shared cloud doc.** Health details leak through shared links and abandoned accounts. This skill keeps data in one local file the family controls; if you sync it (family git repo, encrypted share), say so explicitly in the family and note who has access.
4. **The emergency card that's out of date.** A card generated once and photocopied five times is worse than none — new med added in March, card in wallets still shows April's list. Regenerate quarterly and on every med change; the footer shows the generation date.
5. **One person becoming the invisible coordinator.** The default failure of family care: one sibling does everything, burns out, resents. The `meeting` output shows task-load per person — use it to rebalance before the resentment, not after.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill explicitly instructs use of a local state file (care_state.json) and generates printable outputs, which implies file read/write capability, but it does not declare any permissions or allowed-tools scope. In an agent environment, undeclared filesystem access weakens least-privilege guarantees and can lead to overbroad file access beyond the intended care notebook.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The script stores sensitive personal, medical, contact, insurance, and key-location data in a plaintext JSON file on disk with no permission hardening, encryption, or prominent warning. In the elder-care context this data is especially sensitive, so compromise of the local machine, shared account, backups, or accidental file exposure could leak highly private information and create physical and social-engineering risk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The module documentation presents the tool's supported surface area and intent, but it is inconsistent with the actual CLI and state behavior. The code implements a separate 'question' workflow used by visit briefs and reports, while cmd_profile also ignores documented profile inputs like name, dob, and address despite emergency-card later depending on them.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Confidence
50% confidence
Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/elder_care.py (reported line 63)May include surrounding context.

python
("pharmacy", "pharmacy"), ("insurance", "insurance"),
                     ("keys", "key_locations"), ("hospital", "preferred_hospital"),
                     ("baseline", "baseline_function")]:
        v = getattr(a, opt)
        if v:
            st["profile"][key] = v
            changes.append(f"{key}={v}")

Static analysis

No suspicious patterns detected.