ClawHub
Back to skill

Security audit

expiry-tracker

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward local food-expiry tracker that stores user-entered grocery data on the device and does not show hidden network, credential, or background behavior.

Before installing, know that grocery inventory and waste history are stored locally in ~/.expiry_tracker.json. This is not high-risk data for most users, but on shared or managed computers you may want to inspect or delete that file when finished.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Low
Confidence
73% confidence
Finding
The skill stores household inventory data persistently in a dotfile under the user's home directory but does not present this as an explicit privacy/storage warning to the user. While the data appears low sensitivity, silent persistence can surprise users, leave stale personal consumption data on disk, and create privacy issues on shared systems or managed environments.

VirusTotal

58/58 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.