ClawHub
Back to skill

Security audit

posture-patrol

Security checks across malware telemetry and agentic risk

Overview

This is a local posture-tracking CLI that saves posture data on your machine and gives ergonomic guidance, with no hidden network or credential behavior found.

Before installing, understand that the tool stores your posture profile, check history, and any notes you type in ~/.posture_patrol.json. Do not enter sensitive medical or workplace information unless you are comfortable storing it locally. Treat the stretch and posture suggestions as general ergonomic information, and consult a clinician for pain, numbness, injury, chronic symptoms, or mobility limitations.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding
The skill documentation describes persistent local data storage in `~/.posture_patrol.json` and stdlib-based command functionality, which implies file read/write behavior without any declared permissions. Undeclared filesystem access weakens transparency and security review because users and hosting platforms cannot accurately assess what resources the skill will touch, even if the intended use here appears limited to the user's home directory for benign tracking data.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
This document gives concrete health and exercise guidance, including posture corrections, injury claims, and stretch instructions, without any safety disclaimer, personalization limits, or advice to stop and seek medical care if symptoms exist. In a consumer posture-tracking skill, users may rely on this as medical or therapeutic guidance, which creates a realistic risk of aggravating pain, nerve symptoms, or underlying musculoskeletal conditions.

Missing User Warnings

Low
Confidence
84% confidence
Finding
The script stores posture notes and profile details persistently in a predictable file under the user's home directory, but gives no explicit notice that free-form notes and profile data will be retained on disk. While this is not code-execution or privilege-escalation risk, it is a real privacy weakness because users may enter sensitive health or workplace information without realizing it will be saved locally.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.