ClawHub
Back to skill

Security audit

sleep-debt-calculator

Security checks across malware telemetry and agentic risk

Overview

This is a local sleep-tracking command-line skill whose main risk is that it stores personal sleep notes in a plaintext file on the user's machine.

Before installing, treat the sleep log as a local plaintext wellness journal. Avoid putting highly sensitive details in notes on shared or backed-up devices, and delete ~/.sleep_debt.json if you want to reset or remove the stored data.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Low
Confidence
86% confidence
Finding
The README explicitly documents that sleep logs, including free-form notes mentioning caffeine/alcohol and other potentially sensitive health-related details, are stored persistently in a local file under the user's home directory. While this is not an active exploit, the lack of a privacy warning can cause users to unknowingly retain sensitive wellness data in plaintext where it may be exposed to other local users, backups, or shared environments.

Missing User Warnings

Low
Confidence
86% confidence
Finding
The skill stores sleep logs and free-form notes persistently, and the notes may contain sensitive health or lifestyle details such as caffeine/alcohol use and sleep patterns. Even though the data is stored locally, omitting a privacy warning can cause users to record sensitive information without understanding retention or exposure risks, especially on shared systems or backed-up home directories.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The script persistently stores sensitive wellness data, including sleep schedules, notes, and inferred caffeine/alcohol use, in a predictable file under the user's home directory without any warning, consent flow, or file-permission hardening. In the context of a personal health-tracking skill, this raises a real privacy risk because other local users, backup systems, or endpoint tooling may access data the user may reasonably expect to be transient or confidential.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.