ClawHub
Back to skill

Security audit

symptom-timeline

Security checks across malware telemetry and agentic risk

Overview

This is a local symptom tracker that stores and exports user-entered health notes, with no evidence of network, credential, or hidden behavior.

Before installing, understand that symptom names, notes, triggers, medication mentions, and exported reports are saved locally and may contain private medical information. Store the database and reports in a protected location, review reports before sharing them, and delete exports you no longer need.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
This markdown file explains that symptom entries are stored in a local JSON database, which is health-related personal data, but it provides no user-facing warning about the sensitivity or privacy implications of storing and exporting that information. Because the skill handles potentially sensitive medical information, the documentation should disclose this behavior clearly.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
This markdown file tells users to generate an exported report and later hand over a printed copy containing symptoms and medications. Because this is sensitive medical data, the skill description should warn users that the export creates a local file and that printed/shared copies may expose private health information.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
This code persists symptom entries, including notes, timestamps, and possible medication information, to a JSON file on disk. Although the file's purpose is tracking symptoms, there is no visible warning in the code's user-facing output that personal health data will be stored locally.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The export command writes a doctor report containing symptom history, notes, and medications to an arbitrary output file. While it prints success after writing, it does not warn the user beforehand that sensitive health information will be saved to disk at the specified location.

Scope Creep

Low
Category
Excessive Agency
Content
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
Confidence
70% confidence
Finding
NOT LIMITED TO

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.