Security audit

Period Care Assistant

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-aligned overall, but it handles sensitive menstrual-health data and can place reminder details into scheduler, chat, or webhook paths in plaintext, so users should review the privacy implications before installing.

Install only if users explicitly consent to local encrypted menstrual tracking and to any reminder delivery channel. Avoid webhook delivery unless destinations are administrator-approved, prefer neutral reminder wording, restrict access to OpenClaw config/state/scheduler logs, and treat cron payloads and chat notifications as sensitive health data.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/period_tracker.mjs:543
Finding: Unvalidated Webhook Destination Can Enable Sensitive-Data Disclosure and Downstream SSRF
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/period_tracker.mjs:716
Finding: Sensitive Menstrual Information Is Embedded in Plaintext Cron Payloads
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The example cron payload sends a menstrual prediction and reminder text over a messaging channel tied to a specific user identifier, but the documentation does not warn about consent, channel confidentiality, notification visibility on shared devices, or minimizing sensitive content in messages. Because this skill concerns intimate health information, outbound reminders can disclose protected personal data to unintended viewers through lock-screen previews, compromised chat accounts, or misrouted messages.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill declares access to an environment variable (PERIOD_TRACKER_KEY) via metadata but does not declare an explicit tool scope such as permissions or allowed-tools. This creates an authorization gap: a runtime may expose secrets or code execution capabilities more broadly than reviewers expect, which is especially sensitive here because the skill handles private menstrual health data and encryption material.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The deployment guide handles highly sensitive reproductive-health data and documents secret/key placement plus the encrypted store location, but it does not include any privacy guidance, access-control expectations, retention limits, or operational warnings about who can read the config and state files. In this skill context, the data is especially sensitive because it links menstrual history to identifiable users, so missing privacy safeguards increases the chance of accidental exposure or unsafe deployment.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The sample payload hard-codes Chinese reminder text without stating that the user chose that language or consented to the exact wording, which can lead to privacy, usability, and consent problems. In this context, language choice matters because a conspicuous or unexpected message about menstruation may reveal sensitive health information to others who see the notification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This code persists highly sensitive menstrual health records and reminder configuration to a local file, but there is no confirmation prompt, user-facing log message, or explanatory comment/docstring warning that this data will be stored on disk. For a health-related tracker, local persistence is a privacy-impacting operation that should be explicitly disclosed to the user.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The reminder text and multiple user-visible status messages are hard-coded in Chinese, with no language selection or opt-in mechanism. This imposes a specific language on all users and matches the policy's language/locale violation pattern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The script reads PERIOD_TRACKER_KEY from the environment to decrypt and encrypt the user's store, but there is no visible disclosure in the code output or inline documentation that the skill depends on a sensitive environment variable. Accessing credential-like environment data falls under the warning requirement when no user-facing notice is present.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The test requires result.currentPhase.label to equal the Chinese string 卵泡期, which implies the skill output is fixed to a specific language. This is a natural-language locale policy concern because the file does not indicate user opt-in or language selection.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.