ClawHub
Back to skill

Security audit

reading-habit-tracker

Security checks across malware telemetry and agentic risk

Overview

This skill is a local reading tracker that stores reading goals, sessions, and book lists on the user's machine with no evidence of hidden network access, credential use, or automatic installation behavior.

Install only if you are comfortable storing reading goals, book titles, notes, page counts, and session history locally in ~/.bookshelf-plus/habit_tracker/. Treat the cron reminder as opt-in, and use the remove/delete commands carefully because some deletions do not ask for confirmation.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill clearly instructs use of scripts that read and write persistent files under the user's home directory, but it does not declare those capabilities/permissions. That creates a transparency and consent gap: an agent or reviewer may treat the skill as lower risk than it is, even though it persists behavioral data to disk.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger keywords are very broad and common, increasing the chance the skill activates on loosely related conversations about books, goals, or progress. Unintended activation is risky here because the skill can store user data and may later drive automated reminders, causing privacy-impacting actions without clear user intent.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill stores detailed reading-history data on disk and recommends a cron-based automated reminder flow, but the description does not clearly warn users about local persistence and scheduled autonomous actions. This can lead to users disclosing habits or preferences without realizing they will be retained and used for ongoing reminders.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The remove operation deletes all books whose titles contain the provided fragment, then immediately persists the change with no confirmation, preview, or requirement for an exact match. This creates a real integrity risk: a broad or mistyped fragment can unintentionally delete multiple entries, and in an agent/tooling context a higher-level caller could trigger destructive changes more easily than a careful interactive user would expect.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.