ClawHub
Back to skill

Security audit

Timeblock

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed local time-block logging tool, with privacy and quality caveats but no evidence of hidden exfiltration, destructive behavior, or privilege abuse.

Install only if you want a local plaintext record keeper for time-block entries. Do not enter highly sensitive meeting details unless you are comfortable with them being stored under ~/.local/share/timeblock and potentially included in exports; check local file permissions on shared systems.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Note
Location
scripts/script.sh:6
Finding

Schedule Data Is Stored Without Enforced Restrictive Permissions

Content
View full analysis

Vulnerability Details

File Location: scripts/script.sh:6-7
Vulnerability Type: Insecure local data permissions
Risk Level: Low

bash
DATA_DIR="${HOME}/.local/share/timeblock"
mkdir -p "$DATA_DIR"

Technical Analysis

The script creates its data directory without establishing a restrictive process umask or explicitly setting directory permissions. Subsequent command handlers append schedule information to files under this directory, and _log appends the same input to history.log.

Consequently, the effective permissions depend entirely on the environment from which the script is launched. Under a commonly used 022 umask, a newly created directory may be mode 0755 and newly created log files may be mode 0644. On a multi-user system where home-directory traversal is permitted, other local users could therefore read time-block descriptions, project names, meeting details, productivity records, or other personal information entered through the tool.

This issue does not grant elevated privileges and does not expose data over the network. Exploitation requires a second local account with sufficient permission to traverse the user's home-directory path.

Attack Path

  1. A user launches Timeblock in an environment with a permissive umask, such as 022.
  2. The script creates ~/.local/share/timeblock/ without explicitly restricting its permissions.
  3. The user records schedule or activity information, causing log files to be created with permissions inherited from the permissive umask.
  4. Another local account traverses the accessible home-directory path and reads files such as run.log, history.log, or report.log.
  5. The local account obtains schedule and productivity information that the Timeblock user may have expected to remain private.

Impact Assessment

The maximum demonstrated impact is confidentiality loss for locally stored Timeblock records belonging to the affected user ...[truncated 290 chars]

Remediation
View remediation

Remediation Suggestions

Establish restrictive permissions before creating or writing any data:

bash
umask 077
DATA_DIR="${HOME}/.local/share/timeblock"
mkdir -p -m 700 "$DATA_DIR"
chmod 700 "$DATA_DIR"

Create log and export files with mode 0600, and securely repair permissions on existing storage:

bash
find "$DATA_DIR" -type f -exec chmod 600 {} +

The script should also verify that DATA_DIR is owned by the current user and is not a symbolic link before writing sensitive records. Documentation should explicitly state that entries are stored as plaintext and may contain personal schedule information.

T09 · Insecure Skill Coding Practices

Note
Location
scripts/script.sh:105
Finding

Search Input Can Be Interpreted as grep Command-Line Options

Content
View full analysis

Vulnerability Details

File Location: scripts/script.sh:105-116
Vulnerability Type: Argument and option injection
Risk Level: Low

bash
_search() {
    local term="${1:?Usage: timeblock search <term>}"
    echo "Searching for: $term"
    for f in "$DATA_DIR"/*.log; do
        [ -f "$f" ] || continue
        local m=$(grep -i "$term" "$f" 2>/dev/null || true)
        if [ -n "$m" ]; then
            echo "  --- $(basename "$f" .log) ---"
            echo "$m" | sed 's/^/    /'
        fi
    done
}

Technical Analysis

Although the search term is shell-quoted, quoting only prevents shell word splitting and shell metacharacter interpretation. It does not stop grep from interpreting an argument beginning with - as an option.

An attacker-controlled search term can therefore alter grep behavior by supplying supported options instead of a literal search pattern. Depending on the installed grep implementation, this can cause misleading results, process additional pattern files, emit extensive option output, wait for standard input, or consume excessive resources. The || true expression suppresses failures, making abnormal behavior less visible.

No shell-command execution is possible through this statement because the value is passed as one quoted argument and is not evaluated by a shell. The finding is limited to option injection into grep.

Attack Path

  1. An agent, wrapper, or user invokes timeblock search with an untrusted term beginning with a hyphen.
  2. _search passes that value directly after grep -i without an end-of-options delimiter.
  3. grep treats the supplied term as one or more command-line options rather than as the intended search expression.
  4. The attacker changes search behavior, causes unexpected output, or triggers availability degradation using options supported by the local grep implementation.
  5. Because standard error is discarded ...[truncated 572 chars]
Remediation
View remediation

Remediation Suggestions

Insert the standard end-of-options delimiter before the untrusted search term:

bash
local m
m=$(grep -i -- "$term" "$f" 2>/dev/null || true)

If the documented behavior is intended to be a literal keyword search rather than regular-expression matching, also enable fixed-string mode:

bash
m=$(grep -Fi -- "$term" "$f" 2>/dev/null || true)

Consider validating maximum input length to reduce resource-exhaustion risk. Avoid discarding all diagnostics; distinguish a normal “no match” exit from operational errors so malformed requests and filesystem problems remain visible.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The description promises a focused time-block planning skill, but the code is essentially a generic CLI logger/record keeper. Each main command just appends timestamped free-form input to a corresponding .log file and records activity in history.log. The helper functions provide statistics, search, recent activity, and export of these stored logs. There is no logic for constructing hour-by-hour plans, allocating sessions, validating schedules, analyzing calendar structure, or generating agendas beyond merely saving arbitrary text under labels like 'analyze' or 'generate'. The code also accesses local persistent storage in the user's home directory, which is undeclared. Overall, the actual behavior is materially different from the declared purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The advertised skill purpose is hour-by-hour time-block planning, but the script exposes a broad generic logging interface instead. This mismatch is dangerous because users may provide scheduling or other sensitive content under false expectations, while the tool silently persists arbitrary inputs and offers unrelated capabilities that enlarge the attack surface.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The description says to use the skill when 'checking plans, analyzing allocation, generating agendas,' which are broad natural-language triggers rather than narrowly scoped invocation phrases. Without explicit constraints or negative examples, these terms could collide with ordinary productivity requests and cause unintended activation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

Branding and inline documentation present the tool as a time-block planner, but the implementation does not provide that behavior. This is a security-relevant deception issue because it can cause users or calling agents to trust and route data to a tool whose real function is generic input collection and storage.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The presence of broad utility-style commands such as config, batch, compare, convert, and report is not justified by the stated skill scope. Excess capability increases the chance of misuse, covert data collection, or later extension into more harmful behavior, especially in an agent skill that users may trust based on its description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The export routine aggregates all logged history into JSON, CSV, or TXT files without warning that sensitive entries will be recopied into a consolidated artifact. This raises exposure risk by creating additional plaintext copies that are easier to share, back up, or inspect accidentally, compounding the privacy issue from the original silent logging.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

User-supplied input is appended to persistent log files in the user's home directory without clear consent, warning, retention limits, or sensitivity guidance. In the context of a planning skill, users may enter schedules, meetings, personal routines, or other sensitive information that is then stored locally and could be exposed to other local users, backups, or later exports.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.