ClawHub
Back to skill

Security audit

Bucket List

Security checks across malware telemetry and agentic risk

Overview

This is a local bucket-list tool with an optional life-progress widget; the main privacy concern is local persistence, not hidden or malicious behavior.

Install only if you are comfortable storing personal bucket-list entries in a local workspace file. If you use the life-progress widget, your birth year and life expectancy are kept in this browser profile. Avoid putting secrets in wishes, review JSON before importing it, and be deliberate when linking a file because future saves can write the current list to that selected file.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The skill adds a separate 'life progress' feature that collects birth year and life expectancy, which is unrelated to bucket-list management described in the skill metadata. This expands data collection into sensitive profile information and increases privacy risk because the values are stored persistently and could be exposed through local access, exports, or future feature reuse.

Description-Behavior Mismatch

Medium
Confidence
97% confidence
Finding
The code stores birth year, life expectancy, and UI state in localStorage without that extra personal data being described in the manifest. Persistent browser storage makes the data available to anyone with access to the same browser profile and broadens the skill's data footprint beyond user expectations.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The UI handles personal bucket-list content and also optional life-profile data, then allows file export/import and file linking without any user-facing privacy warning. Users may unknowingly persist or transfer sensitive aspirations and profile data to local files that can be read by other local users, backups, or synced folders.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.