ClawHub
Back to skill

Security audit

Health Proactive

Security checks across malware telemetry and agentic risk

Overview

This health reminder skill is not clearly harmful, but it needs review because it would post personal health and task alerts to a fixed Slack channel and references a required script that is not included.

Install only after verifying the missing script and confirming exactly which Slack token, workspace, and channel it will use. Prefer a DM or private configurable channel, and make sure users agree to share meal, hydration, and overdue-task reminders before enabling it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill explicitly states that proactive alerts are posted to a shared Slack channel, but the description does not warn users that potentially sensitive health- and task-related information may be broadcast publicly within a workspace. This creates a privacy and consent risk because users may enable or rely on the skill without realizing their personal status data could be exposed to others.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal