ClawHub
Back to skill

Security audit

Health Tracking

Security checks across malware telemetry and agentic risk

Overview

This health tracker is not malicious, but it needs review because it stores sensitive health logs and may post meal details into an unspecified shared channel.

Install only if you are comfortable keeping health records in local CSV files and understand where those files will be stored. Before using the channel/thread workflow, confirm #health is private and that the agent will ask before posting meal or health details. Do not rely on the referenced helper scripts unless you obtain and review their actual code.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
This skill collects and stores highly sensitive health information, including weight, sleep, heart rate, meals, and potentially photo-linked nutrition records, yet provides no warning, consent language, retention guidance, or privacy controls. In a health-tracking context, silent local storage of personal health data increases risk of unauthorized access, accidental disclosure, and noncompliant handling of sensitive data.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill instructs posting health-related meal records into a #health channel thread without warning that channel content may be visible to others. Because the content concerns personal health and dietary data, directing users to shared-channel posting can lead to unintended disclosure of sensitive information to coworkers, community members, or other unauthorized viewers.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal