ClawHub
Back to skill

Security audit

Nutrition tracking

Security checks for vulnerabilities and agentic risk

Overview

This nutrition-tracking skill is purpose-aligned, but it handles sensitive health data and account credentials with enough under-scoped behavior that users should review it carefully before installing.

Install only if you are comfortable sending nutrition, weight, profile, images, and coaching chat data to Haver. Verify the API origin is locked to the real Haver service, avoid exposing the hv_ API key in ordinary memory or logs, and review food or profile changes because some entries may be stored without an undo path.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:12
Finding

Unvalidated API Origin Can Receive Bearer Credentials and Sensitive Health Data

Content
View full analysis
" } ``` From `api-reference.md:3-10`: ```markdown Full request/response documentation for all Haver API endpoints. All authenticated endpoints require `Authorization: Bearer hv_...` header. ## Registration ```http POST {HAVER_API_URL}/api/register Content-Type: application/json { "provider": "openclaw", "externalId": "" } ``` ``` ### Technical Analysis The Skill obtains its API origin from the `HAVER_API_URL` environment variable but does not require that the resulting origin be `https://haver.dev`, enforce HTTPS, or define redirect restrictions. Authenticated requests attach a reusable bearer credential to requests made through this configured origin. The API processes sensitive personal and health information, including food records, photographs, weight, height, age, sex, activity level, nutrition goals, and coaching conversations. If the environment variable is changed through deployment misconfiguration or attacker access to runtime configuration, the Agent may send both the bearer credential and sensitive user data to an unintended server. The same weakness also affects response integrity. A substituted server can return fabricated ...[truncated 1468 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:43
Finding

Bearer API Key Is Instructed to Be Stored in Persistent Agent Memory

Content
View full analysis
Remediation
View remediation

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:127
Finding

Untrusted API Response Strings Are Relayed Directly to Users

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Natural-Language Policy Violations

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill directs the agent to set the user's language automatically based on platform-provided information and explicitly forbids asking the user. This removes user choice and transparency around use of inferred/profile data, and can lead to silent preference manipulation or incorrect data submission without user awareness.

Content

No source excerpt is available for this finding.

Context Leakage

High
Category
Data Exfiltration
Confidence
84% confidence
Finding

The instruction to collect profile details conversationally increases the chance that sensitive health and demographic information will be gathered in free-form chat and then forwarded to backend services. In this health-oriented skill, such data can reveal intimate personal attributes, so insufficient scoping, notice, or safeguards raises the risk of context leakage and over-collection.

Content

Scanner excerpt · onboarding.md (reported line 44)May include surrounding context.

Step 3: Physical Profile

Collect conversationally -- sex, age, height, weight, activity level.

http
POST {HAVER_API_URL}/api/me/onboarding/profile

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest advertises broad trigger terms such as 'food', 'weight', 'diet', 'meal', and 'coaching', which can match common everyday requests outside a narrowly scoped nutrition-tracking intent. This increases the chance the skill is invoked unexpectedly and then begins collecting or acting on sensitive health-related data in contexts where the user did not clearly intend to engage this service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The onboarding instructions say to set language automatically based on platform knowledge and explicitly not ask the user. That removes user choice over a profile setting and relies on cross-context inference about the user, which can cause incorrect configuration and privacy concerns, especially in a health-related skill processing sensitive data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The endpoint documentation instructs clients to transmit food logs and optional food images, which are health-related and potentially highly sensitive personal data, but it provides no warning about remote processing, storage, retention, or privacy implications. In a nutrition and health-tracking skill, users may disclose medical, dietary, and lifestyle information they would not expect to be sent to a third-party AI service without explicit notice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The chat endpoint accepts free-form text and optional images for AI coaching, and the metadata indicates the chat may trigger side effects such as logging food from conversation content. That combination creates a meaningful privacy and integrity risk because users may unknowingly send sensitive health information and cause state-changing actions without a clear warning that their data is remotely processed and may alter their account records.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

The directive 'Don't prompt the user' explicitly suppresses user involvement in a decision that writes to their profile. In the context of a health and nutrition assistant handling personal data, suppressing confirmation makes the overall onboarding process less transparent and increases the chance of unnoticed incorrect or undesired settings.

Content

Scanner excerpt · onboarding.md (reported line 28)May include surrounding context.

md
ISO 639-1 codes. Common: `"en"` (English), `"uk"` (Ukrainian).

**You already know the user's language** -- OpenClaw provides it. Set this automatically without asking. Don't prompt the user for language selection.

## Step 2: Timezone

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

The directive 'Don't prompt the user' explicitly suppresses user involvement in a decision that writes to their profile. In the context of a health and nutrition assistant handling personal data, suppressing confirmation makes the overall onboarding process less transparent and increases the chance of unnoticed incorrect or undesired settings.

Content

Scanner excerpt · onboarding.md (reported line 28)May include surrounding context.

md
ISO 639-1 codes. Common: `"en"` (English), `"uk"` (Ukrainian).

**You already know the user's language** -- OpenClaw provides it. Set this automatically without asking. Don't prompt the user for language selection.

## Step 2: Timezone

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The onboarding flow instructs the agent to collect and transmit sensitive health-related profile data, including sex, age, height, weight, activity level, and later weight goals, without any requirement to disclose privacy handling, obtain explicit consent, or minimize collection. In a nutrition and health-tracking context, this is materially sensitive personal data, so silent collection and API submission increase privacy and compliance risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.