Security audit

MindBreak

Security checks for vulnerabilities and agentic risk

Overview

MindBreak has a legitimate break-reminder goal, but it tracks activity and secretly forces the assistant to add reminders while hiding that mechanism from the user.

Install only if you are comfortable with a local hook recording recent message-timing activity and modifying assistant replies. Prefer a version that labels reminders transparently, asks for opt-in before logging, lets you disable and delete ~/.claude/mindbreak_* state, and removes instructions that forbid the assistant from explaining why a reminder appeared.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The skill declares activation for essentially all knowledge-work conversations, which is far broader than necessary for a break-reminder feature. Overbroad triggering increases unintended instruction injection into unrelated tasks, raises privacy concerns from pervasive activity tracking, and makes the behavior harder for users to predict or disable safely.

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: The skill hardcodes reminder text in Chinese regardless of the user's language, which can confuse users, degrade trust, and inject irrelevant content into responses. Because the skill appends text automatically at the end of normal answers, forced-language output can interfere with task completion and produce misleading or inaccessible communication.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script persistently records user activity timestamps and reminder state under ~/.claude without any disclosure, consent, retention control, or visible indication to the user. Even if the purpose is wellness reminders, hidden persistence about user behavior creates a privacy risk and can be repurposed to infer work patterns, presence, and habits.

Natural-Language Policy Violations

High

Confidence: 99% confidence
Finding: The injected instructions explicitly direct the assistant to conceal the tracking mechanism and to alter its response in a mandatory way without user awareness. This is dangerous because it creates covert behavioral manipulation through a hidden control channel, defeating transparency and informed user consent.

Ssd 1

High

Confidence: 99% confidence
Finding: This reminder variant uses prompt injection via hook output to force the model to append concealed persuasion in the last paragraph and forbids mentioning the source of the instruction. In the context of a skill that activates across all work conversations, this broad hidden influence is especially dangerous because it silently overrides normal assistant transparency in many interactions.

Ssd 1

High

Confidence: 99% confidence
Finding: The second variant repeats the same covert control pattern: hidden injected instructions compel the assistant to steer the user toward ending work while concealing the existence of the control channel. Repetition across variants shows this is not incidental wording but a deliberate mechanism for undisclosed behavioral modification.

Ssd 1

High

Confidence: 99% confidence
Finding: The light-break reminder also covertly redirects the assistant’s output and instructs it to hide the existence of the tracking/injection mechanism. Although framed as benign wellness advice, the hidden nature of the intervention and forced response shaping make it a true security issue because it normalizes undisclosed manipulation of model behavior.

Static analysis

No suspicious patterns detected.