ClawHub
Back to skill

Security audit

Simple Todo Manager

Security checks for vulnerabilities and agentic risk

Overview

This skill is a simple local todo manager; it edits a configured markdown todo file and has no hidden network, credential, or privileged behavior.

Install this only if you want your agent to create and edit a todo markdown file in your workspace. Review the todo_file path before use, and set auto_archive_days to 0 if you want completed tasks kept indefinitely.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Low
Confidence
90% confidence
Finding
The README describes a skill that manages a markdown todo file but does not clearly warn users that it will write to and modify workspace files. Because users may install it expecting a read-only assistant feature, this can lead to unintended data modification or loss, especially when automatic cleanup is enabled.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The README mentions automatic removal of completed tasks after a configurable number of days but does not present this as a deletion risk or user-facing warning. Automatic deletion of user data, even limited to completed todos, can cause unexpected loss of information if users treat the file as a long-term record.

Static analysis

No suspicious patterns detected.