ClawDoro
Verdict safe, but 7 findings (2 medium, 5 low), mainly policy violation, data exfiltration, command injection. Most recent scan 2026-02-05.
ClawDoro is a Pomodoro timer skill with MEDIUM security concerns. The primary risks are: (1) starting an HTTP server on a hardcoded port without user confirmation, creating network exposure, and (2) executing Node.js code (trigger.js) that is not provided for security review, creating a transparency gap. The skill appears to be a legitimate productivity tool, but the missing source code for trigger.js prevents full security validation. The network server component introduces attack surface that should be minimized through localhost-only binding and ephemeral ports. Minor issues include missing metadata (allowed-tools, license, compatibility) and lack of server lifecycle documentation. Recommend requiring full source code disclosure and implementing network security controls before deployment.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
A beautiful Pomodoro timer with task tracking. Opens a clean, focused timer interface in your browser.
- Package
- 3 files, 16 KB
- SKILL.md
- 179 words, 8 sections
- Code
- JavaScript (1)
SKILL.md covers: 🍅 ClawDoro · Usage · Start with default 27/5/15 min · Custom focus time · Full custom (focus/short/long) · Features · How It Works · Files
Findings
MEDIUM Hardcoded Network Port Exposure Data Exfiltrationllm
The skill starts an HTTP server on a hardcoded port 8765 without user confirmation or security controls. This creates a network-accessible endpoint on the user's machine that could be exploited by malicious websites or local attackers to interact with the timer interface or potentially probe for vulnerabilities.
SKILL.md:29
Opens a mini HTTP server on port 8765MEDIUM Arbitrary JavaScript Execution via Node.js Command Injectionllm
The skill executes Node.js scripts (trigger.js) which are not provided for security review. The commands configuration shows direct execution of JavaScript files without visibility into what code is actually running. This creates a blind spot where malicious code could perform unauthorized operations including file system access, network requests, or system commands.
YAML manifest
commands: {'clawdoro': 'node ~/clawd/skills/pomodoro/trigger.js', 'pomodoro': 'node ~/clawd/skills/pomodoro/trigger.js'}LOW Skill name does not follow agent skills naming rules Policy Violationstatic
Skill name 'ClawDoro' is invalid. Agent skills require lowercase letters, numbers, and hyphens only, with a maximum length of 64 characters.
SKILL.md
LOW Skill does not specify a license Policy Violationstatic
Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.
SKILL.md
LOW Missing allowed-tools Declaration Data Exfiltrationllm
The skill does not declare which agent tools it uses in the allowed-tools field. While this field is optional, its absence makes it harder to verify that the skill operates within expected boundaries and doesn't use unauthorized capabilities.
allowed-tools: Not specifiedLOW Missing License and Compatibility Information Social Engineeringllm
The skill lacks license and compatibility metadata, making it unclear under what terms it can be used and which environments it supports. This reduces transparency and could lead to unexpected behavior in unsupported environments.
license: Not specified, compatibility: Not specifiedLOW No Server Lifecycle Management Documented Resource Abusellm
The documentation does not specify how to stop the HTTP server once started. This could lead to resource leaks with servers continuing to run in the background, consuming ports and system resources unnecessarily.
No shutdown or cleanup instructions provided in documentationWhat is in the package
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 1.4 KB |
timer.html | data | 13 KB |
trigger.js | script | 1.7 KB |
External hosts referenced
snail3d.github.io www.buymeacoffee.com
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Environment variables referenced
PORT
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://clawhub.ai/skills/pomodoro
- Raw scan result: clawdoro-scan.json
- Badge for your README:
- Request a re-scan