health-tracker
Verdict safe, but 5 findings (1 medium, 4 low), mainly resource abuse, policy violation, unauthorized tool use. Most recent scan 2026-02-06.
The health-tracker skill presents MEDIUM security risk primarily due to unbounded autonomous behavior (auto-logging without consent) and missing tool declarations. The skill's core functionality (tracking water intake and sleep) is legitimate, but implementation choices create autonomy and transparency concerns. The auto-log feature that writes data without user interaction after 15 minutes represents an availability disruption pattern. Missing 'allowed-tools' declaration reduces transparency about required permissions. Additional minor issues include incomplete metadata and unpinned dependencies. The skill does NOT contain data exfiltration, prompt injection, or malicious code. With remediation of the auto-log behavior and addition of proper tool declarations, this skill could be considered safe for use.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Track water intake and sleep with smart reminders
- Package
- 4 files, 17 KB
- SKILL.md
- 619 words, 12+ sections
- Code
- JavaScript (1)
- Version
- 1.0.0
SKILL.md covers: Health Tracker · Tính năng · 💧 Theo dõi uống nước · 😴 Theo dõi giấc ngủ · 📊 Thống kê · Cài đặt · Cách sử dụng · Ghi nhận uống nước · Ghi nhận giấc ngủ · Xem thống kê · Dữ liệu · Tools
Findings
MEDIUM Unbounded Autonomy with Auto-Logging Without User Consent Resource Abusellm
The skill implements an 'auto-log' feature that automatically records water intake entries (with 0 cups) if the user does not respond within 15 minutes of a reminder. This creates an unbounded autonomous behavior where the system makes decisions and modifies user data without explicit consent. The auto-log entries are marked as automatic but still pollute the user's health tracking data, potentially affecting statistics and habit calculations. This represents a form of availability disruption through unwanted automated actions.
SKILL.md
Auto-log section states: 'Nếu không trả lời sau 15 phút → Tự động ghi: {cups: 0, auto: true, note: "Tự động ghi nhận - không phản hồi"}'. This means the system will continuously create entries without user interaction.LOW Skill does not specify a license Policy Violationstatic
Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.
SKILL.md
LOW Undeclared Tool Usage and Missing Tool Restrictions Unauthorized Tool Usellm
The skill declares three tools (log_water, log_sleep, view_stats) in its documentation but does not specify 'allowed-tools' in the YAML manifest. While this field is optional, the skill's behavior suggests it needs Write access (to modify health-data.json) and potentially Bash/Python (for node-cron scheduling). The absence of declared tool restrictions means the skill could potentially use any available agent tools without user awareness, creating a tool exploitation risk.
SKILL.md
YAML manifest shows 'allowed-tools: Not specified' but the skill clearly requires file write operations ('Lưu tại: ./health-data.json') and mentions npm package installation ('npm install node-cron'). The tools section describes data persistence but doesn't declare which agent tools are needed.LOW Missing Provenance and Security Metadata Data Exfiltrationllm
The skill's YAML manifest lacks critical security metadata including license information and compatibility declarations. While 'author' is specified as 'Your Name' (a placeholder), there is no license field to indicate usage rights and liability. The absence of compatibility information means users cannot assess whether the skill is safe for their environment (Claude.ai, Claude Code, API). This represents a minor information disclosure issue affecting user decision-making.
SKILL.md
YAML shows: 'license: Not specified', 'compatibility: Not specified', 'author: Your Name' (placeholder value). Only version (1.0.0) and tags are provided.LOW External Dependency Without Version Pinning Resource Abusellm
The skill requires 'node-cron' npm package for scheduling functionality but does not specify a version constraint. This creates a supply chain risk where future versions could introduce breaking changes, vulnerabilities, or malicious code. While not immediately exploitable, unpinned dependencies are a security best practice violation that could lead to availability issues or unexpected behavior.
SKILL.md
Installation instructions show: 'npm install node-cron' without version specification (e.g., 'node-cron@^3.0.0' or 'node-cron@3.0.2').What is in the package
| File | Kind | Size |
|---|---|---|
README.md | doc | 3.4 KB |
SKILL.md | doc | 3.9 KB |
index.js | script | 9.8 KB |
package.json | config | 216 B |
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://clawhub.ai/skills/healthcheck
- Raw scan result: healthcheck-scan.json
- Badge for your README:
- Request a re-scan