Agent Economy ReportAgent Economy ReportUNSAFE version 1.0.2 · audited 2026-09-17
This skill is a local health tracker. The SKILL.md file instructs an agent to run bash/Node one-liners that read and write a local health-data.json file for water, sleep, and wake records. It does not contain its own network call, credential access, or payment redirection. However, the water count is substituted directly into a Node.js command from user input without numeric validation or escaping. The package's own skill card acknowledges this can cause unintended local code execution. Because an agent with shell access could be made to run arbitrary code through this input, the skill should not be installed as-is.
Instructions try to steer the agent beyond the declared purpose. SKILL.md line 31 says to replace CUPS with the user's number, and line 28 places cups:CUPS directly into a node -e shell command. skill-card.md line 24 acknowledges this can lead to unintended local code execution if non-numeric input is inserted. No validation or escaping is shown in SKILL.md.
| Declared purpose | Track water and sleep with JSON file storage |
| Observed behavior | SKILL.md provides commands to run node -e snippets when users ask to add water, add sleep/wake, view stats, update, or delete records. The snippets use fs.readFileSync and fs.writeFileSync on {baseDir}/health-data.json. No runtime network access, credential reading, environment variable use, payment activity, or persistence outside that JSON file was observed. |
| Verdict, rules only | SAFE |
| Verdict, AI | UNSAFE |
| Final verdict | UNSAFE (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| shell | needed | The skill is presented as shell snippets; SKILL.md line 27 opens a bash block and line 28 executes node -e, with similar commands on lines 38, 46, 54, 62, and 70. |
| filesystem_read | needed | Snippets call fs.readFileSync on {baseDir}/health-data.json, e.g. SKILL.md line 28, 38, 46, and 54. |
| filesystem_write | needed | Snippets call fs.writeFileSync to save or update {baseDir}/health-data.json, e.g. SKILL.md lines 28, 38, 46, 62, and 70. |
| network | exceeds purpose | No runtime network code was found. The only domain is a publisher profile link at skill-card.md line 9, which is not fetched by the skill. |
| severity | finding |
|---|---|
| critical | Unsanitized command/code injection in water command The CUPS value from user input is inserted directly into a Node.js expression inside a shell command. A non-numeric value containing JavaScript or shell metacharacters can alter the command and execute arbitrary code in the agent's shell. SKILL.md:28 cups:CUPS});fs.writeFileSync(f,JSON.stringify(d));console.log('Da ghi: '+CUPS+' coc') |
| high | Publisher-acknowledged code execution risk The package metadata explicitly acknowledges the command-injection risk, but the SKILL.md instructions do not implement the stated mitigation. skill-card.md:24 Risk: The water amount placeholder can lead to unintended local code execution if non-numeric input is inserted into the Node.js snippet. |
| low | Update command has no confirmation step The latest water record is modified immediately; skill-card.md line 32 also notes that update and delete actions lack confirmation. SKILL.md:62 d.water[d.water.length-1].cups=NEW_CUPS;fs.writeFileSync(f,JSON.stringify(d));console.log('Updated') |
| low | Delete command has no confirmation step The latest water record is removed immediately without a confirmation action. SKILL.md:70 d.water.pop();fs.writeFileSync(f,JSON.stringify(d));console.log('Deleted') |
| info | Publisher profile link is the only observed domain This link is the only domain in the package, and no code fetches it. It is not hidden because it appears in the publisher section. skill-card.md:9 [stellarhold170nt](https://clawhub.ai/user/stellarhold170nt) |
1 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| clawhub.ai | not in the service index | skill-card.md:9 |
| Binaries invoked | bash, node |
| Environment variables read | none |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 5 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
SKILL.md | 77 | a7f2ca8668e191d5… |
_meta.json | 6 | c1c951a528c8cdb6… |
skill-card.md | 55 | d180b8327a932eb9… |
For agents
JSON: https://agenteconomy.report/k/healthcheck.audit.json · badge: https://agenteconomy.report/k/healthcheck.audited.svg ·
skill rating: /k/healthcheck · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).