PARA

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:34 PM UTC
• Version: 0.1.0

Overview

This file-organization skill is understandable, but it gives the agent broad automatic authority to move workspace files without confirmation or rollback safeguards.

Install only if you want the agent to actively enforce PARA organization across the workspace. Before using it, require the agent to show proposed moves, get confirmation, avoid overwrites, exclude active/config/hidden files unless explicitly approved, and keep a move log or rollback plan.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:17

Finding

Global File-Operation Hijacking Through Mandatory Automatic Relocation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17–27
Vulnerability Type: Mandatory global instruction override causing unauthorized workspace mutation
Risk Level: Medium

Vulnerable Code

markdown

## Mandate: Automatic Organization
You MUST follow the PARA structure for ALL file operations. Never leave new files in the root directory (`/root/clawd/`) unless they are core identity files (AGENTS.md, MEMORY.md, etc.).

1.  **New Project Files?** Create a subfolder in `1-Projects/`.
2.  **Long-term reference or data?** Put it in `3-Resources/`.
3.  **Finished work?** Move it to `4-Archives/`.
4.  **System/Config updates?** Keep them in `2-Areas/`.

## Workflow
1. **Identify**: Determine which category a file or directory belongs to.
2. **Move**: Use `mv` to place it in the correct PARA folder.
3. **Maintain**: Periodically review Projects and move finished ones to Archives.

Technical Analysis

The Skill uses a mandatory instruction applying the PARA policy to all file operations, rather than limiting it to explicit organization requests. Once loaded, this directive can alter how the Agent handles unrelated file-management tasks and instruct it to move files automatically based on subjective categorization.

The use of mv is not accompanied by requirements for user authorization, source and destination validation, collision detection, non-overwriting behavior, backups, transactional rollback, or protection of active and sensitive files. The narrow exception for unspecified “core identity files” does not adequately protect configuration files, hidden files, active project artifacts, symbolic links, or files required at fixed paths.

The behavior does not grant privileges beyond those already held by the Agent. However, it directs the Agent to exercise its existing filesystem privileges over the entire /root/clawd/ workspace, which exceeds the scope needed for an opt-in organizationa ...[truncated 1614 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the global MUST directive with an opt-in rule that operates only when the user explicitly requests PARA organization.
2. Restrict operations to a user-approved directory instead of automatically controlling every file operation under /root/clawd/.
3. Generate a dry-run plan listing each source path, proposed destination, and categorization reason before making changes.
4. Require explicit user confirmation before moving files, particularly for batch operations, existing files, system configuration, hidden files, or active project artifacts.
5. Validate and canonicalize source and destination paths, reject traversal outside the approved workspace, and handle symbolic links safely.
6. Require collision-safe movement, such as refusing to overwrite an existing destination unless the user separately approves it.
7. Define protected-file rules covering identity files, configuration, hidden files, active artifacts, and any files whose paths are referenced by other resources.
8. Record every move in an audit log and provide a tested rollback procedure that restores the original paths.
9. Disable autonomous “periodic” maintenance unless the user explicitly initiates and approves a review.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill mandates automatic file movement for all file operations and specifically instructs use of mv without requiring confirmation, previews, allowlists, or checks for user intent. This can cause unintended relocation of files, break workflows that depend on stable paths, and lead to effective data loss from the user's perspective if files are moved unexpectedly or into incorrect categories.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.