ClawHub
Back to skill

Security audit

Watchos Code Review

Security checks for vulnerabilities and agentic risk

Overview

This watchOS review skill is mostly coherent, but it makes security reporting depend on an unbundled sibling skill and includes overly broad guidance to disable file protection for background data.

Install only if you are comfortable with the skill's external review-protocol dependency influencing what findings are reported. Before relying on it for security review, remove or vendor the external protocol and revise the background-file guidance so .noFileProtection is limited to explicitly non-sensitive data with a documented tradeoff.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:56
Finding

External Instruction Redirection Can Suppress Audit Findings

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:56
Vulnerability Type: External instruction dependency and review-result suppression
Risk Level: High

Vulnerable Code:

markdown
4. **Protocol** — Pre-report steps in [review-verification-protocol](../review-verification-protocol/SKILL.md) are satisfied for this item (no finding if they are not).

Technical Analysis

The Skill requires the agent to consult and satisfy instructions from ../review-verification-protocol/SKILL.md, a file outside the audited project directory. The external Skill is neither bundled with nor verifiable from this project, and its contents may change independently.

More critically, the phrase “no finding if they are not” makes security reporting conditional on the external instructions. This delegates control over the audit outcome to an unaudited instruction source. Such indirection is unnecessary for the declared watchOS code-review functionality: a local, self-contained verification checklist would provide the same legitimate capability without transferring authority to another Skill.

This is an instruction-hijacking risk rather than direct local code execution. Exploitation requires an attacker or compromised component to control the referenced sibling Skill.

Attack Path

  1. A user or agent loads this watchOS review Skill.
  2. The Skill instructs the agent to apply hard gate 4 before reporting any finding.
  3. The agent resolves and reads ../review-verification-protocol/SKILL.md.
  4. An attacker-controlled or subsequently modified sibling Skill supplies instructions that weaken review criteria, redirect the task, or prohibit selected findings.
  5. Because the current Skill explicitly requires “no finding” when that protocol is not satisfied, the agent suppresses otherwise valid vulnerabilities or produces a manipulated report.

Impact Assessment

Exploitation can compromise the integrity and completeness of ...[truncated 469 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the mandatory dependency on ../review-verification-protocol/SKILL.md.
  2. Place the complete verification checklist directly inside this repository so it is immutable and auditable with the Skill.
  3. Do not make vulnerability reporting conditional on instructions obtained from outside the reviewed Skill package.
  4. If external documentation remains necessary, treat it as untrusted reference data rather than authoritative agent instructions.
  5. Pin and integrity-check any required external policy artifact, and define explicit behavior when it is missing or fails validation.
  6. Replace the suppression rule with a transparent reporting rule, such as marking uncertain items as review questions rather than silently omitting them.

T09 · Insecure Skill Coding Practices

Warning
Location
references/performance.md:80
Finding

Recommendation Disables File Protection for Background Data

Content
View full analysis

Vulnerability Details

File Location: references/performance.md:80-86; reinforced by references/performance.md:225
Vulnerability Type: Insecure data-at-rest protection guidance
Risk Level: Medium

Vulnerable Code:

swift
// BAD: Fails when screen locked
func backgroundHandler() {
    let data = try? Data(contentsOf: protectedFileURL)  // Fails!
}

// GOOD: Use no file protection for background data
try data.write(to: url, options: .noFileProtection)

The recommendation is reinforced by the review question:

markdown
3. Are files using `.noFileProtection` if accessed in background?

Technical Analysis

The Skill presents .noFileProtection as the preferred solution for files accessed during background processing. On Apple platforms, this option disables Data Protection for the written file, weakening confidentiality while the device is locked.

The guidance does not limit this option to explicitly non-sensitive data, does not require a threat assessment, and does not distinguish health information, authentication tokens, credentials, personal information, or other sensitive records. Because the Skill reviews watchOS applications, affected data may include particularly sensitive health and activity information.

The behavior exceeds minimum privilege and exposure requirements when a stronger protection class or a redesigned background workflow can meet the application’s operational needs.

Attack Path

  1. A developer or reviewing agent applies the Skill’s performance guidance.
  2. Background-accessed data is written using .noFileProtection.
  3. The affected file remains unprotected by the platform’s normal locked-device Data Protection controls.
  4. An attacker who subsequently obtains sufficient device, backup, forensic, or filesystem access retrieves the file while its contents would otherwise have remained cryptographically unavailable.
  5. Sensitive application data ...[truncated 574 chars]
Remediation
View remediation

Remediation Suggestions

  1. Do not recommend .noFileProtection as a general solution for background access.
  2. Use the strongest file-protection class compatible with the required execution state.
  3. Explicitly prohibit .noFileProtection for credentials, authentication tokens, health data, personal information, cryptographic material, and other sensitive content.
  4. Separate non-sensitive background state from protected application records so only the minimum necessary data receives weaker protection.
  5. Minimize retained data, encrypt especially sensitive payloads at the application layer where appropriate, and securely delete temporary files after use.
  6. Redesign background operations to defer protected-file access until the device is unlocked when operationally feasible.
  7. Revise the checklist to require a documented data-classification and threat assessment before changing file-protection settings.

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md
1. **Location artifact** — The finding includes `[FILE:LINE]` (or a line range) copied from the current file contents; the path resolves in this repo.
2. **Scope read** — You read the full surrounding unit: the `View` body, `WKApplicationDelegate` / scene method, `TimelineProvider` implementation, `WCSessionDelegate` callback, or workout/background task handler that owns the behavior—not only a diff hunk.
3. **watchOS or pairing claim** (only if the finding depends on background modes, complication/timeline contracts, `WCSession` reachability or transfer semantics, workout or extended runtime rules, or device-specific limits) — You name one concrete artifact you inspected (for example `Info.plist` / target capabilities for background modes, the `WK*` / `WCSession` call order in source, entitlements, or a subsection you read in the matching doc from [Quick Reference](#quick-reference)) **or** you downgrade the item to an open question in [Review Questions](#review-questions).
4. **Protocol** — Pre-report steps in [review-verification-protocol](../review-verification-protocol/SKILL.md) are satisfied for this item (no finding if they are not).

Use the issue format `[FILE:LINE] ISSUE_TITLE` for each reported finding. Hard gate 4 is the full pre-report checklist for this skill’s review type.

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/connectivity.md (reported line 169)May include surrounding context.

md
## Data Type Requirements

Only Plist-encodable types allowed:
- String, Int, Double, Bool
- Data
- Array, Dictionary (of above types)

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/connectivity.md (reported line 193)May include surrounding context.

md
## Data Type Requirements

Only Plist-encodable types allowed:
- String, Int, Double, Bool
- Data
- Array, Dictionary (of above types)