Security audit

ClawCoach Core

Security checks for vulnerabilities and agentic risk

Overview

This health-coaching skill is purpose-aligned and locally scoped, with some safety and clarity caveats users should understand before using it.

Before installing, understand that ClawCoach stores personal profile and food-log data in ~/.clawcoach/. The roast persona may use blunt humor, though the skill includes limits against body-image or distress-related mocking. Users outside the United States should not rely on the listed crisis numbers as their only emergency resource.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The phrase allowing persona switching on commands 'or similar' is overly broad and can cause unintended state changes from ambiguous user language. In a coaching skill with persistent profile storage, accidental or adversarially induced persona changes can alter tone and safety expectations, especially given the presence of an aggressive 'savage roaster' mode.

Natural-Language Policy Violations

Medium

Confidence: 85% confidence
Finding: The crisis response hard-codes US-only support numbers without qualifying geography or offering alternatives, which can misdirect users in distress outside the United States. In a health and eating-behavior coaching context, this is more dangerous because the skill explicitly handles self-harm, purging, binging, and severe emotional distress, where incorrect crisis routing may delay access to appropriate help.

Natural-Language Policy Violations

Low

Confidence: 92% confidence
Finding: The file instructs the skill to use a fixed 'lowercase typing style' as part of its response behavior. This is a language/style constraint imposed by default, and the file does not indicate any user choice or opt-in for that locale/style preference.

Natural-Language Policy Violations

Low

Confidence: 86% confidence
Finding: The instruction "Clear, complete sentences with proper capitalization" imposes a specific language/writing-style convention. Under the policy, locale or language constraints should not be forced unless the skill offers user choice or clearly justifies the restriction.

Static analysis

No suspicious patterns detected.