ClawHub
Back to skill

Security audit

ClawCoach Setup

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward local setup flow for a health coach, but it stores sensitive profile and meal data in plaintext local files.

Install only if you are comfortable storing health profile details, goals, allergies, dietary preferences, and meal history as local plaintext JSON under ~/.clawcoach. Use it on a private account or device, avoid syncing that folder unintentionally, and delete the folder if you no longer want the data retained.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:19
Finding

Sensitive Health Profile Data Stored Without Explicit Filesystem Protections

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 19–26 and 96–126
Vulnerability Type: Plaintext storage of sensitive personal and health-related data
Risk Level: Medium

Vulnerable Code

markdown
## Data Storage

All ClawCoach data is stored in `~/.clawcoach/` as JSON files. Create this directory if it does not exist.

Files:
- `~/.clawcoach/profile.json` — user profile and preferences
- `~/.clawcoach/food-log.json` — meal log entries
- `~/.clawcoach/daily-totals.json` — cached daily macro totals

The stored profile is instructed to include sensitive personal and health-related fields:

json
{
  "name": "...",
  "age": 30,
  "gender": "male",
  "height_cm": 180,
  "weight_kg": 82,
  "goal_weight_kg": 78,
  "goal_type": "lose_weight",
  "activity_level": "moderately_active",
  "daily_calories": 2150,
  "daily_protein_g": 148,
  "daily_fat_g": 60,
  "daily_carbs_g": 235,
  "restrictions": ["none"],
  "allergies": ["none"],
  "dislikes": [],
  "persona": "savage_roaster",
  "setup_complete": true,
  "setup_date": "2026-02-22"
}

Technical Analysis

The skill directs the agent to persist the user's identity, age, gender, body measurements, weight goals, dietary restrictions, allergies, and nutrition targets in ordinary JSON files. It does not require restrictive permissions for the storage directory or files, encryption at rest, secure atomic file creation, or verification of resulting ownership and permissions.

Consequently, access controls depend entirely on the host's existing umask and filesystem configuration. In an environment with permissive defaults, shared home-directory access, insecure backups, or broadly authorized local processes, the data may be readable by parties beyond the intended user. Plaintext JSON also makes the information directly intelligible if the files are disclosed.

This is an insecure data-storage practice rather th ...[truncated 1691 chars]

Remediation
View remediation

Remediation Suggestions

  1. Create ~/.clawcoach/ with mode 0700 and verify that it is owned by the current user.
  2. Create profile, log, and cache files with mode 0600, independent of the ambient umask.
  3. Use secure atomic writes: create a same-directory temporary file with restrictive permissions, write and flush the content, then atomically rename it to the destination.
  4. Refuse to write through symbolic links and verify that existing paths are regular files owned by the expected user.
  5. Clearly disclose before collection that the information will be retained as local plaintext unless encryption is enabled.
  6. Offer encryption at rest using an operating-system credential store or a user-controlled key, especially for allergy, body-measurement, and meal-history data.
  7. Provide a non-persistent mode and allow users to omit or delete individual fields.
  8. Define retention and secure-deletion behavior for profile, meal-log, cache, reset, and reconfiguration operations.
  9. Avoid including these files in cloud synchronization or backups by default, or clearly warn users when the storage directory is located within a synchronized or shared environment.

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The activation trigger includes the catch-all phrase "or similar," which makes invocation boundaries ambiguous and can cause the skill to activate on loosely related user requests. Because this skill collects and persists sensitive health profile data, accidental activation could lead to unnecessary collection or storage of personal information without sufficiently clear user intent.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
86% confidence
Finding

The skill establishes persistent local storage in ~/.clawcoach/ for ongoing profile and meal data, creating a durable record of sensitive health and behavioral information. Even though this is framed as normal application state, persistent storage increases exposure if the host is shared, backed up insecurely, synced automatically, or later accessed by other tools without the user's awareness.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md
## Data Storage

All ClawCoach data is stored in `~/.clawcoach/` as JSON files. Create this directory if it does not exist.

Files:
- `~/.clawcoach/profile.json` — user profile and preferences

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill instructs saving highly sensitive personal and health-related data to local JSON files, but the save step itself does not require an explicit just-in-time notice and consent immediately before persistence. A generic earlier statement that data stays local is weaker than a direct warning at collection/save time, especially given the breadth of stored fields such as age, weight, dietary restrictions, and goals.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.