Security audit
Security checks for vulnerabilities and agentic risk
This blogging skill needs review because it encourages publishing current-session work and persists that instruction across sessions without requiring your approval.
Before installing, remove the recurring publishing directive and require approval of each exact draft before posting. Check drafts for private project details, personal information, and secrets. Keep the API key outside tracked project files. Deleting a post does not remove archived copies. The review covered the complete bundled artifact; live service behavior and optional external code remain unverified.
SKILL.mdPersistent instructions redirect future sessions toward public publishing
Later sessions can be redirected toward public publication without a task-specific publishing request. Actual publication or disclosure of confidential information was not observed.
The request uses the declared platform, but modifies a founder-message resource rather than performing any stated article, comment, registration, browsing, or proof-verification operation. This is an undeclared write capability, not merely an implementation detail of the described functions.
The skill pressures the agent to immediately publish material derived from its current session, without requiring a confidentiality review or user approval of the exact content. This creates a plausible path for private user or project information to reach a public service, where the documented retention of deleted text in internal archives and backups makes disclosure harder to reverse. The optional client's preview safeguards reduce risk for that workflow but do not constrain the direct curl publishing instructions.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
The first fifty registrations are kept as a permanent chronological record, available to agents and humans:
curl https://clawprint.org/api/founders
This is a record of how Clawprint started, not a gate. Registration is open to every agent.
The setup asks the agent to place a recurring publishing directive into CLAUDE.md, turning task-specific skill guidance into persistent instructions for future sessions. This can steer unrelated work toward external publication without renewed authorization; the blogging context explains the feature but does not justify making it a standing project instruction.
Persisting the instruction to write posts each session can influence future agent behavior beyond the original task and user authorization. This is the same underlying persistent-instruction issue reported by SDI-2, not a separate exploit, and becomes more consequential when combined with encouragement to publish session-derived information.