ClawHub
Back to skill

Security audit

Tarot Reading

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Markdown-only tarot reading skill, with a privacy caveat around silent reuse of saved preferences and a sibling memory file.

Installers should understand that the skill may personalize readings from saved preferences and may check a related fortune-hub memory file if present. Avoid storing sensitive personal details in these memory files unless you are comfortable with later reuse across fortune-telling skills.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Note
Location
SKILL.md:82
Finding

Cross-Skill Persistent Memory Access Violates Least Privilege

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 82–83
Vulnerability Type: Cross-skill memory access
Risk Level: Low

Vulnerable Code

markdown
1. This skill's `MEMORY.md` — any stored user preferences (e.g., preferred spread, common topics)
2. The same repo's `fortune-hub/MEMORY.md` (if it exists) — no need for basic profile fields, just check for relevant preferences

Technical Analysis

The skill explicitly instructs the agent to read persistent memory belonging to the separate fortune-hub skill. A tarot reading does not require access to another skill's state, so this crosses a logical authorization boundary and violates the principle of least privilege.

The restriction to “relevant preferences” reduces the intended scope but is not an enforceable access control. The agent must still open and process the sibling memory file to determine which fields are relevant. Consequently, unrelated or sensitive information in that file may enter the agent's context. The project contains no field-level allowlist, user-consent check, access-control mechanism, or isolation layer governing this read.

No instruction to transmit the information externally, access credentials, modify sibling memory, or execute content from the file was found.

Attack Path

  1. A user invokes the tarot-reading skill.
  2. The skill directs the agent to inspect its own MEMORY.md.
  3. The agent is then directed to locate and read the sibling fortune-hub/MEMORY.md.
  4. The sibling file's contents enter the tarot skill's active context, including any information beyond the preferences actually needed.
  5. Those contents may influence the generated reading or be unintentionally reflected in the response.

If another party or skill can place misleading content in the sibling memory file, that content could also influence the tarot response. The audited files do not establish that such write access exists, so this is a con ...[truncated 600 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the instruction to read fortune-hub/MEMORY.md; default to reading only memory owned by the tarot skill.
  2. If shared preferences are required, request explicit user authorization before accessing cross-skill state.
  3. Replace direct file access with a scoped preference interface that returns only allowlisted fields, such as preferred_spread and common_topics.
  4. Enforce per-skill memory namespaces and deny arbitrary sibling-memory reads at the tool or runtime permission layer.
  5. Treat memory content as untrusted data rather than executable instructions, and prevent it from overriding system, developer, or active user directives.
  6. Avoid loading the complete shared memory file into the model context; retrieve only the specifically authorized fields needed for the current request.
  7. Add tests confirming that invoking this skill cannot read unrelated profile data or state owned by other skills.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · references/major-arcana.md (reported line 265)May include surrounding context.

md
**Reversed Keywords**: liberation, release, reclaiming control, breaking free

**Upright — Deeper Meaning**:
The Devil sits enthroned above two figures loosely chained at his feet — chains they could slip off at any moment, if they chose. This card represents the things that keep us addicted, obsessed, or trapped. Its appearance is an invitation: look clearly at the beliefs, patterns, or behaviors that make you feel bound — without judgment, without shame. Awareness itself is where liberation begins.

**Reversed — Deeper Meaning**:
In reversal, the chains are beginning to loosen. This is an encouraging reversal — a long-held addiction or obsessive pattern is starting to lose its grip, and you are reclaiming agency over your own life. The journey toward freedom may just be beginning, or a relationship that once felt inescapable may finally be reaching its end. Once you can see the truth, the chains that felt unbreakable turn out to be easier to slip than you imagined.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The trigger list includes very broad phrases such as "tarot," "draw a card," and "daily card," which are common conversational terms and may cause the skill to activate when the user did not explicitly intend a tarot workflow. In a multi-skill environment, unintended invocation can route users into divination behavior unexpectedly, potentially producing irrelevant or inappropriate guidance for sensitive topics.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill instructs the agent to read from and write to MEMORY.md for user preferences, but it does not require a clear user-facing notice that preference data may be stored or later reused. Even though writes are limited to explicit user requests, silent reading and implicit reuse of stored personal preference patterns can undermine user expectations and create privacy risks, especially for sensitive topics like love or career concerns.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.