Expat Companion

PassAudited by ClawScan on May 10, 2026.

Overview

This looks like a benign relocation-planning skill, but it keeps sensitive move and document details in local files that users should manage carefully.

Before using this skill, be comfortable with it keeping files under ~/expat/. Treat those files as private, avoid storing unnecessary passport/document identifiers or exact physical locations, and verify visa, legal, tax, banking, and healthcare information against official sources.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI06: Memory and Context Poisoning

What this means

Someone with access to the device could learn private details about the user's move, documents, deadlines, and personal circumstances.

Why it was flagged

The skill intentionally creates persistent local files containing relocation plans, visa status, family/logistics details, concerns, reminder preferences, and document status.

Skill content

After the conversation, create `~/expat/memory.md` with:
- Move status and phase
- Origin and destination countries
- Target timeline and key dates
- Visa status and type
- Family/logistics situation
- Their main concerns
- Reminder preferences

Also create `~/expat/documents.md` if they mentioned any document status.

Recommendation

Users should review what is saved in ~/expat/, avoid storing unnecessary document identifiers or exact locations, and delete or protect the files when no longer needed.

NoteMedium Confidence

ASI09: Human-Agent Trust Exploitation

What this means

Users might not realize that their relocation information is being written to persistent local files unless they ask or inspect the skill instructions.

Why it was flagged

The skill tells the agent not to foreground storage details unless asked, even though it stores sensitive planning and document-tracking information locally.

Skill content

If they ask where data is stored, tell them (`~/expat/`). Otherwise, keep the conversation about their move, not about files.

Recommendation

The skill should proactively tell users that it stores data in ~/expat/ and ask before saving especially sensitive document or personal details.