Anki

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 7:24 PM UTC
• Version: 1.0.3

Overview

This is a coherent Anki guidance skill with app-scoped local preferences and no evidence of hidden execution or data exfiltration.

Before installing, know that the skill may use ~/Clawic/data/anki/config.yaml and memory.md to remember Anki preferences and study context. It does not appear to run code or directly change your Anki collection, but you should still review generated cards before importing and make backups before following any destructive Anki advice.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 173)May include surrounding context.

md

| Trap | Why it fails | Do instead |
|---|---|---|
| Answering Hard to keep a card close | Hard is a pass with a shrinking multiplier; used habitually it drives intervals toward daily and inflates difficulty | Again for failures, Good for successes; Hard only for genuine slow retrievals |
| Deleting a leech | Removes the evidence and the fact; the same gap reappears from the source material next month | Suspend, rewrite, reset history, unsuspend (rule 4) |
| Studying a giant shared deck as-is | Thousands of unsuspended cards on material not yet taught — a backlog by day three | Unsuspend by lecture or topic tag as you cover it (`medicine.md`) |
| Editing deck options from a subdeck | Presets are shared; the edit hits every deck using that preset | Check the usage count, clone the preset first (rule 7) |
| Fixing retention by raising desired retention | The recall gap is usually card quality or grading; the dial only buys reviews | Diagnose the Again-rate by deck first (`retention.md`) |

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · importing.md (reported line 31)May include surrounding context.

md

- A **tab inside a field** ends the field. Strip tabs from source text before writing the file.
- A **raw newline ends the record**. Multi-line answers need `#html:true` plus `<br>`, or the whole field quoted in a CSV dialect Anki understands.
- **Duplicate handling** is chosen in the dialog: *Update existing notes* matches on the FIRST field only and overwrites your edits with no warning; *Preserve existing* skips; *Duplicate* imports anyway. Pick deliberately — the default is the one that overwrites.
- Cloze notes need `#notetype:Cloze` and real `{{c1::…}}` markers; a cloze note with no marker imports as a note that generates **zero cards**.
- Import creates notes, not scheduling: everything arrives as new cards at the end of the new queue. Use Reposition if the order matters.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · importing.md (reported line 54)May include surrounding context.

md

- A **tab inside a field** ends the field. Strip tabs from source text before writing the file.
- A **raw newline ends the record**. Multi-line answers need `#html:true` plus `<br>`, or the whole field quoted in a CSV dialect Anki understands.
- **Duplicate handling** is chosen in the dialog: *Update existing notes* matches on the FIRST field only and overwrites your edits with no warning; *Preserve existing* skips; *Duplicate* imports anyway. Pick deliberately — the default is the one that overwrites.
- Cloze notes need `#notetype:Cloze` and real `{{c1::…}}` markers; a cloze note with no marker imports as a note that generates **zero cards**.
- Import creates notes, not scheduling: everything arrives as new cards at the end of the new queue. Use Reposition if the order matters.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · importing.md (reported line 82)May include surrounding context.

md

- A **tab inside a field** ends the field. Strip tabs from source text before writing the file.
- A **raw newline ends the record**. Multi-line answers need `#html:true` plus `<br>`, or the whole field quoted in a CSV dialect Anki understands.
- **Duplicate handling** is chosen in the dialog: *Update existing notes* matches on the FIRST field only and overwrites your edits with no warning; *Preserve existing* skips; *Duplicate* imports anyway. Pick deliberately — the default is the one that overwrites.
- Cloze notes need `#notetype:Cloze` and real `{{c1::…}}` markers; a cloze note with no marker imports as a note that generates **zero cards**.
- Import creates notes, not scheduling: everything arrives as new cards at the end of the new queue. Use Reposition if the order matters.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · note-types.md (reported line 64)May include surrounding context.

md

- A **tab inside a field** ends the field. Strip tabs from source text before writing the file.
- A **raw newline ends the record**. Multi-line answers need `#html:true` plus `<br>`, or the whole field quoted in a CSV dialect Anki understands.
- **Duplicate handling** is chosen in the dialog: *Update existing notes* matches on the FIRST field only and overwrites your edits with no warning; *Preserve existing* skips; *Duplicate* imports anyway. Pick deliberately — the default is the one that overwrites.
- Cloze notes need `#notetype:Cloze` and real `{{c1::…}}` markers; a cloze note with no marker imports as a note that generates **zero cards**.
- Import creates notes, not scheduling: everything arrives as new cards at the end of the new queue. Use Reposition if the order matters.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · organization.md (reported line 85)May include surrounding context.

md

- A **tab inside a field** ends the field. Strip tabs from source text before writing the file.
- A **raw newline ends the record**. Multi-line answers need `#html:true` plus `<br>`, or the whole field quoted in a CSV dialect Anki understands.
- **Duplicate handling** is chosen in the dialog: *Update existing notes* matches on the FIRST field only and overwrites your edits with no warning; *Preserve existing* skips; *Duplicate* imports anyway. Pick deliberately — the default is the one that overwrites.
- Cloze notes need `#notetype:Cloze` and real `{{c1::…}}` markers; a cloze note with no marker imports as a note that generates **zero cards**.
- Import creates notes, not scheduling: everything arrives as new cards at the end of the new queue. Use Reposition if the order matters.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The setup directs the agent to persist user statements into local config and memory files without telling the user during the interaction that their preferences and habits may be stored. This creates a meaningful privacy and transparency issue because sensitive study habits, risk posture, exam dates, or tooling restrictions could be retained unexpectedly and influence later sessions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

Line L84 instructs the user to 'Pick one variety as the default for your deck,' which imposes a language/locale choice rather than explicitly offering equal user choice or opt-in at the skill level. This can conflict with language/locale policy expectations when a skill should avoid steering users toward one default locale without justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The setup instructs the agent to read local preference and memory files automatically on first use, without any user-facing notice or consent step. Even though the files are app-scoped and the intent is personalization, silent access to local persisted context is a privacy weakness because users may not expect prior notes or preferences to be loaded implicitly.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.