ClawHub
Back to skill

Security audit

Austin

Security checks for vulnerabilities and agentic risk

Overview

This is a mostly static Austin guide, but it asks the agent to persist personal relocation context and modify memory without clear controls.

Review the memory behavior before installing. Only use it if you are comfortable with Austin-related personal context such as budget, role, timeline, and neighborhood preferences being saved locally, and verify legal, tax, housing, school, safety, and current-price guidance from official or professional sources.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (16)

Hidden Instructions

High
Category
Prompt Injection
Confidence
83% confidence
Finding

The HTML comments act as hidden operational instructions that shape what the agent should collect about the user, including role, timeline, budget, neighborhoods, and preferences. Hidden collection guidance is risky because it encourages unobvious profiling and persistence of personal context outside a transparent user-visible policy.

Content

Scanner excerpt · memory-template.md (reported line 15)May include surrounding context.

md
integration: pending | done | declined

## Context
<!-- What you know about their Austin situation -->
<!-- Role: visitor, relocator, resident, tech worker, etc. -->
<!-- Timeline: when visiting, when moving, how long there -->
<!-- Budget: housing range, lifestyle expectations -->

Session Persistence

Medium
Category
Rogue Agent
Confidence
93% confidence
Finding

The instruction to create ~/.austin/memory.md establishes cross-session persistence of user data in local storage. Without consent, scoping, or lifecycle controls, this can retain personal details across interactions and expose them to unintended reuse or access by other components.

Content

Scanner excerpt · memory-template.md (reported line 3)May include surrounding context.

Memory Template — Austin

Create ~/.austin/memory.md with this structure:

markdown
# Austin Memory

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The template directs the agent to create and continually update a persistent user memory file, but it provides no user-facing disclosure, consent flow, retention limits, or controls over what personal information is stored. In a skill about relocation and local guidance, this can accumulate sensitive behavioral and lifestyle data over time without the user's awareness.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The neighborhood matrix makes categorical 'Best Areas' and 'Avoid' judgments tied to schools, diversity, nightlife, and community traits without clear sourcing or nuance. In a relocation guidance skill, this can steer users away from specific places in ways that encode bias or proxy discrimination, especially where recommendations intersect with family status, schools, and 'diverse community' framing.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The family-oriented profile advice uses broad exclusionary statements such as avoiding Downtown for 'no space' and Deep East Austin for 'schools,' which can function as overgeneralized steering. Because the skill is explicitly helping people choose where to live, unsupported area exclusions in family/school contexts are more sensitive and can contribute to discriminatory housing guidance.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The Westlake section uses value-laden, exclusionary framing such as 'wealthy enclave,' 'exclusive,' 'old Austin money families,' and 'prestige address,' which can steer users toward or away from areas based on socioeconomic signaling rather than neutral housing factors. In a relocation/neighborhood guidance skill, this is risky because it can normalize discriminatory or biased housing guidance and create policy, compliance, or reputational issues.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The trigger text says the skill should be used when the user asks about 'Texas or Austin,' which is broader than the skill's Austin-focused scope and can cause unintended invocation in unrelated Texas contexts. Over-broad activation increases the chance of unnecessary memory prompts, irrelevant guidance, or skill takeover when another specialized skill should handle the request.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly instructs the agent to modify the user's MEMORY.md and only phrases this as a casual question, without clearly disclosing that it is a persistent write to user data. This creates a consent and transparency issue: users may agree without understanding the durability and scope of the stored information, and the agent is being directed to alter long-lived state outside the immediate task.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill directs the agent to accumulate user-specific profile details over time, including profession, budget, transportation access, and neighborhood preferences. Persisting this longitudinal personal data in plain language expands privacy risk, enables profiling beyond the immediate request, and may retain sensitive lifestyle and financial information longer than necessary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The phrase "Bar hopping (one drink max)" normalizes riding scooters after alcohol consumption and does not clearly warn users to avoid riding entirely if they have been drinking. In a travel/transportation skill, users may treat this as practical safety guidance, increasing the risk of injury, legal issues, or harm to others.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

The document gives concrete guidance on business formation, taxes, payroll, worker classification, and licensing without clearly stating that it is not legal, tax, or financial advice. Users may reasonably rely on it as authoritative and make compliance decisions based on incomplete, outdated, or jurisdiction-specific information, increasing risk of legal, tax, or employment mistakes.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
0% confidence
Finding

After reviewing the markdown content, there is no language-forcing instruction, opt-out suppression, or other natural-language organizational policy violation. The file is informational and locale-specific by topic rather than by mandated user language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The section titled 'Austin Food Rules' tells the user what they must do using commands like 'Eat them', 'Accept this', and 'Participate'. This natural-language framing imposes a behavioral norm rather than presenting optional guidance, which can be read as forcing a specific preference or cultural practice without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The statement '"Y'all" is standard vocabulary' prescribes a regional language norm in natural language. Under the locale/language policy, content should avoid forcing or implying a required language style unless it is optional or clearly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The phrase "Pronounced 'Flugerville' — test for newcomers" imposes a pronunciation expectation and frames it as a social test, which can pressure users into conforming to a specific linguistic norm without consent. In a city-guide skill, this is not a technical exploit, but it can reinforce exclusionary or gatekeeping behavior toward newcomers or non-local speakers.

Content

No source excerpt is available for this finding.

Ssd 3

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill asks to record both activation of the skill and a persistent 'integration: declined' state in MEMORY.md. Storing a durable decline marker without strong disclosure is still a persistent write about user preference state, and it may bias future agent behavior based on a one-time response.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.