Azure

• Outcome: Review
• Latest audit: Jul 27, 2026 · 8:45 AM UTC
• Version: 1.0.2

Overview

This Azure skill is a disclosed local-notes and Azure-operations assistant; its persistence of cloud inventory and review records is sensitive but purpose-aligned and bounded.

Install only if you want the agent to keep local Azure operational notes under ~/Clawic/data/. Protect that directory like internal infrastructure documentation, review announced writes, and avoid pasting secrets unless you are comfortable with the skill replacing them with pointers. Destructive Azure operations are gated by explicit confirmation, but normal Azure reads and local record-keeping are part of the workflow.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Rogue Agent: Self-Modification, Session Persistence
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The skill explicitly instructs the agent to persist security-review artifacts and custom role data under local paths without first requiring user confirmation. In an agent setting, writing to local state can create unintended side effects, leak sensitive access-review details into persistent storage, or modify a user's workspace in ways they did not authorize.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: This instruction tells the agent to update tracking files such as `memory.md` and `## Due` with review dates and expirations, again without an explicit warning or confirmation about persistent modification. Even though the intent is operational hygiene, automatic writes to local files are risky in agent workflows because they can overwrite user data, create audit records the user did not want stored, or persist sensitive security metadata.

Missing User Warnings

Low

• Confidence: 94% confidence
• Finding: The file explicitly instructs the agent to write an architecture decision record to a fixed path under the user's home directory (`~/Clawic/data/azure/artifacts/decision-<name>.md`) and then modify `memory.md`, without any requirement for user confirmation. In an agent skill, this is risky because it authorizes persistent local file writes based on normal workflow text, which can lead to unintended modification of user files or silent persistence of agent-generated content.

Session Persistence

Medium

• Category: Rogue Agent

Content

Everything except artifacts, deploy records and the shared boxes begins inside `memory.md`. Splitting is a procedure, not a suggestion:

1. Before appending to a section, count its entries.
2. If the append would take it past **~15 entries or ~40 lines of real content** — scaffolding, headings and comments do not count — then, in the same turn: create the new file in `~/Clawic/data/azure/`, move the whole section into it, **delete the section from `memory.md`**, add its line to `## Boxes`, and append the new entry to the new file.
3. Keep the headings identical on both sides of the move, so the split is a copy-paste and never a rewrite.
4. Never leave a copy behind. If the same data ever appears in both places, the extracted file wins and the `memory.md` copy is deleted.

• Confidence: 78% confidence
• Finding: The template instructs persistent storage and reorganization of operational context across sessions, including infrastructure details, spend data, owners, due dates, and environment structure. Even though it excludes raw secrets, this creates a durable knowledge base of sensitive cloud metadata that could aid later misuse, expand blast radius after compromise, or retain stale sensitive context longer than necessary.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: memory-template.md:57