T09 · Insecure Skill Coding Practices
Warning
- Location
setup.md:11- Finding
Automatic Plaintext Persistence of Sensitive User Context Without Explicit Consent
- Content
View full analysis
## Family ## Concerns- Remediation
View remediation
Security audit
Beijing
Security checks for vulnerabilities and agentic risk
Overview
This Beijing guide is not malicious, but it needs Review because it tells agents to keep sensitive relocation and family details in plaintext local memory without clear opt-in or deletion controls.
Review before installing if you do not want a skill to remember local details about your Beijing move or trip. Consider asking the agent not to save family, school, visa, home, health, or household-worker details, and periodically inspect or delete files under ~/Clawic/data/beijing/. The package did not show code execution or exfiltration behavior, but its memory behavior should be made explicit and user-controlled.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (26)
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 85% confidence
- Finding
Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.
- Content
md **Drinking etiquette:** - "干杯" (gān bēi) = "empty glass" — finish your drink - Don't refuse toasts from elders/hosts - Use both hands when toasting seniors - It's OK to sip if you explain you can't handle it
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The natural-language instruction says to "Assume zero English" and prescribes an "English mode" toolkit as the default. This imposes a specific language/locale framing rather than offering language choice or making it conditional on the user's preferences.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file explicitly instructs storing household staffing details and schedules in a local memory file, which encourages persistence of sensitive personal data about domestic workers and family routines without any minimization, consent, retention, or access-control guidance. In the context of a family-life skill, this data can reveal home occupancy patterns, childcare arrangements, and identifying information that could enable privacy harm, stalking, or targeted social engineering if the memory store is exposed.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The guidance encourages eating from street vendors and frames illness risk casually with advice like using busy stalls and allowing time for 'local bacteria' adjustment, but it does not clearly warn that foodborne illness can still occur even at popular stalls. In a travel/relocation skill, users may rely on this as practical safety advice, so understated hygiene risk can lead to preventable gastrointestinal illness or other foodborne infections.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The guide tells users to undergo biometric registration and provide identity documents as part of SIM setup, but gives no warning that this involves collection of sensitive personal data subject to retention, sharing, and misuse risks. In a relocation/travel skill, users are likely to follow these steps directly, so omission of privacy and safety guidance can lead to unnecessary exposure of passport and biometric data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The WeChat Pay setup instructions direct users to upload a passport photo and possibly complete video verification without disclosing the privacy, identity-theft, or account-takeover risks of submitting sensitive KYC materials. Because this skill is operational guidance for foreigners setting up daily life in Beijing, users may treat it as trusted onboarding advice and share highly sensitive identity data without understanding the consequences.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
Lines L198-L205 instruct users to avoid protests, political organizing, discussing sensitive topics publicly, and criticizing the government online. This is a natural-language locale/policy constraint that suppresses political expression without framing it as optional user preference or clearly limiting it to a narrowly justified compliance context.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Lines L272-L289 tell users to avoid discussing or sharing named political topics and to avoid political groups, which constitutes a natural-language policy limitation on subject matter. The file does not present this as a user-selectable preference or as a narrowly justified organizational compliance requirement.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs the agent to read persistent user profile and memory files containing prior context and preferences without any user-facing disclosure or consent flow. This creates a privacy risk because sensitive personal data may be accessed across sessions unexpectedly, especially given the travel/relocation context where visa status, family details, and location data may be stored.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The instructions direct the agent to write user preferences and durable personal context to persistent files during normal conversation, but do not tell the user this retention is happening. This is dangerous because it silently creates a long-lived profile of sensitive attributes such as district, budget, family situation, school information, visa type, and employer area.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly tells the agent to persist user-provided personal context across sessions in memory/config files. In this skill's context, that data can include relocation stage, home base, children, school, visa type, and household arrangements, making the persistence more privacy-sensitive and increasing the chance of unintended profiling or later misuse.
- Content
YARA rule 'network_reconnaissance': Network reconnaissance and scanning patterns [hacktools]
Medium
- Category
- YARA Match
- Confidence
- 65% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md top engineers | | **VC concentration** | Most major China VCs headquartered here | | **Government support** | Zhongguancun policies, subsidies | | **Tech giants** | ByteDance, Baidu spin-offs, alumni network | | **Market access** | 22 million local population | | **Political center** | Government relationships matter | ### Challenges | Factor | Reality | |--------|---------| | **Competition** | Fierce for talent, funding, customers | | **Costs** | Higher than other cities | | **Bureaucracy** | Complex regulations | | **Language** | Most business in Chinese | | **Work culture** | 996 expectations common | --- ## 💰 Funding Landscape ### Stage Overview (2025) | Stage | Typical Range (¥) | Typical Range (USD) | |-------|-------------------|---------------------| | Angel/Pre-seed | 500K-5M | $70K-700K | | Seed | 5M-20M | $700K-2.8M | | Series A | 20M-100M | $2.8M-14M | | Series B | 50M-300M | $7M-42M | | Series C+ | 200M+ | $28M+ | ### Top Beijing VCs | Firm | Stage Focus | Nota
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The natural-language statement says 'Written contract — Mandatory, Chinese required,' which imposes a specific language requirement. While this may reflect local practice, the document does not explain that this is a jurisdiction-specific legal requirement or offer any clarification, so it appears as an unqualified language-policy constraint.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
Line L048 describes Pleco as "non-negotiable," which is a natural-language directive rather than a neutral recommendation. While this is not a severe violation, it does impose a specific language/tool choice without presenting it as optional or user-selected.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
SQP-3 applies to all file types and covers language or locale policy violations in natural language. This line presents English availability as a default characteristic rather than offering language choice or framing it neutrally, which may conflict with organizational expectations around language neutrality.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
Several sections prioritize 'English-speaking' facilities and repeatedly evaluate providers by English availability, which can amount to a language preference embedded in the skill content. Because the document does not explicitly state that it is intended for users seeking English-language care or offer alternative language preferences, this can be viewed as a locale/language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
These lines explicitly prioritize English-language resources and note that Chinese platforms 'assume Mandarin,' while elsewhere the file centers 'native-English' qualifications. As written, the guidance is framed around English-speaking users and does not offer language/locale choice or state that the document is intentionally limited to English-speaking foreign applicants.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This markdown file directs the skill to create
~/Clawic/data/beijing/memory.md, which is a filesystem write affecting user data. The description does not include any warning or disclosure that the skill will create or modify files in the user's home directory.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The section rates neighborhoods by 'English Support' and frames recommendations around English-speaking users, which imposes a language-specific perspective without explicit user opt-in or a documented locale justification. This can conflict with a policy requiring language or locale choices to be offered rather than assumed.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
Line L254 instructs users to greet neighbors using Chinese ("早上好") as the default phrasing. Because the document does not frame this as optional or offer language alternatives, it can be read as forcing a specific language/locale choice without user opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
Lines L114-L124 rank neighborhoods by 'English Friendliness', which centers a specific language preference in the guidance. Because the file does not state that this is optional or intended specifically for English-speaking users, it can be read as enforcing an English-language lens without user opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
This markdown file is entirely written in English and does not indicate any user language selection, opt-in, or justification for restricting output to that language. Under the stated policy, forcing a specific language without user choice can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The instruction 'Do not interview the user' is a natural-language constraint that prevents normal preference elicitation unless narrowly blocked. While not a language restriction, it imposes an interaction policy that may conflict with user choice by requiring inference instead of asking.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The document is explicitly framed as guidance for 'Beijing Expat Taxes' and 'Individual income tax for foreigners,' which imposes a specific locale/jurisdiction context throughout the skill. Under the policy, locale constraints should either be optional for the user or clearly justified as region-specific; this file does not explicitly present itself as a region-scoped skill with opt-in or limitation language beyond the title.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
This markdown file contains a natural-language locale instruction that pushes a specific language setting as the default behavior. Under the policy, forcing a specific language without user opt-in can be a locale-policy violation, and this line does not present English as an optional preference.
- Content
Static analysis
No suspicious patterns detected.