Security audit

Brief

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed brief-writing skill that keeps narrow local formatting preferences, with no evidence of hidden execution, exfiltration, or destructive behavior.

Install only if you are comfortable with the skill keeping local formatting preferences under ~/Clawic/data/brief/ and using ~/Clawic/profile.yaml for locale/timezone fallback. Review those files if brief style starts changing unexpectedly, and confirm any migration from older folders before moving data.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 80% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Content: Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.
md
- **At risk** — buffer being consumed; the first slip counts, no grace period - **Blocked** — cannot proceed without a named external action Declaring at-risk early is cheap. A green-to-red flip with no warning destroys trust in every future brief you send. (`status_scheme: rag` in config maps these 1:1 to Green/Amber/Red.) ### 8. Learn Only From Explicit Feedback "Too detailed" / "missing X" / "perfect" → one line in `~/Clawic/data/brief/preferences.md` with a level (`pattern`/`confirmed`/`locked`, promotion rules in `dimensions.md`). Check the file before writing any brief — a well-built brief in the wrong learned format still misses.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The configuration table specifies a default locale of en-US, which is a language/locale choice applied by default rather than through explicit user selection. The policy allows locale constraints when the user is offered a choice or when the constraint is clearly justified, neither of which is stated here.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The instructions direct the skill to read multiple local files and update configuration/preference files without any user-facing notice or consent workflow. Hidden access to local data is dangerous because it can violate user expectations, expose unrelated personal information, and normalize silent file operations in a skill that outwardly appears to only draft briefs.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The file specifies locale: en-US as a default and instructs the skill to use defaults without asking the user. This creates a language/locale policy concern because it imposes a specific locale absent explicit user choice or a documented reason for the constraint.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The setup explicitly instructs the skill to create and update persistent files under the user's home directory, which expands behavior from generating briefs into local state management. Even if intended for convenience, silent file writes can modify user data, create unexpected persistence, and increase the attack surface if later prompts influence what gets stored.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill is designed to record and learn user preferences in local storage based on user statements and reactions, creating a persistent behavioral profile beyond the immediate task. This is risky because inferred preferences may be stored without sufficiently explicit consent, and future interactions may be influenced by stale, incorrect, or privacy-sensitive data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill explicitly instructs the agent/user to move data from legacy paths into ~/Clawic/data/brief/, which is a filesystem modification. Even though this appears to be a migration convenience rather than malicious behavior, it can cause unintended file moves, overwrites, or user confusion if performed without explicit confirmation and safety checks.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.