ClawHub
Back to skill

Security audit

Canada

Security checks for vulnerabilities and agentic risk

Overview

This Canada travel skill is mostly a coherent travel guide, but it persistently stores personal trip details locally without clear consent, retention, deletion, or file-permission controls.

Before installing, decide whether you want this skill to keep a local travel profile. If you use it, avoid saving booking confirmation numbers, passport/payment details, exact absence-from-home plans, or sensitive accessibility and family details unless necessary, and periodically inspect or delete ~/canada/memory.md.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
setup.md:7
Finding

Unprotected Plaintext Persistence of Sensitive Travel and Booking Data

Content
View full analysis

Vulnerability Details

File Location: setup.md:7-25; related data schema in memory-template.md:13-21 and memory-template.md:48-51
Vulnerability Type: Plaintext sensitive-data storage without explicit consent, data minimization, retention controls, or permission hardening
Risk Level: Medium

Complete Code Snippet

From setup.md:7-25:

markdown
### 1. Create Memory Structure
```bash
mkdir -p ~/canada

2. Initialize Memory File

Create ~/canada/memory.md using the template from memory-template.md.

3. Gather Trip Context

Ask naturally (not as a form):

  • What month are you traveling? (season is critical in Canada)
  • How long is the trip?
  • Which cities or regions matter most?
  • What trip style fits best? (food, cities, nature, family)
  • Any mobility, dietary, or budget constraints?
  • Are you renting a car or using public transport?

4. Save to Memory

Update ~/canada/memory.md with their answers.

text

From `memory-template.md:13-21`:

```markdown
- **Travelers:** [solo / couple / family / group]
- **Kids:** [yes (ages) / no]

## Preferences
- **Travel style:** [foodie / city / nature / road-trip / family / nightlife / mixed]
- **Budget:** [budget / mid-range / luxury]
- **Dietary:** [none / vegetarian / vegan / gluten-free / other]
- **Mobility:** [full / limited / wheelchair]
- **Transport:** [public transit / rental car / mixed]

From memory-template.md:48-51:

markdown
## Bookings Made
| What | Where | Date | Confirmation |
|------|-------|------|--------------|
| | | | |

Technical Analysis

The setup procedure directs the agent to create and update ~/canada/memory.md when Canada travel is first discussed. The stored schema can include travel dates and destinations, children's ages, dietary information, mobility limitations, budget, and booking confirmation data.

This information is persisted in an ordinary ...[truncated 2370 chars]

Remediation
View remediation

Remediation Suggestions

  1. Require explicit consent before persistence

    • Explain which fields will be stored, where they will be stored, and why.
    • Default to session-only processing unless the user opts into long-term memory.

  2. Minimize collected data

    • Remove the booking Confirmation field.
    • Store children's broad age groups only when operationally necessary.
    • Avoid retaining detailed mobility, dietary, or budget information unless the user requests it.
    • Prefer approximate travel windows over exact dates when exact dates are unnecessary.

  3. Harden filesystem permissions

    • Create the directory and file with owner-only permissions.
    • On POSIX systems, use an equivalent of umask 077, directory mode 0700, and file mode 0600.
    • Do not claim equivalent protection on unsupported platforms without implementing platform-specific access controls.

  4. Add retention and deletion controls

    • Define a short default retention period.
    • Delete completed-trip details automatically or ask whether they should be retained.
    • Provide clear commands to inspect, edit, and erase all saved travel memory.

  5. Exclude secrets and authenticators

    • Explicitly prohibit storage of passwords, payment details, ticket barcodes, passport data, loyalty-account credentials, and complete booking references.
    • If a booking needs to be tracked, store a non-sensitive user-defined label instead of the operator's confirmation identifier.

  6. Document residual risk

    • Warn that plaintext local files may be included in backups or synchronization systems.
    • Clarify that local storage does not guarantee confidentiality from other software or accounts with filesystem access.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md
Be explicit about what to avoid:
- Any restaurant with giant wait and mostly social-media hype near main attractions
- Last-minute Banff parking attempts in July and August
- Paying premium prices for generic airport transfer options without checking rail or bus alternatives
- Underestimating drive times in mountain areas because map distance looks short

### 6. Match Trip Style

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

md
Be explicit about what to avoid:
- Any restaurant with giant wait and mostly social-media hype near main attractions
- Last-minute Banff parking attempts in July and August
- Paying premium prices for generic airport transfer options without checking rail or bus alternatives
- Underestimating drive times in mountain areas because map distance looks short

### 6. Match Trip Style

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs the agent to create a directory and persist user travel details to ~/canada/memory.md without any explicit user-facing notice, consent step, or explanation of what data will be stored. Even though the data is ordinary trip-planning context, it may include budget, mobility, and dietary constraints, so silent local persistence creates a privacy and transparency risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.