CEO / Chief Executive Officer

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:57 PM UTC
• Version: 1.1.6

Overview

This CEO advisory skill is not malware, but it saves sensitive company context locally without a clear opt-in or deletion/security controls.

Review this skill before installing if your CEO conversations include confidential financials, board issues, investor/customer names, personnel matters, or legal strategy. Use it only if you are comfortable with local plaintext files under ~/Clawic/data/ceo/, and consider manually inspecting or deleting those files after sensitive sessions.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: setup.md:21

Finding

Persistent plaintext storage of sensitive company information without explicit consent or security controls

Content

View full analysis

## Decisions Made ## Open Threads ## Pain Points ``` ### Technical Analysis The skill instructs the agent to persist confidential company information—including cash position, burn rate, headcount, board membership, major customers, investors, strategic restrictio ...[truncated 3539 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (8)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · acquisitions.md (reported line 50)May include surrounding context.

md

3. **Brand and customers**: what the customers of the acquired product are told, by whom, in the first 48 hours.

- Name one integration owner from your side, full-time, senior, for at least a quarter. Part-time integration ownership is why acquisitions drift.
- Day-one basics: systems access, payroll, benefits, email, and a clear statement about what is not changing. Anxiety in the first week produces the departures you spent the retention pool to prevent.
- Compensation and level mapping will be discovered by the acquired team within days. Decide it deliberately and explain the logic, or you import a permanent grievance.
- Kill the acquired roadmap explicitly if you are killing it. The team keeping faith with a dead roadmap is the most common quiet failure.

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · communication.md (reported line 68)May include surrounding context.

md

## Press and Public

- No off-the-record conversation with a journalist you do not have a track record with. "Off the record" is a norm, not a contract, and the rules differ per outlet.
- Decide what you would be comfortable seeing as the headline, then say only that. Journalists write from the most interesting sentence, not the main one.
- Correct facts, not framing (→ SKILL.md Quick Reference: crisis).
- Your employees read everything you publish. A public claim your own team knows is inflated costs you internal credibility first.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · memory-template.md (reported line 13)May include surrounding context.

md

last: YYYY-MM-DD

## Context
<!-- Company, stage, model, headcount, where they are in the cycle -->

## Decisions Made
<!-- Date, decision, owner, review date, falsifier — so nothing gets relitigated by accident -->

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · memory-template.md (reported line 19)May include surrounding context.

md

<!-- Date, decision, owner, review date, falsifier — so nothing gets relitigated by accident -->

## Open Threads
<!-- Live questions: the raise, the exec search, the pivot debate -->

## Pain Points
<!-- What keeps coming back: board friction, co-founder tension, a metric that won't move -->

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The instruction 'Hire a local operator' is a natural-language directive that favors a specific local identity/background rather than offering it as one option among several. This can create a locale-related policy concern because it prescribes a regional preference without documenting user choice, exceptions, or a compliance-based justification.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · memory-template.md (reported line 31)May include surrounding context.

Updated: YYYY-MM-DD

text

Company facts the user declares (cash, burn, board roster, key accounts, red lines) belong in `~/Clawic/data/ceo/company.md`, not here: memory is what you observed, `company.md` and `config.yaml` are what they declared. An observation never overwrites a declared fact without asking.

## Status Values

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill instructs the agent to read and persist potentially sensitive business data such as cash, burn, board members, investors, key customers, red lines, and risk posture into local files without any user-facing notice, consent flow, retention limits, or data minimization. In a CEO advisory context, this materially increases confidentiality risk because the stored information is highly sensitive and could expose strategic, financial, and personnel details if accessed by other tools, users, or future sessions.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown file instructs to create a CEO memory file but does not specify the triggering conditions, scope boundaries, or negative examples for when this template should be used versus other memory workflows. In a skill context, that lack of specificity can cause overly broad or unintended invocation for general note-taking or profile capture tasks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.