Security audit

Clients

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed local client-management skill that keeps client notes, contacts, projects, and commercial history on the user’s machine, with explicit rules not to store credential values.

Install only if you are comfortable with a local CRM-style system that records client names, work emails, rates, proposals, invoices, approval history, and relationship notes under ~/Clawic. Keep those folders private and backed up, do not paste credential values into them, and apply your own retention or legal-hold policy where it is stricter than the skill’s delete/update guidance.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The instruction directs the agent to create project and contact records in other data domains (`projects` and `contacts`) even though the skill metadata explicitly says those areas are out of scope. That creates unauthorized cross-skill side effects and can lead to writes in unrelated files without explicit user approval, increasing the chance of unintended data modification or privacy issues.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill directs the agent to record lead and client details into local files such as contact logs and memory stores, but it gives no warning, minimization rule, or consent check before storing potentially sensitive personal and business information. In a client-management skill, this can accumulate names, referral relationships, budget ranges, decision-makers, and engagement history in persistent storage, creating avoidable privacy and data-retention risk if the device, repo, or workspace is shared or later exfiltrated.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This instruction operationalizes broad persistence of lead, decline, roster, and contact information across multiple files, including reasons for decline and re-open conditions, without any privacy notice or safeguards. Because the skill is specifically about client relationship management, the data is likely to include commercially sensitive notes and identifiable contact information, making the context increase the likelihood and sensitivity of what gets stored.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill explicitly instructs the agent to persist changed client rates, payment terms, pricing policies, and scripts to multiple files without any requirement to confirm with the user before modifying stored data. In an agent setting, this can cause unauthorized or surprising state changes, corrupt records, or persist sensitive commercial information based on a conversational inference rather than explicit approval.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The file instructs saving winning proposals with prices to local artifact paths and updating multiple local records, but provides no warning, consent step, or data-minimization guidance before persisting potentially sensitive business information. In an agent context, this can cause silent storage of client names, pricing, and commercial details to disk, exposing confidential data and creating unnecessary retention risk.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The file explicitly instructs recording client contact history, referral outcomes, testimonial artifacts, and permission scope in multiple local records, but it provides no guidance on data minimization, retention limits, access controls, or lawful handling of personal/business data. In a client-management skill, this can lead users to persist identifiable client information and endorsements in ways that create privacy, confidentiality, or compliance risk, especially when testimonials and contact logs include names, dates, and business context.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The skill explicitly instructs the agent to read and maintain stakeholder contact records, including names, roles, channels, approval chains, and email-keyed entries, but provides no privacy guardrails, consent check, data-minimization rules, or handling restrictions. In a client-management skill, this increases the risk of over-collection, unnecessary persistence of personal data, and disclosure or misuse of stakeholder information across engagements.

Missing User Warnings

Medium

Confidence: 81% confidence
Finding: The instruction to delete a departed person's row from the contacts file encourages irreversible modification of stakeholder records without any warning about retention requirements, auditability, or accidental loss of business history. In a client-relationship context, deleting records can remove provenance needed for approvals, billing disputes, legal hold, or compliance, especially when personnel changes are operationally significant.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: memory-template.md:61