Clients

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:10 PM UTC
• Version: 1.0.2

Overview

The skill is a coherent local client-management system, but it automatically reads, writes, and deletes long-lived client records and uses user-derived file paths without enough validation or prior confirmation.

Install only if you want the agent to maintain local Clawic client records automatically. Treat the Clawic data folders as sensitive business records, review announced writes and deletions, keep backups, avoid storing secrets, and use safe generated slugs or validated relative paths for clients, projects, contacts, artifacts, and configuration file references.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: `; overrides ad-hoc pricing in proposals | | voice_file | path | none | How the user writes to clients (register, length, sign-off) at `~/Clawic/data/clients/<file>`; overrides the default plain register in every draft | ``` `memory-template.md:21`: ```markdown | **Anything durable this table does not name** | `~/Clawic/data/clients/<plural-noun>.md`, or `artifacts/<kebab-name>.md` if it is a long text read whole | Name the file after what it holds, never after when it was made; add its `## Boxes` line in ...[truncated 3834 chars]:30

Finding

Unsanitized Dynamic File Paths Can Escape Declared Storage Boundaries

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:30-34, SKILL.md:152-153, memory-template.md:21, memory-template.md:196, memory-template.md:202, memory-template.md:235, memory-template.md:256, and memory-template.md:286
Vulnerability Type: Path traversal through unvalidated names, paths, and index entries
Risk Level: Medium

Vulnerable Code Snippets

SKILL.md:30:

markdown

**Data.** At the start of every session, read `~/Clawic/data/clients/config.yaml` (what the user declared) and `~/Clawic/data/clients/memory.md` (what you observed, plus its `## Boxes` index and its `## Due` table). Open any file `## Boxes` names the moment the condition written on its line applies — that index *is* the list of files; never work from a list of names memorised here, because most boxes are created after this skill was written.

SKILL.md:34:

markdown

Table until ~15 people; past that, one file per person at `~/Clawic/data/contacts/<name>.md`, with `contacts.md` left as the index.
...
Every engagement with a start, an end and milestones goes to `~/Clawic/data/projects/<project>.md`, one file from the first, identified by the project name;

SKILL.md:152-153:

markdown

| rate_card_file | path | none | Long-form rates and packages at `~/Clawic/data/clients/<file>`; overrides ad-hoc pricing in proposals |
| voice_file | path | none | How the user writes to clients (register, length, sign-off) at `~/Clawic/data/clients/<file>`; overrides the default plain register in every draft |

memory-template.md:21:

markdown

| **Anything durable this table does not name** | `~/Clawic/data/clients/<plural-noun>.md`, or `artifacts/<kebab-name>.md` if it is a long text read whole | Name the file after what it holds, never after when it was made; add its `## Boxes` line in the same turn |

memory-template.md:196:

markdown

- **Scale cut**: one row per person while there are ≤15. Past that, one file per person at `~/Clawic/data
...[truncated 3554 chars]

Remediation

View remediation

Remediation Suggestions

1. Convert all client, project, contact, and artifact names into generated slugs using a strict allowlist such as [a-z0-9-].
2. Reject absolute paths, .. path segments, directory separators in names, null bytes, and Unicode control or bidirectional characters.
3. Resolve every target to its canonical path before each read, write, move, or deletion.
4. Verify that the canonical target remains beneath an explicitly approved root, such as:
   • ~/Clawic/data/clients/
   • ~/Clawic/data/contacts/
   • ~/Clawic/data/projects/
5. Reject symlinks whose resolved targets escape the corresponding approved root.
6. Restrict rate_card_file, voice_file, and ## Boxes values to validated relative paths rather than arbitrary paths.
7. Store stable generated identifiers separately from display names so attacker-controlled names never become filesystem paths.
8. Require explicit user confirmation before deleting shared contact or project records.
9. Add negative tests for absolute paths, traversal components, mixed separators, encoded traversal, Unicode separators, and symlink escapes.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · difficult-clients.md (reported line 93)May include surrounding context.

md

- One reason, or none. "It isn't the right fit for how I work" is complete and unanswerable.
- Never itemise their failings, even when invited to. Nothing good comes of it and it will be forwarded.
- Offer a referral only if you would genuinely make it. Sending a difficult client to a peer without warning them costs you a peer.
- Never exit in the message where you are angry. Write it, wait a night, send it in the morning (SKILL.md Traps).

## Afterwards

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 85% confidence

Finding

Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Content

Scanner excerpt · pipeline.md (reported line 87)May include surrounding context.

md

> "I'm not the right fit for this one — the budget and the scope are far enough apart that I'd be setting us both up to be disappointed. If the scope tightens or the budget moves, I'd be glad to look again. In the meantime, [name] does this kind of work well."

Never decline by going quiet, never decline with a fake reason a mutual contact can disprove, and never counter-offer a discount in the same message as the decline.

**Write before you move on:** every lead gets a row in `## Pipeline` in `memory.md` (or `~/Clawic/data/clients/leads.md` once it has split out) with its source, stage, estimated value and next date; a decline gets its row in `## Declined Leads` with the reason and the re-open condition; a discovery call gets its entry in `contact-log/<client-slug>.md`; a lead that converts gets its roster row and its people written into `~/Clawic/data/contacts/contacts.md`. A pipeline held in the user's head is the thing this skill exists to replace.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill explicitly instructs recording detailed client interaction history and a client's 'Health' status in persistent files without any guidance on data minimization, lawful basis, access controls, or handling of sensitive personal data. In a client-management workflow, this can lead users to store health-related personal information in plain operational notes, increasing privacy, compliance, and unauthorized disclosure risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The instruction to read receivables data "at the start of any money conversation" does not clearly bound when this skill should activate versus when ordinary discussion of budgets, pricing, or finances should not invoke it. The file does not provide explicit trigger phrases, exclusions, or negative examples to narrow the scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The instruction to delete a paid invoice's receivables row can remove historical audit trail and collections evidence from the operational record. If followed blindly, it may impair reconciliation, dispute resolution, bad-debt analysis, or compliance expectations, especially when the same file is also used to track chase history and payment behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs the agent to read and use persistent client memory and contact records that likely contain personal and commercially sensitive information, but it provides no warning, consent check, or data-minimization guidance. In an agent setting, silently consulting prior records can expose sensitive lead history and cause the system to process personal data beyond what the user expects for the current task.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instruction to record discovery-call details into a persistent client history creates a retention and profiling risk, especially because calls may contain sensitive business information and personal contact details. Without disclosure, retention limits, or approval, the agent may store more information than necessary and create an audit trail the user did not intend to maintain.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This section directs broad, routine updates across multiple persistent files for leads, declines, roster entries, and contacts, but does not warn that the agent will modify long-lived records containing personal and business data. That increases the chance of unauthorized data accumulation, incorrect record creation, and privacy-impacting writes that outlast the immediate interaction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly instructs the agent to write changed pricing, payment terms, configuration values, and scripts to persistent files in the same turn, but it does not require user confirmation before modifying those records. In an agent setting, this can cause silent state changes that alter future pricing behavior, client records, and commercial policy based on a single prompt, including mistaken or adversarial user input.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instruction at the end of the skill tells the agent to create project, roster, memory, pipeline, and contact records after a proposal win, which expands beyond proposal drafting into unrelated data-management actions. This is risky because it can cause unauthorized cross-skill side effects, write personal/contact data into other stores, and make durable changes the user did not explicitly request in the current interaction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill directs several persistent file writes and record updates in the same turn, including saving proposal artifacts and modifying memory, pipeline, project, and contact files, without requiring a user-facing warning or confirmation. In an agent setting, silent multi-file writes are dangerous because a routine content-generation request can unexpectedly alter business records, create duplicate or incorrect entries, and persist sensitive information without review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill instructs users to record renewal outcomes, contact history, referral sources, and testimonial permission scope in multiple files, which can include sensitive client relationship and business information. In a client-management skill this is contextually relevant, but the lack of any guidance on minimization, access controls, retention, or redaction creates a real risk of oversharing or insecure storage of confidential data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly instructs reading and updating stakeholder contact records in shared files before meetings, but provides no privacy guardrails, data minimization limits, consent expectations, or handling rules for sensitive business contact data. In a shared agent workspace, this can lead to over-collection and broad persistence of identifiable stakeholder information beyond what is necessary for the task.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file directs the agent to collect and maintain detailed person-level stakeholder data from meetings in shared persistent files, including approval chains and organizational influence. This materially increases privacy and confidentiality risk because it centralizes sensitive relationship intelligence that may exceed operational necessity and could be exposed to other users or later tasks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The instruction to delete a departed person's row while preserving departure details elsewhere creates data lifecycle actions without any audit, retention, or governance guidance. That can cause either improper deletion of records needed for accountability or continued shadow retention of personal history in memory files without clear purpose or user awareness.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The workflow requires deleting and replacing a person's contact row while preserving departure and replacement details in another persistent file, reinforcing longitudinal tracking of individuals across role changes. This creates unnecessary person-history retention and increases the chance of privacy leakage, inaccurate records, or covert profiling of stakeholder movements.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The broad instruction to record every learned person, role, channel, decision relationship, scope change, and approval detail into multiple persistent logs encourages comprehensive surveillance-style accumulation of stakeholder and project metadata. In context, this expands the blast radius of any workspace compromise and increases misuse risk because sensitive internal politics and contact data are replicated across several files.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · proposals.md (reported line 46)May include surrounding context.

md

Longer than feels comfortable, and it is the section clients read most carefully. It protects them too: the exclusion is where they discover they needed something, while there is still time to buy it.

Standard candidates: content and copy, photography and licensing, third-party subscriptions and their costs, hosting, translation, accessibility remediation beyond the stated standard, training, post-launch support, work on systems you cannot access, anything requiring a stakeholder who has not been named, and rush work outside agreed hours.

Each exclusion gets a price or a "quoted separately". An exclusion with no route to buying it reads as a refusal; an exclusion with a price reads as a menu.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: memory-template.md:61