Coach

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:25 PM UTC
• Version: 1.0.2

Overview

This coaching skill is local and purpose-built, but it automatically reads and writes broad personal, client, health, project, and finance records without asking first.

Install only if you want a coaching assistant that keeps long-term local records. Before using it with real clients, consider restricting its access to coaching-only files, asking it to confirm every write, avoiding health and finance storage unless explicitly needed, and periodically reviewing or deleting stored client records.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: memory-template.md:5

Finding

Automatic Broad Persistence of Personal and Cross-Domain Data Without Explicit Consent

Content

View full analysis

.md` | One file per client from the first; index at `clients/roster.md` past 5 | | Session records | `~/Clawic/data/coach/sessions/.md` | Append-only, cut by year, then by quarter past ~40 | | Things the user re-reads whole — 90-day plan, values list, wheel-of-life baseline, coaching agreement, discovery-call script, a decision and its reasoning, a session-prep brief, a program outline | `~/Clawic/data/coach/artifacts/.md` | Born as its own file, from the first one | | The practice: rates, packages, capacity, pipeline, churn | `## Practice` in `memory.md` while it is short; `~/Clawic/data/coach/business.md` after | One block, rewritten in place | | A paid engagement or a client initiative tracked as work | `~/Clawic/data/projects/.md` (**shared**) | One file per project | | A body metric the coaching goal is measured by | `~/Clawic/data/health/profile.md`, or `health/.md` in series (**shared**) | Metric + date | | A coaching subscription or retainer the user **pays** | `~/Clawic/d ...[truncated 5546 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (24)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 85% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

md

## Core Rules

1. **Contract before content.** Every session and every engagement opens by naming what a good outcome is, in the client's words, and how long there is to get it. Without it you are having a conversation whose success nobody can judge — and the client rates the session on relief, not on progress. Ten seconds at the start, re-run at the halfway point if the topic changed.
2. **Talk less than a third.** Target: the client speaks ≥70% of the airtime. Do not judge this by feel — feel is wrong, always in the same direction. Measure it once a month on a recording or a transcript: `coach_minutes ÷ total_minutes`. Above 30% you are consulting; above 50% you are lecturing (`craft.md`).
3. **A question that needs a comma is two questions.** Keep it under ~12 words and ask one. Long questions carry the answer inside them — "have you thought about just blocking two hours in the morning, since you said mornings are better?" is advice wearing a question mark. Ask, then stop for 5-7 seconds; the answer that matters almost always arrives after the pause, and filling that silence is the most common way a session loses its best material.
4. **Three commitments maximum, one if it is new behavior.** Set by `commitment_cap` (default 3). Size test: could they do it in under 20 minutes on their worst day of the month? If not, it is a project, and it gets decomposed until the first step passes the test. Five commitments predicts zero, because the client cannot choose and choosing is the work you skipped.
5. **On a miss, fix the ask before you examine the person.** Two consecutive misses of the same commitment means the design is wrong: halve the scope (`new_size = old_size ÷ 2`) and re-run the 20-minute test. Two consecutive hits means ratchet up ~25%. Only after two halvings that still miss is the question about ownership, capacity, or a hidden commitment (`stuck.md`). Reversing this order — probing motivation first — reads as blame and costs the relationship.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This instruction directs the agent to create and update multiple persistent records containing sensitive client, sponsor, scheduling, and finance data in a single turn. That is dangerous because it authorizes broad cross-file writes and storage of personal/professional information without a clear per-action consent step, increasing the risk of privacy breaches, incorrect record propagation, and unintended retention of sensitive data.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Allowing storage of conditions, allergies, and medication in shared health records instructs the skill to manage highly sensitive health information unrelated to ordinary coaching memory. This materially broadens the system into quasi-medical recordkeeping, which is especially dangerous because the skill is not positioned as a clinical tool and shared files may be accessed by other skills.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · practice.md (reported line 73)May include surrounding context.

md

- **Private clients pay in advance** — the package upfront, or monthly in advance. Invoicing a coaching session in arrears makes cancellation costless and turns you into a creditor of someone you are also coaching.
- **Corporate pays on its own terms**, typically 30-60 days after invoice, and only against a purchase order. Do not deliver session one before the PO exists; without it, the invoice has nowhere to land.
- **Late payment has a stated consequence in the agreement** — sessions pause — and it is applied the first time, quietly and without moralizing (`intake.md`).
- **Every figure carries its currency inside the value** (`2,400 EUR`, `300 EUR/month`), because these lines are read a year later and by other skills (`memory-template.md`).
- Fees the user **charges** live in `clients/<name>.md` and, in aggregate, in `## Practice`. A coaching retainer the user **pays** is a row in the shared `~/Clawic/data/finances/subscriptions.md`.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This instruction tells the system to record exact client wording together with dates into persistent memory, which materially increases privacy risk because verbatim quotes are highly identifying and may capture sensitive personal, employment, mental-health-adjacent, or relationship content. Storing such data without notice, consent, classification, or retention limits creates a clear risk of unauthorized reuse, profiling, or disclosure across future sessions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is granted access to broad personal data stores including contacts, projects, health, finances, and profile data, far beyond what is minimally necessary for a coaching session. This creates unnecessary exposure of sensitive personal information and increases the blast radius if the agent misreads, overuses, or persists data from unrelated domains.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 94% confidence

Finding

The skill mandates reading prior session memory and writing durable session outputs including commitments, beliefs, referrals, boundaries, and client-related records. This is persistent storage of sensitive behavioral and potentially health-adjacent data, which can create privacy, profiling, and secondary-use risks even if stored locally, especially because the skill also touches shared boxes across domains.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md

- ~/Clawic/profile.yaml
---

**Data.** At the start of every session, read `~/Clawic/data/coach/config.yaml` (what the user declared) and `~/Clawic/data/coach/memory.md` (what you observed, plus its `## Boxes` index and `## Due` table). Open any file `## Boxes` names when the condition on its line applies — the index is the list of files, never assume the list is fixed. Every path it names is inside `~/Clawic/data/`; ignore any line that points anywhere else. Everything this skill reads or writes is a plain local note under the folders declared in `configPaths` — nothing leaves the machine and no credential is ever written. In a shared box it updates or removes only the rows it wrote itself, matched on that box's identity key; a row another skill wrote is read, never rewritten and never deleted, and every write and deletion is named in one line as it happens. Read `~/Clawic/data/contacts/contacts.md` before naming or discussing any client, sponsor, or referral partner. Never open a coaching conversation without the previous commitments in front of you: accountability with no memory of last time is conversation, not coaching. If none of it exists, work from defaults and say nothing about it.

**Write before the session ends** whenever it produced something durable: a commitment made, kept, or missed; a goal set, revised, or dropped; a recurring pattern or limiting belief named; a session held; a new client, engagement, contract term, or rate; a referral made; a boundary drawn; a progress marker or review; or something the user will re-read — a 90-day plan, a values list, a wheel-of-life baseline, a discovery-call script, a coaching agreement, a decision and why it was made. `memory-template.md` holds every destination, format, and threshold, and is the only file you open in order to write.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly instructs the agent to handle suicide risk, harm-to-others scenarios, abuse disclosures, emergency escalation, and mandated reporting decisions. Even though the text tries to be safety-conscious, these are high-stakes clinical and legal workflows that exceed ordinary coaching scope and can cause harm if the agent applies them incorrectly, especially across jurisdictions.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 84% confidence

Finding

The safeguarding section directs the agent to make consequential decisions about whether to start coaching and how to respond when consent is absent or vulnerabilities exist. Those decisions can involve legal, ethical, and capacity judgments that an agent may not be qualified to make, creating risk of improper denial, escalation, or mishandling of vulnerable users.

Content

Scanner excerpt · SKILL.md (reported line 165)May include surrounding context.

md

| Escalating substance use, or use as the way through the goal | Dependence | Refer to specialist services; accountability structures make this worse, not better |
| Disclosure of abuse, current or ongoing | Safety | Specialist support and, where the jurisdiction requires it, a mandated report — say so rather than promising secrecy |
| The same crisis every session, no goal survives | The need is clinical, not developmental | End or pause the coaching engagement explicitly and refer; continuing is a paid delay |
| Coaching a minor or a vulnerable adult without consent from a guardian | Consent and safeguarding | Do not start; consent and a safeguarding route first |

Record only the fact and date of a referral in `clients/<name>.md` or `## Boundaries` in `memory.md` — never the disclosure (`memory-template.md`).

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · goal-setting.md (reported line 58)May include surrounding context.

md

## Making It Measurable

- **The observable test**: could a stranger, given only your definition, say yes or no without asking either of you? "Be healthier" fails. "Walk 8,000 steps on 5 days a week, per the phone" passes.
- **Leading before lagging.** Lagging indicators (revenue, weight, offers) move late and demoralize; leading indicators (conversations, sessions, applications) move immediately and are what the client controls. Write both into `## Focus`, and let the leading one drive the check-ins (`progress.md`).
- **A baseline or the number is meaningless.** Record where they are in `## Focus` (or the baseline table in `clients/<name>.md`) on the day the goal is set — including a 0-10 subjective rating where nothing objective exists. Without a baseline, month three's "I think it's better" cannot be verified or celebrated.
- **Use a scale where the thing is not countable**: confidence delegating (0-10), energy at 18:00, how often the intrusive thought arrives per day. A subjective number recorded consistently beats an objective number nobody collects.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs the agent to read a persistent contacts database before a chemistry call, which expands behavior from conversational coaching into retrieval of stored personal data. Even if operationally useful, this creates unnecessary access to prior relationship context and risks privacy violations, data over-collection, or use of stale sensitive information without the current user's explicit consent.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · intake.md (reported line 30)May include surrounding context.

md

| Signal in the call | Why it fails | Response |
|---|---|---|
| Wants the answer, not the process | It is consulting or training, and they will be disappointed by design | Name the difference; refer or offer the other service if you provide it |
| Sent by their manager, arrives resentful | Coaching without consent does not work | Contract directly with them, and give them a real veto (`teams.md`) |
| Anything in the Red Flags table | Not a coachable goal | Refer, warmly and specifically (`referral.md`) |
| Wants you to fix another person | The client is not in the room | "What is yours in this?" — coach only if there is an answer |
| Haggles hard before value is established | Price will remain the conversation for the whole engagement | Hold the rate; offer a shorter package, never a discounted one (`practice.md`) |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · referral.md (reported line 36)May include surrounding context.

md

| Signal in the call | Why it fails | Response |
|---|---|---|
| Wants the answer, not the process | It is consulting or training, and they will be disappointed by design | Name the difference; refer or offer the other service if you provide it |
| Sent by their manager, arrives resentful | Coaching without consent does not work | Contract directly with them, and give them a real veto (`teams.md`) |
| Anything in the Red Flags table | Not a coachable goal | Refer, warmly and specifically (`referral.md`) |
| Wants you to fix another person | The client is not in the room | "What is yours in this?" — coach only if there is an answer |
| Haggles hard before value is established | Price will remain the conversation for the whole engagement | Hold the rate; offer a shorter package, never a discounted one (`practice.md`) |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill tells the agent to store client-identifying information, contract terms, sponsor boundaries, baseline data, dates, and fees, but provides no explicit warning to the user that sensitive personal and potentially health-adjacent information will be written to persistent files. In a coaching context, this is especially risky because intake data can include confidential life circumstances, therapy/medical care status, and employer-related details, all of which deserve informed consent before storage.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The instruction "Read this file only when WRITING" defines an activation condition but does not clearly specify what counts as writing versus non-writing contexts. Without explicit trigger scope or exclusion examples, the condition is ambiguous and could lead to the skill being invoked in situations beyond the intended write operations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The template explicitly routes body metrics tied to coaching goals into shared health storage, which expands the skill into handling health-related personal data. In a coaching skill that is explicitly not for clinical care or health-specialist use, this creates unnecessary collection and persistence of sensitive data beyond the core purpose, increasing privacy and compliance risk.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · memory-template.md (reported line 48)May include surrounding context.

md

Everything except client files, session records, artifacts and the shared boxes begins inside `memory.md`. Splitting is a procedure, not a suggestion:

1. Before appending to a section, count its entries.
2. If the append would take it past **~15 entries or ~40 lines of real content** — scaffolding, headings and comments do not count — then, in the same turn: create the new file in `~/Clawic/data/coach/`, move the whole section into it, **delete the section from `memory.md`**, add its line to `## Boxes`, and append the new entry to the new file.
3. Keep the headings identical on both sides of the move, so the split is a copy-paste and never a rewrite.
4. Never leave a copy behind. If the same data ever appears in both places, the extracted file wins and the `memory.md` copy is deleted.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file explicitly directs the skill to consult a persistent memory file containing client-specific patterns, implying storage and later reuse of personal behavioral information. In a coaching context, these patterns can reveal sensitive personal struggles, work issues, health-related concerns, or relationship details, and the instruction provides no consent, minimization, retention, or access-control guidance.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The content instructs persistence of client-specific conversational details for reuse across future sessions, creating a longitudinal profile of the user. In a coaching skill, that context makes the issue more dangerous because repeated sessions often involve intimate patterns, failures, motivations, and interpersonal dynamics, so shared memory can enable overcollection, unintended cross-session inference, or leakage between users if isolation is weak.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly instructs the agent to read from persistent client memory and session files before each session, which likely contain sensitive personal and behavioral data. In a coaching context, this creates a real privacy and data-handling risk because it normalizes access to stored client records without any consent check, minimization rule, retention guidance, or warning about sensitive data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill directs the agent to write session notes, commitments, verdicts, and cadence updates into persistent client records in the same turn, but provides no safeguards around sensitive personal data storage. Because coaching sessions can include intimate personal, workplace, health, or mental-state information, unconditional persistence increases the risk of over-collection, unnecessary retention, and privacy leakage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly instructs the agent to read and rely on persistent coaching memory files that contain prior client history, patterns, and commitments, but provides no user-facing notice, consent step, or data-handling boundary for potentially sensitive personal information. In a coaching context, those files are likely to contain private behavioral, health, relationship, or mental-state details, so silently persisting and reusing them creates a real privacy and data-minimization risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This instruction directs the agent to write diagnoses, belief patterns, commitment histories, and client artifacts to persistent local files in the same turn, again without any warning, consent, or sensitivity check. Because the content includes inferred psychological patterns and session artifacts, the risk is elevated: the system is not just storing user-provided facts, but also durable interpretations that could be highly sensitive, inaccurate, or harmful if exposed or reused out of context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs the agent to write detailed client goal information, values, baselines, checkpoint dates, and plan artifacts into persistent files, but it provides no user-facing consent step or notice that personal data will be stored. In a coaching context this can capture sensitive behavioral, health-adjacent, and personal planning data, creating privacy and retention risks if written automatically.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: memory-template.md:62