Cooking

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:35 PM UTC
• Version: 1.0.2

Overview

The skill gives cooking help, but it automatically reads and edits shared health, contact, and household cooking notes, so it should be reviewed before installation.

Install only if you are comfortable with a cooking skill maintaining local long-term memory about your kitchen, meals, guests, allergies, intolerances, and food constraints. Prefer explicit confirmation before saving or deleting health/contact records, and review the shared ~/Clawic/data/health/ and ~/Clawic/data/contacts/ files if you use this skill.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:34

Finding

Mandatory Broad Access to Sensitive Health Records and Dynamically Indexed Files

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: memory-template.md:26

Finding

Unconsented Persistent Recording and Deletion of Health and Contact Data

Content

View full analysis

.md`, with the timings that were wrong | | A substitution or a scaling was tried | Its row in `## Swaps`, with the verdict, not just the swap | | A fact about this kitchen cost effort to learn — oven offset, hob behavior, pan dimensions, freezer temperature, water hardness, which salt is in the jar | A line in `## Kitchen` | | A piece of equipment was bought, retired, sharpened, re-seasoned, or found to be the problem | A line in `## Kitchen`, plus a `## Due` row if it needs maintenance on a cadence | | An allergy, intolerance, or diet-relevant condition came up | Its entry in `health/profile.md` (**shared**), with severity | | Someone was cooked for and their constraint or taste matters next time | `contacts/contacts.md` (**shared**) by name, constraint in `Context`; referenced here by name only | | An allergy was outgrown, a condition resolved, or someone is no longer cooked for | Delete the entry or the row from its shared box, and write the date as a line in `## Household` | ``` ### Technical Analysis The explicit statement that no permission is needed makes post-action notification a substitute for informed consent. The Skill can create, update, and delete sens ...[truncated 1875 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: memory-template.md:9

Finding

Excessive Long-Term Household, Guest, and Behavioral Profiling

Content

View full analysis

.md` | Append-only, cut by year | | Things you produced that get re-read — a recipe as they actually cook it, a dinner run-sheet, a brine or spice formula, a technique that fina ...[truncated 2696 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: memory-template.md:197

Finding

Plaintext Cross-Skill Storage of Health and Contact Information

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (46)

Harmful Content Injection

Critical

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

This content may contain harmful instructions that could cause physical harm if followed. CRITICAL: Review carefully before use.

Content

Scanner excerpt · preserving.md (reported line 105)May include surrounding context.

md

## When to Throw It Out

Discard without tasting: any bulging or leaking jar or can; any home-canned low-acid food that was not pressure-canned; a ferment with fuzzy mould or a rotten smell; anything with pink, orange, or black slime; garlic or herbs stored in oil at room temperature; and any preserve whose seal failed and was not refrigerated.

Botulinum toxin has no smell and no taste, and the food it grows in can look and smell fine. That is why the rule is a process, not a sniff. When in doubt, the cost is one jar.

**Write every batch, running and finished**, to `ferments.md` in `~/Clawic/data/cooking/`: what it is, start date, salt percentage, temperature, container, check date, and outcome — including failures with what they looked and smelled like. The check or ready date is mirrored into `## Due` in `memory.md` the moment the batch starts and cleared when it finishes; a cure formula that worked is an `artifacts/` file with its `## Boxes` line in the same turn (`memory-template.md`).

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · baking.md (reported line 15)May include surrounding context.

md

dough will not come together". Weigh it, or spoon and level. If `measure_by: volume` is set, the conversions are in `substitutions.md` and every cup of flour is stated as spooned-and-levelled.

Convection: reduce the temperature by **15-20°C** and expect roughly **25% less time**, and start checking earlier than that. Convection dries surfaces, which is excellent for pastry, roast potatoes, and cookies with crisp edges, and hostile to delicate cakes, custards, and soufflés.

## Leavening

| Agent | Amount | Needs | Timing |
|---|---|---|---|
| Baking powder (double-acting) | 1 tsp per 120 g flour | Nothing — it carries its own acid | One rise in the bowl, one in the oven |
| Baking soda | ¼ tsp per 120 g flour | An acid: buttermilk, yogurt, brown sugar, molasses, cocoa (natural, not Dutched), honey, citrus | Reacts immediately — get it in the oven |
| Both together | Powder for lift, soda for browning and pH | — | Common in cookies and pancakes |
| Yeast | See `bread.md` | Ti

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill instructs the agent to record inferred lactose intolerance or egg allergy and its severity into a persistent health profile. Persisting inferred health conditions is especially sensitive because the data may be wrong, medically significant, and retained without explicit confirmation, creating elevated privacy and downstream decision-making risks.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Using health/profile.md as an authority for allergy constraints causes the cooking skill to access health data outside its stated scope. Allergy data is sensitive, and tying cooking substitutions to a general health profile creates a privacy boundary violation that could expose or misuse medical-like personal information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs reading shared health and contacts files containing allergies, intolerances, conditions, and personal identity data, but the access is embedded in operational instructions rather than presented as a clear, prominent upfront disclosure. This is risky because users may invoke a cooking skill without realizing it will access sensitive health and contact information from shared stores.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill directs access to a shared contacts database to store people the user cooks for and their food constraints, which exceeds the core need of a cooking-rescue skill. This creates unnecessary collection and persistence of third-party personal data, increasing privacy risk and the chance of cross-skill exposure or misuse if the data is later read by other skills.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill claims ownership of recurring cadence tracking and updates to a due table, which moves it beyond immediate cooking assistance into reminder/task management. While not directly dangerous on its own, it expands data retention and behavioral tracking scope in ways users may not expect from a cooking skill.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The instruction to read ~/Clawic/data/cooking/memory.md and config.yaml before answering introduces filesystem access that goes beyond ordinary cooking advice. Even if the named files seem relevant, hidden reads of local state can expose unrelated sensitive data, create prompt-injection opportunities through those files, and violate least-privilege expectations for a simple advice skill.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file is presented as baking guidance, but it also instructs the agent to write persistent data into memory and artifacts files. That expands the skill from transient advice into state mutation, which can create unauthorized persistence, contaminate later interactions, and exceed the declared scope of the cooking skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs the agent to read a separate health profile containing sensitive medical and allergy information before giving cooking advice. For a cooking skill, using health data may sometimes be relevant for food safety, but accessing a persistent profile file is broader than necessary and creates unnecessary exposure of sensitive data beyond the immediate conversation.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The instruction to read a health profile introduces access to sensitive medical and allergy data from outside the current request context. In a cooking skill, this context makes the data somewhat relevant to food safety, but the broad file-based access still increases risk because it normalizes handling sensitive data without clear minimization or consent boundaries.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill directs persistent storage of user-specific cooking history, successful ratios, brand preferences, and health conditions into local memory and artifact files. This exceeds ordinary transient cooking assistance and creates a privacy and data-retention risk, especially because the manifest does not describe this storage behavior or its limits.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill tells the agent to update persistent health and cooking memory files without warning the user that personal data will be modified and retained. Silent persistence of personal data undermines user expectations and can lead to unauthorized retention of sensitive or identifying information.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs the agent to read persistent local files (~/Clawic/data/cooking/memory.md and config.yaml) before answering. That expands the skill from transient cooking assistance into filesystem-aware behavior, creating unnecessary access to local state and configuration that may contain unrelated sensitive data or enable cross-session prompt/data poisoning.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file instructs the agent to write historical planning data to cooks/<year>.md, update ## Kitchen in persistent memory, and create artifacts/ files. Persistent writes and artifact creation exceed the core cooking-help function and introduce risks of uncontrolled data retention, cross-session contamination, and using the filesystem as an unbounded side channel.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill directs persistent writes to memory.md, artifacts/ runbooks, and guest-related cook logs, which exceeds transient cooking assistance and can store household behavior, guest history, and operational details indefinitely. This increases privacy risk, creates unnecessary retention, and broadens the blast radius if memory is later accessed by other skills or exposed.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to read a persistent user-specific file in the home directory before answering. For a cooking-help skill, that creates unnecessary access to cross-session local state and can expose unrelated user data or hidden prompt instructions if that file is modified, poisoned, or contains more than narrowly scoped stove metadata. The cooking context makes this somewhat less suspicious than in an unrelated skill, but it is still an overbroad stateful dependency not justified by the manifest alone.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill directs the agent to write observations back into a persistent memory file, adding a stateful capability beyond simple cooking assistance. Persistent writes can leak behavioral data across sessions, enable prompt/data poisoning for future runs, and create an unintended channel for storing user-environment details in the home directory without clear necessity or authorization. In a cooking skill this appears operational rather than malicious, but it still expands the attack surface.

Content

No source excerpt is available for this finding.

Unbounded Output

Medium

• Category: Output Handling
• Confidence: 60% confidence

Finding

Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Content

Scanner excerpt · meat.md (reported line 69)May include surrounding context.

md

- Pork loin and chops at 63°C with a 3-minute rest are safe and juicy; Trichinella is inactivated by 58°C, and the 71°C target is a leftover from a solved problem. Ground pork still needs 71°C.
- Pork shoulder and belly are collagen cuts: 90-96°C, hours, no shortcuts.
- Lamb behaves like beef for tender cuts and like pork shoulder for the collagen ones. Lamb fat carries the flavor most people either love or dislike — trimming it changes the dish more than trimming beef fat does.
- Crackling: score the skin without cutting into the fat, dry it hard, salt it, and give it a blast at 230°C at the start or the end. Moisture is the only thing that prevents it.

## Ground Meat

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instruction to write cooking outcomes into ~/Clawic/data/cooking/memory.md and related local files directs the agent to perform persistent local-state modification beyond merely giving cooking advice. Even if intended as a helpful journal feature, unnecessary file writes create privacy and integrity risk because they can store personal household data or overwrite existing notes without a clear user request each time.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The template explicitly authorizes the agent to perform writes and deletions without obtaining user permission first, requiring only a one-line announcement. This creates an unsafe autonomy boundary: if the agent misinterprets context, is prompt-injected, or selects the wrong target file/row, it can alter or delete durable user data before the user has a chance to approve the change.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file explicitly instructs the agent to read and rely on ~/Clawic/data/cooking/ferments.md at the start of preserving sessions, creating cross-session statefulness not required for one-off cooking advice. This expands the skill from contextual cooking guidance into persistent record retrieval, which can expose prior user data and create unintended memory coupling between sessions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill directs automatic writes of batch details into ferments.md, mirrored scheduling data into memory.md, and successful formulas into artifacts/, adding durable record-management behavior beyond the declared cooking purpose. Unnecessary persistence increases the chance of storing sensitive habits, schedules, or household information and broadens the blast radius if those files are later accessed by other skills or components.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly instructs writing to persistent local files (~/Clawic/data/cooking/memory.md, dish repertoire entries, and artifacts/) after a rescue. For a cooking-rescue advisory skill, this goes beyond giving transient guidance and creates durable side effects on local state, which can be abused to poison future recommendations, overwrite user-maintained notes, or cause unwanted file growth and workflow changes.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs reading a personal health profile before cooking and frames that read as a required execution gate. That expands the skill from cooking advice into access of sensitive medical data, creating unnecessary exposure of allergies, pregnancy, immunosuppression, and other conditions even when not strictly needed for the immediate task.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: memory-template.md:64