Cooking

• Outcome: Review
• Latest audit: Jul 27, 2026 · 8:55 AM UTC
• Version: 1.0.2

Overview

This cooking skill is useful and mostly transparent, but it needs Review because it automatically reads and writes persistent cooking, health, and contact records, including allergies and guest constraints.

Install only if you want this skill to maintain a local cooking memory and to use shared allergy/contact records. Review the files under ~/Clawic/data/ before and after use, and avoid using it for casual one-off cooking questions if you do not want allergies, guest constraints, kitchen facts, or dish outcomes saved.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (41)

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill’s declared purpose is cooking assistance, but it also reads and updates shared health and contacts data, expanding its access to sensitive personal information beyond what users would reasonably expect from the manifest. This creates a privacy and scope-creep risk: even if the data stays local, the skill is empowered to process medical constraints and personal relationship data that are not strictly necessary for many cooking tasks.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Writing ‘people you cook for’ into a shared contacts database is a cross-domain data collection behavior that is not proportionate to a cooking skill’s core function. It can silently accumulate third-party personal data and make that data available to other skills, increasing privacy exposure and the blast radius of any later misuse.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill directs the agent to update persistent health and cooking memory files, which exceeds the stated purpose of providing cooking guidance. Persisting health sensitivities and user-specific history without an explicit, scoped user request creates a privacy and authorization risk, especially because health data is sensitive and the write is framed as routine behavior.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The document broadens the skill from cooking assistance into maintaining user health and repertoire records. That scope expansion is dangerous because it can cause an agent invoked for innocuous cooking help to collect and retain sensitive profile data beyond user expectations.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill instructs the agent to read from a persistent local memory file before answering a frying question. That creates unnecessary coupling to unrelated local state and can expose or import sensitive or attacker-controlled data into the interaction, especially if the memory file is shared across skills or sessions. In a cooking skill, this read is not required to provide general frying guidance, so the context makes it less justifiable rather than safer.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill directs the agent to write operational notes to persistent local memory and artifacts files after use. Persistent writes can leak user data, create cross-session prompt injection surfaces, and allow unauthorized modification of the agent's future behavior or retained context. In this skill, recording oil usage and outcomes is convenience state, not essential to answering the current cooking request, so the context does not reduce the risk.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to read `contacts.md` and household memory to determine guest constraints and preferences, which expands data access beyond what is necessary for core grilling guidance. This creates an unnecessary privacy exposure because personal household and contact data may be retrieved and processed whenever the skill is invoked, even when the user only asked for cooking help.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill directs persistent logging of cook outcomes, grill behavior, guest-related events, and records in long-term memory files such as `cooks/<year>.md` and `memory.md`. This is dangerous because it encourages retention of personal behavioral data and guest associations beyond the immediate cooking task, increasing privacy risk and the chance of secondary misuse or over-collection.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill instructs the agent to read a persistent memory file in the user's home directory before giving cooking advice. That introduces stateful access to local data outside the immediate request, which is broader than the stated scope of providing cooking guidance and could expose or rely on unrelated user-specific information if the memory file grows beyond narrowly scoped kitchen facts.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill explicitly tells the agent to write observations into a persistent local memory file, creating lasting state and file-modification behavior not necessary for ordinary cooking advice. Persistent writes can be abused for unauthorized data storage, prompt-state poisoning, or accumulation of environmental details that later influence agent behavior in unintended ways.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly instructs the agent to read local configuration and household memory files before answering. That expands the skill from pure cooking advice into access of persistent local state, which can expose unrelated personal preferences or data and creates a broader attack surface if the memory files contain sensitive content or are later influenced by untrusted input.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The instruction to write cooking outcomes into persistent files causes the skill to modify local memory beyond delivering transient cooking guidance. Persistent writes can leak household behavior, create privacy issues, and allow prompt-driven data poisoning of future agent behavior if these records are later reused as trusted memory.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill instructs the agent to persist outcome details and create runbooks/artifacts after a rescue attempt, which exceeds the minimal scope of providing cooking advice. Unnecessary writes to local memory/artifact files can store user-derived data across sessions, create prompt-injection persistence, and modify the agent’s future behavior without clear authorization.

Context-Inappropriate Capability

Low

• Confidence: 92% confidence
• Finding: The skill requires reading local memory files before proposing a fix, introducing an unnecessary dependency on shared persistent state for a cooking-rescue task. This broadens the attack surface because poisoned or unrelated content in those files can influence responses and leak cross-session information into the current interaction.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill instructs the agent to persist personal health details, guest constraints, and contact-context data to local files as part of routine cooking workflows, even though long-term storage is not necessary to answer a one-off food safety question. This creates avoidable collection and retention of sensitive personal data, increasing the risk of privacy leakage, overbroad profiling, and misuse if those files are later accessed by other skills, users, or processes.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill explicitly instructs the agent to read persistent household health and cooking memory files before handling shellfish. That expands access beyond the immediate cooking request and introduces exposure to sensitive allergy and household data that may be unnecessary for many queries, creating privacy and over-collection risk.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill instructs the agent to write newly discovered shellfish allergies, severity, supplier preferences, and household likes/dislikes into persistent files. This is dangerous because it stores sensitive health information and household behavioral data in long-lived memory without explicit consent, retention limits, or privacy safeguards.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill instructs the agent to read household-specific data from local files before answering a cooking question, expanding its access beyond what is necessary to provide general seasoning guidance. This creates an unnecessary privacy boundary crossing and can expose or normalize use of unrelated local user data without clear consent or minimization.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill directs the agent to persist household preferences and observations into config and memory files, including inferred tastes and kitchen details. Storing user-profile data from interaction history is outside the core need of answering a cooking question and risks silent accumulation of personal preference data that could later be reused or exposed.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: This instruction expands the cooking skill’s scope into reading persistent user data from health/profile.md and config.yaml. Even if intended to respect allergies and dietary preferences, it creates unnecessary access to sensitive or unrelated stores, increasing privacy risk and the chance of over-collection or misuse of personal health information.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The file instructs the skill to read and later write user-specific substitution outcomes to persistent memory files. That persistence is not necessary for one-shot cooking assistance and creates a data-retention channel that can accumulate behavioral history, preferences, and potentially sensitive household information beyond the skill’s stated purpose.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly instructs the agent to read household diet and restriction data from local config and memory files, which expands the skill from generic cooking advice into accessing persistent personal preference data. Even if the purpose is convenience, this creates unnecessary data exposure and implicit data-use without any consent, minimization, or scope controls.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill directs the agent to write household willingness-to-eat patterns, preferences, and kitchen behavior into persistent memory files. This creates a profiling and retention risk because the agent is storing behavioral household data beyond the immediate task, potentially without user awareness or review.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill description presented to users focuses on cooking help but does not prominently warn that the skill reads and writes shared local files, including health and contact data. This undermines informed consent: users may invoke the skill expecting ephemeral advice, while the skill performs persistent cross-skill data operations with sensitive information.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill also instructs persistent writes to cooking memory and artifacts without clearly telling the user that their preferences, successful ratios, or interaction details will be stored. Even if less sensitive than health data, undisclosed persistence can violate user expectations and create unnecessary data retention.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: memory-template.md:64