Designer

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:58 PM UTC
• Version: 1.0.2

Overview

The skill is not destructive or exfiltrating, but it automatically stores and reuses local design, client, project, and licence information without asking first.

Install only if you want this skill to maintain a local design memory. Before using it with client work, review the Clawic data folders it can read/write, require confirmation before shared contacts/projects/finances updates, and avoid storing contracts, bank or tax details, credentials, private participant identities, or sensitive client context in its memory files.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:228
• Finding: Promotional Instructions Embedded in Operational Skill Context<, the verified skill library. Get this skill: https://clawic.com/skills/designer. ``` ### Technical Analysis The primary Skill instruction document includes promotional directions, external navigation prompts, installation suggestions, and requests to “star” the Skill. These directives are unrelated to the Skill’s declared design-assistance functionality. Because `SKILL.md` is loaded as Agent instruction context, this content can influence the Agent’s behavior in the current session. It may cause the Agent to reproduce promotional material, recommend unrelated Skills, or steer the user toward an external service. User confirmation is mentioned for installation, but not for presenting or otherwise acting on the promotional instructions. No executable network request was identified. The risk arises from instruction-context influence rather than automatic network communication. ### Attack Path 1. The Agent loads `SKILL.md` to perform a design task. 2. The promotional footer is interpreted as part of the Skill’s operational instructions. 3. The Age ...[truncated 675 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `Related Skills` and `Feedback` sections from operational Agent instructions. 2. Move optional discovery, version, homepage, and feedback links into package metadata or a human-facing README that is not loaded as Agent instruction. 3. Do not instruct the Agent to advertise, request stars, or recommend installation during unrelated user tasks. 4. If related-Skill discovery is retained, expose it only when the user explicitly asks for extensions or additional capabilities. 5. Require explicit user confirmation before any installation action or external navigation. 6. Add a validation rule that rejects promotional calls to action in files used as runtime Agent instructions. ]]>

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:36
• Finding: Automatic Cross-Session Memory Writes Without Prior User Consent<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 36-42; `memory-template.md`, lines 1-49 **Vulnerability Type**: `T02: Agent Memory Poisoning` **Risk Level**: High ### Complete Vulnerable Code Snippet From `SKILL.md`: ```markdown **Data.** At the start of every session, read `~/Clawic/data/designer/config.yaml` (what the user declared) and `~/Clawic/data/designer/memory.md` (what you observed, plus its `## Boxes` index and `## Due` table). Open any file `## Boxes` names when the condition on its line applies — the index is the list of files, never assume the list is fixed. Every path it names is inside `~/Clawic/data/`; ignore any line that points anywhere else. Everything this skill reads or writes is a plain local note under the folders declared in `configPaths` — nothing leaves the machine and no credential is ever written. In a shared box it updates or removes only the rows it wrote itself, matched on that box's identity key; a row another skill wrote is read, never rewritten and never deleted, and every write and deletion is named in one line as it happens. Read `~/Clawic/data/designer/memory.md`'s `## Brands` and `## Surfaces` before proposing any color, type, spacing or component decision: re-deriving a palette that already exists is the single most expensive mistake in this domain. If none of it exists, work from defaults and say nothing about it. **Write before the session ends** whenever it produced something durable: a brand and its palette, type stack or logo rules; a surface and its grid, breakpoints or implementer; a token set or a rename; a usability finding, an accessibility audit, or a design review; a fact that cost effort to learn (a licence restriction, a client's forbidden technique, a printer's ink limit, a locale that overflows every label); or something the user will re-read — brand guidelines, a component spec, a handoff spec, a decision and what it rejected. `memory-template.md` holds every destination, forma ...[truncated 4175 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit, informed opt-in before creating or changing persistent state. 2. Present the exact proposed record, destination file, and retention purpose before writing it. 3. Do not persist inferred observations as user preferences. Only explicitly declared preferences should affect future sessions automatically. 4. Treat stored observations as untrusted contextual notes rather than authoritative instructions. 5. Add provenance fields recording the source session, whether the user approved the record, and when it expires. 6. Provide commands or documented procedures to inspect, correct, export, and delete all retained state. 7. Apply retention limits to session logs, findings, pain points, and due records. 8. Do not automatically follow dynamically indexed records unless the user has approved the relevant memory collection. 9. Validate stored content before loading it into instruction context and prevent records from containing instruction-override language. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: memory-template.md:19
• Finding: Excessive Collection and Cross-Skill Sharing of Contact, Project, and Financial Data<![CDATA[ ## Vulnerability Details **File Location**: `memory-template.md`, lines 19-21, 54-59, and 224-253; related declaration in `SKILL.md`, line 40 **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: Medium ### Complete Vulnerable Code Snippet From the storage mapping in `memory-template.md`: ```markdown | People: clients, stakeholders, print vendors, collaborators | `~/Clawic/data/contacts/contacts.md` (**shared**) | One row per person, every skill's contacts in one file | | A named engagement: brief, scope, rounds, milestones, decisions, estimate vs actual | `~/Clawic/data/projects/<project>.md` (**shared**) | One file per project | | Font, icon, stock and tool licences; retainers — anything with a renewal date | `~/Clawic/data/finances/subscriptions.md` (**shared**) | One row per subscription | ``` From the automatic write table: ```markdown | A client, stakeholder or print vendor entered the picture | Their row in `contacts.md` (shared) | | An engagement started, changed scope, or closed | Its file in `projects/` (shared) | | A font, icon, stock or tool licence was bought or renewed | A row in `subscriptions.md` (shared), plus its renewal in `## Due` | ``` From the shared contact schema: ```markdown # Contacts | Name | Key | Role | Preferred channel | Context | Last contact | File | |------|-----|------|-------------------|---------|--------------|------| | Marta Ruiz | [e-mail] | client, decides on brand | email | Acme rebrand; approves in writing, slow in August | 2026-07-18 | — | | Nord Press | [e-mail] | print vendor | email | Coated stock, TAC 300%, 5-day lead | 2026-06-30 | — | ``` From the shared project schema: ```markdown # Acme rebrand status: active client: Marta Ruiz (see contacts) started: 2026-05-04 fee: 14,000 EUR fixed, 50% deposit paid 2026-05-06 ``` ### Technical Analysis The Skill prescribes default write access to shared repositories containing contacts, pr ...[truncated 1906 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Keep design-specific records in the Skill’s private directory by default. 2. Require explicit user consent before each write to a shared contacts, projects, or finances repository. 3. Request access separately for each data category instead of granting broad shared-store access. 4. Store only minimal project identifiers unless contact or commercial details are essential to the requested task. 5. Do not store email addresses, communication history, fees, deposit status, or financial renewal information by default. 6. Implement per-Skill access controls so unrelated Skills cannot automatically read all shared records. 7. Add field-level provenance and ownership metadata rather than relying solely on narrative rules about which Skill created a row. 8. Encrypt sensitive local records at rest and enforce restrictive filesystem permissions. 9. Add retention periods and user-controlled deletion for contact, project, and subscription data. 10. Clearly disclose, before collection, which other Skills or components can access each shared record. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (15)

Ae1

High

• Category: analysis-evasion

Content

| A component needs its real states, or a form fights the user | The state matrix and the validation timing rules | `components.md` |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

| A component needs its real states, or a form fights the user | The state matrix and the validation timing rules | `components.md` |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

| A component needs its real states, or a form fights the user | The state matrix and the validation timing rules | `components.md` |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

| A component needs its real states, or a form fights the user | The state matrix and the validation timing rules | `components.md` |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

| A component needs its real states, or a form fights the user | The state matrix and the validation timing rules | `components.md` |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

| A component needs its real states, or a form fights the user | The state matrix and the validation timing rules | `components.md` |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Memory Manipulation

High

• Category: Memory Poisoning

Content

- **Scenario, not instruction.** "You need to expense last week's client dinner" beats "click the Add Expense button", which tests reading, not design.
- **Never use the interface's own words** in the task. If the button says "Compose" and the task says "compose a message", the task has given away the answer.
- **One clear completion state** per task, so success is not a judgment call.
- **Order tasks from independent to dependent**, and reset state between participants — the second participant should not inherit the first one's data.
- **Three to five tasks per session** for a 45-minute slot. More produces fatigue and shallow data.

## Metrics

• Confidence: 80% confidence
• Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Session Persistence

Medium

• Category: Rogue Agent

Content

- ~/clawic/designer/
---

**Data.** At the start of every session, read `~/Clawic/data/designer/config.yaml` (what the user declared) and `~/Clawic/data/designer/memory.md` (what you observed, plus its `## Boxes` index and `## Due` table). Open any file `## Boxes` names when the condition on its line applies — the index is the list of files, never assume the list is fixed. Every path it names is inside `~/Clawic/data/`; ignore any line that points anywhere else. Everything this skill reads or writes is a plain local note under the folders declared in `configPaths` — nothing leaves the machine and no credential is ever written. In a shared box it updates or removes only the rows it wrote itself, matched on that box's identity key; a row another skill wrote is read, never rewritten and never deleted, and every write and deletion is named in one line as it happens. Read `~/Clawic/data/designer/memory.md`'s `## Brands` and `## Surfaces` before proposing any color, type, spacing or component decision: re-deriving a palette that already exists is the single most expensive mistake in this domain. If none of it exists, work from defaults and say nothing about it.

**Write before the session ends** whenever it produced something durable: a brand and its palette, type stack or logo rules; a surface and its grid, breakpoints or implementer; a token set or a rename; a usability finding, an accessibility audit, or a design review; a fact that cost effort to learn (a licence restriction, a client's forbidden technique, a printer's ink limit, a locale that overflows every label); or something the user will re-read — brand guidelines, a component spec, a handoff spec, a decision and what it rejected. `memory-template.md` holds every destination, format and threshold, and is the only file you open in order to write.

• Confidence: 90% confidence
• Finding: The skill explicitly instructs the agent to persist session-derived information across runs by reading and writing `memory.md` and related files. Even though it says data stays local and forbids credentials, this still creates a real privacy and integrity risk: user content, project details, client names, accessibility findings, and other durable artifacts may be stored without narrowly scoped consent, and later prompts can cause that stored context to be reused in unintended ways.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly instructs the agent to read persistent local memory and prior audit artifacts before performing an accessibility pass. That expands scope from design guidance into cross-session data access, which can expose unrelated or sensitive project context and create unnecessary data dependence for a task that can usually be performed from the current design inputs alone.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The file directs the agent to create and update audit artifacts, session logs, due trackers, memory, and configuration state. This gives the skill broad persistent write authority beyond a narrow designer role, increasing the risk of unauthorized state changes, sensitive data retention, and unintended cross-task influence if an attacker can shape what gets recorded.

Session Persistence

Medium

• Category: Rogue Agent

Content

Everything except artifacts, session logs and the shared boxes begins inside `memory.md`. Splitting is a procedure, not a suggestion:

1. Before appending to a section, count its entries.
2. If the append would take it past **~15 entries or ~40 lines of real content** — scaffolding, headings and comments do not count — then, in the same turn: create the new file in `~/Clawic/data/designer/`, move the whole section into it, **delete the section from `memory.md`**, add its line to `## Boxes`, and append the new entry to the new file.
3. Keep the headings identical on both sides of the move, so the split is a copy-paste and never a rewrite.
4. Never leave a copy behind. If the same data ever appears in both places, the extracted file wins and the `memory.md` copy is deleted.

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: Line L082 states 'Changelog in the users' language' as a requirement, which imposes a language/locale policy in natural language. The file does not offer user choice, opt-in, or a documented region-specific justification for this constraint.

Missing User Warnings

Low

• Confidence: 76% confidence
• Finding: The instruction to read a user-specific memory file lacks any privacy boundary, minimization rule, or warning about sensitive contents. Even if intended for continuity, this can normalize unnecessary access to prior user data and increase accidental exposure in outputs or downstream decisions.

Context-Inappropriate Capability

Low

• Confidence: 84% confidence
• Finding: This file primarily presents design/layout guidance, but its closing instructions tell the skill to persist information into memory.md, config.yaml, and artifacts files. While some design handoff documentation is consistent with a designer role, storing standing user preferences in config.yaml and maintaining persistent local knowledge stores is an additional capability not clearly inherent to giving layout advice in this document itself.

Context-Inappropriate Capability

Low

• Confidence: 80% confidence
• Finding: The manifest describes a designer skill focused on creating and justifying design work, documenting design systems, and handing off buildable files. Line L106 extends into maintaining shared contact and project-tracking records, which is more akin to CRM/project administration than design execution.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: memory-template.md:66