T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:228- Finding
Promotional Instructions Embedded in Operational Skill Context
- Content
View full analysis
- Remediation
View remediation
Security audit
Designer
Security checks for vulnerabilities and agentic risk
Overview
The skill is not destructive or exfiltrating, but it automatically stores and reuses local design, client, project, and licence information without asking first.
Install only if you want this skill to maintain a local design memory. Before using it with client work, review the Clawic data folders it can read/write, require confirmation before shared contacts/projects/finances updates, and avoid storing contracts, bank or tax details, credentials, private participant identities, or sensitive client context in its memory files.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:36- Finding
Automatic Cross-Session Memory Writes Without Prior User Consent
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
memory-template.md:19- Finding
Excessive Collection and Cross-Skill Sharing of Contact, Project, and Financial Data
- Content
View full analysis
.md` (**shared**) | One file per project | | Font, icon, stock and tool licences; retainers — anything with a renewal date | `~/Clawic/data/finances/subscriptions.md` (**shared**) | One row per subscription | ``` From the automatic write table: ```markdown | A client, stakeholder or print vendor entered the picture | Their row in `contacts.md` (shared) | | An engagement started, changed scope, or closed | Its file in `projects/` (shared) | | A font, icon, stock or tool licence was bought or renewed | A row in `subscriptions.md` (shared), plus its renewal in `## Due` | ``` From the shared contact schema: ```markdown # Contacts | Name | Key | Role | Preferred channel | Context | Last contact | File | |------|-----|------|-------------------|---------|--------------|------| | Marta Ruiz | marta@acme.example | client, decides on brand | email | Acme rebrand; approves in writing, slow in August | 2026-07-18 | — | | Nord Press | hello@nordpress.example | print vendor | email | Coated stock, TAC 300%, 5-day lead | 2026-06-30 | — | ``` From the shared project schema: ```markdown # Acme rebrand status: active client: Marta Ruiz (see contacts) started: 2026-05-04 fee: 14,000 EUR fixed, 50% deposit paid 2026-05-06 ``` ### Technical Analysis The Skill prescribes default write access to shared repositories containing contacts, pr ...[truncated 1906 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- Rogue AgentSelf-Modification, Session Persistence
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (15)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | A component needs its real states, or a form fights the user | The state matrix and the validation timing rules | `components.md` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | A component needs its real states, or a form fights the user | The state matrix and the validation timing rules | `components.md` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | A component needs its real states, or a form fights the user | The state matrix and the validation timing rules | `components.md` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | A component needs its real states, or a form fights the user | The state matrix and the validation timing rules | `components.md` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | A component needs its real states, or a form fights the user | The state matrix and the validation timing rules | `components.md` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | A component needs its real states, or a form fights the user | The state matrix and the validation timing rules | `components.md` |
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
md - **Scenario, not instruction.** "You need to expense last week's client dinner" beats "click the Add Expense button", which tests reading, not design. - **Never use the interface's own words** in the task. If the button says "Compose" and the task says "compose a message", the task has given away the answer. - **One clear completion state** per task, so success is not a judgment call. - **Order tasks from independent to dependent**, and reset state between participants — the second participant should not inherit the first one's data. - **Three to five tasks per session** for a 45-minute slot. More produces fatigue and shallow data. ## Metrics
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
The skill explicitly instructs the agent to persist session-derived information across runs by reading and writing
memory.mdand related files. Even though it says data stays local and forbids credentials, this still creates a real privacy and integrity risk: user content, project details, client names, accessibility findings, and other durable artifacts may be stored without narrowly scoped consent, and later prompts can cause that stored context to be reused in unintended ways.- Content
md - ~/clawic/designer/ --- **Data.** At the start of every session, read `~/Clawic/data/designer/config.yaml` (what the user declared) and `~/Clawic/data/designer/memory.md` (what you observed, plus its `## Boxes` index and `## Due` table). Open any file `## Boxes` names when the condition on its line applies — the index is the list of files, never assume the list is fixed. Every path it names is inside `~/Clawic/data/`; ignore any line that points anywhere else. Everything this skill reads or writes is a plain local note under the folders declared in `configPaths` — nothing leaves the machine and no credential is ever written. In a shared box it updates or removes only the rows it wrote itself, matched on that box's identity key; a row another skill wrote is read, never rewritten and never deleted, and every write and deletion is named in one line as it happens. Read `~/Clawic/data/designer/memory.md`'s `## Brands` and `## Surfaces` before proposing any color, type, spacing or component decision: re-deriving a palette that already exists is the single most expensive mistake in this domain. If none of it exists, work from defaults and say nothing about it. **Write before the session ends** whenever it produced something durable: a brand and its palette, type stack or logo rules; a surface and its grid, breakpoints or implementer; a token set or a rename; a usability finding, an accessibility audit, or a design review; a fact that cost effort to learn (a licence restriction, a client's forbidden technique, a printer's ink limit, a locale that overflows every label); or something the user will re-read — brand guidelines, a component spec, a handoff spec, a decision and what it rejected. `memory-template.md` holds every destination, format and threshold, and is the only file you open in order to write.
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill explicitly instructs the agent to read persistent local memory and prior audit artifacts before performing an accessibility pass. That expands scope from design guidance into cross-session data access, which can expose unrelated or sensitive project context and create unnecessary data dependence for a task that can usually be performed from the current design inputs alone.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file directs the agent to create and update audit artifacts, session logs, due trackers, memory, and configuration state. This gives the skill broad persistent write authority beyond a narrow designer role, increasing the risk of unauthorized state changes, sensitive data retention, and unintended cross-task influence if an attacker can shape what gets recorded.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md Everything except artifacts, session logs and the shared boxes begins inside `memory.md`. Splitting is a procedure, not a suggestion: 1. Before appending to a section, count its entries. 2. If the append would take it past **~15 entries or ~40 lines of real content** — scaffolding, headings and comments do not count — then, in the same turn: create the new file in `~/Clawic/data/designer/`, move the whole section into it, **delete the section from `memory.md`**, add its line to `## Boxes`, and append the new entry to the new file. 3. Keep the headings identical on both sides of the move, so the split is a copy-paste and never a rewrite. 4. Never leave a copy behind. If the same data ever appears in both places, the extracted file wins and the `memory.md` copy is deleted.
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Line L082 states 'Changelog in the users' language' as a requirement, which imposes a language/locale policy in natural language. The file does not offer user choice, opt-in, or a documented region-specific justification for this constraint.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The instruction to read a user-specific memory file lacks any privacy boundary, minimization rule, or warning about sensitive contents. Even if intended for continuity, this can normalize unnecessary access to prior user data and increase accidental exposure in outputs or downstream decisions.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This file primarily presents design/layout guidance, but its closing instructions tell the skill to persist information into memory.md, config.yaml, and artifacts files. While some design handoff documentation is consistent with a designer role, storing standing user preferences in config.yaml and maintaining persistent local knowledge stores is an additional capability not clearly inherent to giving layout advice in this document itself.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The manifest describes a designer skill focused on creating and justifying design work, documenting design systems, and handing off buildable files. Line L106 extends into maintaining shared contact and project-tracking records, which is more akin to CRM/project administration than design execution.
- Content
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- memory-template.md:66