Developer

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:01 PM UTC
• Version: 1.0.2

Overview

This skill is a disclosed local developer-assistant memory workflow, but users should understand that it automatically stores durable work notes, contacts, and project records on the machine.

Install only if you want this skill to maintain local, cross-session developer memory under ~/Clawic/data/, including repo notes, estimates, releases, incidents, project status, and limited work contacts. Review or clear those files periodically if you do not want that context retained or shared with other Clawic skills.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

other

Warning

• Location: memory-template.md:24

Finding

Automatic Persistent Profiling and Cross-Skill Personal Data Storage

Content

View full analysis

.md` if `## Repos` has a row for it: it holds the run and test commands, the conventions, and the traps that cost someone an afternoon. If none of it exists, work from defaults and say nothing about it. **Write before the session ends** whenever it produced something durable: a repo learned or a command that finally worked; a root cause that took real time to find; a decision and what it rejected; an estimate made or an estimate closed against reality; a flaky test, a performance baseline, a dependency verdict; a release, a migration, or an incident; or something the user will re-read — a postmortem, a runbook, a setup recipe, a review checklist. `memory-template.md` holds every destination, format and threshold, ...[truncated 7778 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md

**People and projects go to the shared boxes**, not here: reviewers, code owners, maintainers and the PM belong in `~/Clawic/data/contacts/contacts.md`, and the work in flight belongs in `~/Clawic/data/projects/<project>.md`. One record per person or project, updated in place — a second copy inside this skill is how two skills start contradicting each other.

**No credential is ever written anywhere under `~/Clawic/data/`** — not in the files named here, not in a file you create, not in a stack trace, `.env`, log, or config the user pastes in to be saved. Store the pointer and strip the value: `env:DATABASE_URL`, `keychain:npm-publish`, `1password:Work/CI/deploy-token`, `file:~/.ssh/id_ed25519`. The same applies to customer data pasted inside a bug report.

Most developer work is not writing code; it is finding the one place to change and proving the change did what you claimed. State which file and which line changes, and how the change is verified, before writing it. Work from defaults immediately: never open with questions about their stack, their workflow, or how proactive to be. Precedence for any value: `config.yaml` → `~/Clawic/profile.yaml` (shared universals) → the Configuration table default.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · memory-template.md (reported line 63)May include surrounding context.

md

**People and projects go to the shared boxes**, not here: reviewers, code owners, maintainers and the PM belong in `~/Clawic/data/contacts/contacts.md`, and the work in flight belongs in `~/Clawic/data/projects/<project>.md`. One record per person or project, updated in place — a second copy inside this skill is how two skills start contradicting each other.

**No credential is ever written anywhere under `~/Clawic/data/`** — not in the files named here, not in a file you create, not in a stack trace, `.env`, log, or config the user pastes in to be saved. Store the pointer and strip the value: `env:DATABASE_URL`, `keychain:npm-publish`, `1password:Work/CI/deploy-token`, `file:~/.ssh/id_ed25519`. The same applies to customer data pasted inside a bug report.

Most developer work is not writing code; it is finding the one place to change and proving the change did what you claimed. State which file and which line changes, and how the change is verified, before writing it. Work from defaults immediately: never open with questions about their stack, their workflow, or how proactive to be. Precedence for any value: `config.yaml` → `~/Clawic/profile.yaml` (shared universals) → the Configuration table default.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · memory-template.md (reported line 67)May include surrounding context.

md

When the user pastes something to save — a `.env`, a config file, a stack trace, a command history, a curl that reproduces the bug — replace each secret value before writing and leave the pointer visible: `DATABASE_URL=<env:DATABASE_URL>`, `Authorization: Bearer <keychain:api-staging>`. Say in one line that you did it.

In this domain — **not secrets, keep them**: repository names and URLs without credentials, branch names, commit SHAs, ticket ids, package names and versions, service and environment names, table and column names, endpoint paths, port numbers, config variable *names*, error messages and stack frames, CI job names, feature-flag keys. **Secrets, strip them**: API keys and tokens, connection strings carrying a password, personal access tokens embedded in a remote URL, session cookies and JWTs copied out of a debug log, private keys and passphrases, webhook URLs with a token in the path, CI and registry credentials, basic-auth in a URL. **Also strip, though not a credential**: real customer data pasted inside a bug report or a failing payload — replace with a shape-preserving placeholder (`email: <redacted-email>`), because a reproduction case does not need the person.

**Contents:** [config.yaml](#configyaml) · [memory.md](#memorymd) · [repos/](#repos) · [artifacts/](#artifacts) · [releases/](#releases) · [incidents/](#incidents) · [shared contacts](#shared-contacts) · [shared projects](#shared-projects) · [split-out files](#split-out-files)

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · dependencies.md (reported line 44)May include surrounding context.

md

- Run the ecosystem's audit in CI and treat *reachable* criticals as blocking. A vulnerability in a dev-only dependency, or in a code path you never call, is a ticket, not a fire.
- A CVE with no patched version is a decision: pin around it, patch locally, vendor it, or accept and document. Write the decision down (`artifacts/`), because it will be asked again at the next audit.
- Install scripts run arbitrary code at install time — that is the actual supply-chain surface. Disable them where the ecosystem allows and the build still works.
- Lockfile changes deserve review attention on their own: a diff that adds 200 transitive packages is a change of risk profile, whatever the feature was (`reviews.md`).
- Never install from a URL or a branch in a production build. Publish or vendor it instead.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The template explicitly authorizes writes and deletions without user confirmation, which can cause unauthorized persistence changes or data loss in the user's memory store. In an agent setting, automatic modification of shared and durable files is risky because prompt injection, misclassification, or simple model error could trigger unwanted state changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The contact-retirement rule permits deleting shared contact rows based on the model's judgment that someone 'leaves the project,' without a user-facing warning or approval step. Because contacts.md is shared across skills, an incorrect deletion could remove useful cross-domain context and create integrity issues for other workflows.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · migrations.md (reported line 67)May include surrounding context.

md

| Testing on an empty staging database | Every problem here is a volume problem | Copy of production data, or generated data at real scale |
| Adding a column with a default on a large table | Rewrites the whole table in older engines | Add nullable, backfill in batches, then set the default |
| Trusting the ORM's generated migration | It optimizes for expressing your model, not for a live table | Read the emitted SQL before running it |
| Deploying a migration without checking the down path | Discovered during the incident | Run up, down, up locally against real-shaped data |
| Leaving the contract step "for later" | Two sources of truth forever, and the next developer writes to the wrong one | `## Open Threads` until it ships, with a date |
| A data fix run from a shell with no record | Nobody can reconstruct what changed | The statement, the row count and the date go in `releases/<year>.md` |

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

Line L51 imposes a language requirement tied to the user's language, but the document does not specify how that language is determined or provide an opt-in/choice mechanism. This can create a locale policy issue if the skill assumes or enforces language behavior without explicit user selection or a documented regional justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.