Security audit

Digest

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent personalized news-digest helper that stores local preferences and sent logs, with no executable code or hidden install behavior found.

Before installing, understand that the skill keeps a local digest profile, learned preferences, and a sent-item log under ~/Clawic/data/digest/. Review or delete that directory if you do not want long-term personalization history retained, and be deliberate when enabling scheduled sends or external delivery channels such as email, Slack, or Telegram.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill instructs the agent to persist user preferences, learned signals, and sent-item logs in a local directory, but it does not disclose retention limits, sensitivity handling, or consent expectations. Because these files can reveal interests, routines, contacts, and behavioral patterns over time, silent persistence increases privacy risk and potential exposure if the host or adjacent tools can access that directory.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The 'When To Use' section describes many general scenarios like wanting a daily briefing, news roundup, scheduled update, or an existing digest feeling off, but it does not define specific activation phrases or clear boundaries for when this skill should versus should not be invoked beyond a few adjacent-skill examples. This breadth could cause unintended invocation for common news-related requests.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The file explicitly directs the agent to auto-edit and evolve stored user preferences as it learns, but it does not include any user-facing notice, consent boundary, or retention/update controls. In a personalization skill, silent modification of persistent preference data can undermine user expectations, create privacy/compliance issues, and cause the agent to act on inferred preferences the user did not knowingly approve.

Natural-Language Policy Violations

Medium

Confidence: 87% confidence
Finding: Line L49 states 'Default: mirror the register of the user's own messages,' which imposes a language/style behavior automatically rather than offering the user a choice. Under the policy, language or locale constraints should not be forced without opt-in unless clearly justified.

Static analysis

No suspicious patterns detected.