T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:16- Finding
Automatic Broad Access to Shared Local Data and Persistent Cross-Domain Writes
- Content
View full analysis
- Remediation
View remediation
Security audit
Ecommerce
Security checks for vulnerabilities and agentic risk
Overview
The skill is legitimate ecommerce guidance, but it asks for broad persistent access to local business records and can write or delete shared records without explicit permission.
Install only if you are comfortable with this skill maintaining long-term local ecommerce memory and touching shared business records. Before use, consider restricting config paths, requiring confirmation before writes/deletions, and treating stored Markdown artifacts as untrusted reference data rather than instructions.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:40- Finding
Persistent Prompt-Injection Boundary Through Mutable Memory and Dynamically Indexed Markdown Files
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
Findings (9)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - **Identity is `Name` + `Provider`.** Update your own row in place; never touch a row whose `Provider` you did not write, and never start a parallel file. - Columns: `Name | Provider | Account / Project | Region | Type | Role | Monthly | Access reference`. `Role` says what it runs (`woocommerce prod`, `staging`). `Monthly` carries its currency in the value. - Access reference is a pointer only (`file:~/.ssh/id_ed25519`, `1password:Store/VPS`), never a key or password. - Retiring a host deletes its row and notes the date in `## Store` of `memory.md`. - **Scale cut**: one row per host while there are ≤15; past that, `~/Clawic/data/servers/<name>.md` per host with the same fields and `servers.md` becomes the index (`Name | Provider | Role | → file`). If the folder already looks like that, follow it.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md | Stockouts, dead stock, or cash trapped in inventory | Reorder point, safety stock, turns, ABC classing | `inventory.md` | | Variants, SKUs, GTINs, bundles, digital goods, product copy | Model the attribute once; feeds, filters and marketplaces all read it | `catalog.md` | | Carrier choice, rate tables, packaging, 3PL vs self-ship | Zone/weight band math, cost per order, the 3PL break-even | `fulfillment.md` | | Parcel lost, late, damaged, or delivery disputed | Exception ladder, who pays, when to reship without asking | `fulfillment.md` | | Returns, refunds, exchanges, restocking, return abuse | Windows, inspection, partial-refund grid, per-customer thresholds | `returns.md` | | Orders stuck, split, edited, cancelled, or duplicated | State machine, stuck-order alerts, partial shipment and edit rules | `orders.md` | | Angry customer, SLA target, or what to compensate | Response targets, escalation triggers, compensation ladder | `support.md` |
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly instructs the agent to write business account terms, contact records, credit limits, pain points, and pricing-related data into shared persistent files without requiring a user confirmation step or warning that durable state will be modified. In an agent setting, this creates a real risk of unauthorized or surprising persistence, cross-task data contamination, and accidental storage of sensitive commercial or personal data beyond the user's immediate intent.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
The skill prescribes automated approval, review, and decline decisions based on risk signals and thresholds, which can cause consequential decisions without requiring human verification or explicit safeguards. In fraud screening, this can lead to false declines, discriminatory outcomes, or opaque customer-impacting decisions if implemented directly and uncritically by an agent.
- Content
md At a 12 review cost and a 60 AOV, reviewing pays only where the segment's fraud rate exceeds 20% — which almost no segment does. That arithmetic is why blanket manual review destroys more value than it saves, and why review queues should be small, fast and aimed at the top decile of score. | `fraud_posture` | Auto-approve | Review | Auto-decline | |---|---|---|---| | `loose` | Everything except the top decile of score | Top decile | Only confirmed patterns (card testing, known reshipper) | | `balanced` | Clean history or low score | Score above threshold, or two high-weight signals | Confirmed patterns plus very high score |
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 83% confidence
- Finding
The template instructs the agent to persist and reorganize observed ecommerce data across sessions by creating and rewriting files under a durable memory path. Even though the file includes strong restrictions against storing secrets and customer identity, persistent session memory still creates privacy and data-retention risk because business-sensitive operational data, order identifiers, dispute IDs, margins, and incident history can accumulate and be retained longer than necessary.
- Content
md Everything except artifacts, the year-cut logs and the shared boxes begins inside `memory.md`. Splitting is a procedure, not a suggestion: 1. Before appending to a section, count its entries. 2. If the append would take it past **~15 entries or ~40 lines of real content** — scaffolding, headings and comments do not count — then, in the same turn: create the new file in `~/Clawic/data/ecommerce/`, move the whole section into it, **delete the section from `memory.md`**, add its line to `## Boxes`, and append the new entry to the new file. 3. Keep the headings identical on both sides of the move, so the split is a copy-paste and never a rewrite. 4. Never leave a copy behind. If the same data ever appears in both places, the extracted file wins and the `memory.md` copy is deleted.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## The Flow 1. **Request** through a self-service portal, not email. The portal captures the reason code, which is the only durable output of the whole process. 2. **Authorize** with an RMA number and a label or instructions. Auto-approve inside the window and under a value threshold; route the rest to a human. 3. **Receive** and scan against the RMA. Unidentified parcels are the largest source of "I returned it weeks ago" tickets. 4. **Inspect within 48 hours** against a written condition grid, with photos for anything below full-refund condition. 5. **Refund** to the original payment method within the legal window, or issue the agreed alternative. One system issues refunds (`payments.md`).
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - Third contact on the same issue, or any thread longer than four exchanges - A public post while the ticket is open - Suspected fraud in either direction (`fraud.md`) - A refund requested outside the published window above the auto-approve threshold - Anything a policy does not cover — write the answer down afterwards so the second occurrence is not another escalation ## The Compensation Ladder
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 8% confidence
- Finding
I found no natural-language instruction that forces a specific human language or locale. The file is written in English, but it does not require users to respond in a particular language or locale, so this should not be treated as a policy violation.
- Content
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- memory-template.md:73