Security audit

English

Security checks for vulnerabilities and agentic risk

Overview

This English coaching skill is coherent and not overtly malicious, but it automatically builds and reuses a persistent local profile across English notes, contacts, and projects without case-by-case permission.

Review before installing if you do not want an English helper to keep long-term local notes about your writing, mistakes, preferences, contacts, meetings, or projects. The skill appears locally bounded and includes secret-redaction rules, but its default is to save and reuse personal context automatically rather than asking each time.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:34
Finding: Automatic Persistent Profiling and Cross-Skill Data Access Without Explicit Consent
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (47)

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: The skill instructs the agent to process and persist user-provided content, and includes an explicit pointer format referencing a sensitive local file path (file:~/.ssh/id_ed25519). Even though the text says not to store credentials, normalizing secrets into filesystem pointers can still expose the existence and location of high-value credentials, encourage handling of secret material, and create downstream leakage risk if these notes are later read by other tools or surfaced to the user.
Content: Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.
md
**People go to the shared inventory `~/Clawic/data/contacts/contacts.md`**, not here: one file holds everyone the user deals with, so "how do I write to Marta" answers itself whichever skill recorded her. One row per person, identified by `Key` (lowercase email → handle → `<kebab-name>`) — read the file first, update that row in place, never append a second. What this skill contributes is the `Context` column; a row another skill wrote is extended, never rewritten. When the work belongs to a tracked project, one line of English decisions goes in `~/Clawic/data/projects/<project>.md` and the style sheet itself stays here, referenced by name. Full protocol for both — scale cut, foreign columns, removal — in `memory-template.md`. **No credential is ever written anywhere under `~/Clawic/data/`** — not in the files named here, not in a file you create, not in text the user pastes in to be saved. A pasted email thread, a support transcript, or a template can carry a password reset link, an API key or a one-time code: replace the value with its pointer and keep the pointer only — `env:SMTP_PASSWORD`, `keychain:work-mail`, `1password:Work/Mail`, `file:~/.ssh/id_ed25519`. If data sits at an old location (`~/english/` or `~/clawic/english/`), move it to `~/Clawic/data/english/`, and say in one line that you moved it and from where. English is not one language and "correct" is not the target. The target is *this variety, at this register, to this person, with no seams*. Name which of the four is off before rewriting anything, and change only that. Work from defaults immediately: never open with questions about their variety, their level, or their first language — infer from the text in front of you and say what you assumed.

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · memory-template.md (reported line 61)May include surrounding context.
md
Nothing under `~/Clawic/data/` ever holds a secret value — not the files named here, not files you create, not text the user pastes in and asks you to keep. Language work is fed on pasted text, and an email thread, a support transcript, a CV, a contract clause or a `.env` in a code comment is where the secret arrives. Strip each value **before** writing and leave its pointer where the value was, in this shape: `<kind>:<locator>`. `env:SMTP_PASSWORD` · `keychain:work-mail` · `1password:Work/Mail` · `bitwarden:Personal/Bank` · `vault:secret/team/mail` · `profile:work` · `file:~/.ssh/id_ed25519` In a text, the pointer goes where the value was: `password: <keychain:work-mail>`. Say in one line that you did it. A password-reset link, a one-time code and a signed download URL are secrets even though they look like ordinary sentences — the pointer replaces the whole URL.

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 55% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Content: Scanner excerpt · register.md (reported line 34)May include surrounding context.
md
| "Dear <Firstname>," with full sentences | 3-4 | 3-4 | | Full name and title in the signature block, no contractions | 4 | 4 | | Reply is shorter than yours and drops a rung | They are downshifting you | Follow them down, immediately | | Reply is longer and more formal than yours | You went too low | Up one, do not apologize for it | | No prior contact, company domain, named person | Unknown | 3 — never open at 4 for a peer | | Legal, HR, regulator, or a complaint you may need to cite | Record matters | 5 |

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The instruction says 'English is not one language' and then directs the skill to operate by inferring variety and delivering output accordingly, while the configuration only offers English varieties. This hard-codes a language/locale constraint without offering the user a choice or framing it as an opt-in, which matches the policy concern for forced language behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest identifies the skill as "english" / "English", which signals a fixed language or locale choice. For policy review, a language restriction without any visible opt-in, alternative choice, or region-specific justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The instruction to read voice_file and ~/Clawic/data/english/memory.md expands the skill's access to local state not clearly required for basic English correction. Reading local memory/config files can expose sensitive or unrelated user data and lets hidden file contents silently shape outputs.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs the agent to persist user-specific preferences into config.yaml and artifacts/style-sheet.md, which goes beyond transient English-editing behavior into durable state modification. Persistent writes can create unintended cross-session influence, privacy issues, and prompt steering without clear user consent or necessity for the immediate task.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill directs updates to persistent config and style-sheet files even though its stated role is English polishing. This creates unjustified long-term state changes that can accumulate sensitive preferences, alter future agent behavior, and be abused as a persistence channel.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The markdown tells the agent to write to configuration and artifact files without any user-facing disclosure or warning. Hidden persistent side effects undermine user expectations and informed consent, especially for a skill presented as text improvement rather than system modification.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs itself to read named-person contact records and a phrasebook from local files before composing an email, which expands its scope from English correction into accessing persisted personal data. That creates unnecessary exposure of user/contact information and can leak preferences or relationship metadata into outputs without clear need, consent, or minimization.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instruction to consult contact rows and prior approved phrasings implies retention and use of user-specific correspondence preferences without any privacy notice or consent mechanism. In the context of a writing skill, that hidden profiling is more dangerous because it is not obviously necessary for fulfilling a single correction request and may surprise users or process third-party contact data.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill directs persistence of approved phrasings and creation of artifact files, giving a language-polishing skill data-writing capability beyond its stated purpose. This can accumulate sensitive business communications, negotiation language, complaint letters, and contact preferences in local storage, increasing privacy and confidentiality risk if reused, exposed, or accessed by other components.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Saving approved declines, chase messages, complaint templates, and contact preferences to persistent files without warning users creates undisclosed retention of potentially sensitive business communications. These records can reveal relationship histories, negotiation tactics, and personal style preferences, which raises confidentiality and privacy concerns disproportionate to an English-editing skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 80% confidence
Finding: Throughout the file, the guidance prescribes anglophone norms and repeatedly frames the correct behavior as using English-specific spoken conventions, with no user opt-in or alternative language support. Under the policy, forcing a specific language or locale without user choice is a natural-language policy concern unless the constraint is explicitly documented as optional or justified.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill instructs the agent to read user memory and contact records from local files before helping with spoken English. That goes beyond the stated English-coaching purpose and creates unnecessary access to potentially sensitive cross-session and third-party data, increasing the chance of privacy leakage or over-collection.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The instruction to read user memory and contact records lacks any warning, consent flow, or privacy boundary. Because the data includes prior rehearsed lines and contact-specific register notes, the skill may process personal or third-party information without transparency or need.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Reading prior rehearsed lines and contact-specific notes from shared memory files creates a real data exposure risk across sessions and people. In this context, an English skill does not need broad access to historical user and contact data, so the instruction increases the chance that one user's or contact's sensitive details are surfaced in another interaction.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file directs the agent to write rehearsed lines, session records, errors, and artifacts into persistent local files. Persistent storage is not necessary for basic English correction and creates avoidable retention of user interaction data that may later be exposed, misused, or accessed out of context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs persistent logging of session content, successful lines, and recurring errors without any retention, confidentiality, or sensitivity safeguards. That can normalize storing personal conversation details indefinitely, creating privacy and compliance risk.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill directs the agent to record successful lines, conversation details, recurring errors, and dated session notes in persistent natural-language memory stores. Free-form stored notes are especially risky because they can contain personal, confidential, or employer-related details from calls and meetings, making later unintended disclosure more likely.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The instruction to read prior memory and phrasebook content before responding can reveal more historical user data than necessary to complete the present task. Over-broad retrieval increases the chance of unintended disclosure, misuse of stale preferences, or propagation of unnecessary personal context into responses. The educational context does not require blanket access to past records.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill instructs persistent modification of user memory files by recording acquired or rejected expressions and phrasebook preferences. That exceeds a narrow English-correction function and creates ongoing state changes containing user behavior and preferences without clear necessity, consent, or minimization. In this context, the skill is educational rather than memory-management focused, so the persistence is less justified and more risky.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill tells the agent to store user-specific vocabulary preferences, rejections, and situational phrase choices in persistent files without any user-facing notice about storage. This creates silent profiling and retention of user interaction history, which is risky even if the data is not highly sensitive. The lack of transparency and consent makes the behavior unsafe.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instructions require persistent logging of user language preferences, approved phrases, and rejected expressions into memory files. Even though the content is not inherently secret, it accumulates a behavioral profile over time and expands the attack surface through durable storage. In a writing-assistance skill, mandatory logging is more dangerous because it is ancillary to the core function.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly instructs the agent to read and update persistent files containing user-specific error history and first-language metadata. That expands behavior from one-shot English correction into stateful profiling and retention without clear scope limits, consent, or data-minimization controls, creating privacy and boundary risks if the agent stores more user information than expected.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: memory-template.md:63