Security audit
Security checks for vulnerabilities and agentic risk
This freelance-advice skill is not malicious, but it automatically reads, writes, moves, and deletes persistent business records without a fresh approval step.
Install only if you are comfortable with the skill maintaining local business memory automatically. Before using it on real records, back up ~/Clawic/data and require explicit approval for migrations, deletions, shared contact or finance updates, and dispute notes about people or clients.
SKILL.md:36Automatic Broad Access to Persistent and Cross-Skill Business Records
memory-template.md:54Automatic Migration and Destructive Record Reorganization Without Prior Approval
The instruction at line 116 tells the agent to persist assessment conclusions and supporting reasoning into specific local files, which expands the skill from advisory analysis into state-changing record modification. That is dangerous because it can alter long-lived user data without an explicit per-action confirmation, and incorrect or premature classifications could be memorialized and later relied upon as if authoritative.
The file directs the agent to maintain ongoing memory and due-date tracking records, creating durable state beyond what is needed for one-off classification guidance. This increases risk because the agent may accumulate, mutate, and rely on user records over time, causing privacy issues, stale decisions, or workflow changes unrelated to the immediate advisory task.
The skill instructs the agent to write to memory and artifact files without any user-facing notice that local data will be modified. This is unsafe because silent persistence undermines user expectations and can lead to unauthorized changes, especially in environments where the agent has filesystem access and the saved data may influence later actions or decisions.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
| Unlimited revisions or "until satisfied" | Unbounded work at a fixed price | A revision count and a price per further round |
| Non-solicit of the client's staff and clients | Often reasonable; over-broad versions block your whole sector | Limit to people you actually worked with, 12 months |
| Governing law and venue on the far side of the world | Recovery becomes economically impossible | Your jurisdiction, or a neutral one with an arbitration or mediation step |
| Assignment of the contract without consent | You end up working for a company you did not choose | Consent required, not unreasonably withheld |
| Their insurance requirement | Sometimes exceeds what a solo can buy at a sane price | Negotiate the limit to what is proportionate (`insurance.md`) |
**Negotiating stance**: pick the top three for the size of the deal and concede the rest gracefully. A freelancer who red-lines eleven clauses on a 4,000 project reads as expensive to work with; one who calmly caps liability and fixes IP reads as professional.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
| Unlimited revisions or "until satisfied" | Unbounded work at a fixed price | A revision count and a price per further round |
| Non-solicit of the client's staff and clients | Often reasonable; over-broad versions block your whole sector | Limit to people you actually worked with, 12 months |
| Governing law and venue on the far side of the world | Recovery becomes economically impossible | Your jurisdiction, or a neutral one with an arbitration or mediation step |
| Assignment of the contract without consent | You end up working for a company you did not choose | Consent required, not unreasonably withheld |
| Their insurance requirement | Sometimes exceeds what a solo can buy at a sane price | Negotiate the limit to what is proportionate (`insurance.md`) |
**Negotiating stance**: pick the top three for the size of the deal and concede the rest gracefully. A freelancer who red-lines eleven clauses on a 4,000 project reads as expensive to work with; one who calmly caps liability and fixes IP reads as professional.
The guidance instructs recording dispute details in shared contact records but does not include an explicit privacy, confidentiality, or access-control warning. In a business-dispute context, these notes can contain sensitive financial, legal, or reputational information, and writing them into a shared file increases the chance of over-collection, unauthorized access, and long-lived misuse.
The template explicitly authorizes autonomous writes and deletions ('No permission needed') and describes deletion behavior, which can cause the agent to modify or remove user data without a fresh, explicit confirmation at action time. In a memory-management skill that touches shared files and supports section/file deletion during splits, this increases the risk of unintended destructive changes from prompt misunderstanding, stale context, or adversarially supplied content.
The skill explicitly instructs the agent to write new people into a shared contacts database outside the immediate task of giving freelance pipeline advice. Cross-skill or global contact-store modification can create unauthorized persistence of personal data and scope creep, especially if the user did not explicitly request storing or syncing that information.
The file directs updates to shared memory and contacts files containing personal/contact information without any user-facing notice, confirmation, or minimization guidance. That creates a privacy and transparency risk because the agent may persist sensitive business relationship data across sessions or tools without the user's informed approval.
The skill goes beyond presenting trade norms and instructs the agent to persistently modify config.yaml, memory.md, and create files under artifacts/. Persistent writes can alter future agent behavior, store unvetted user-derived data, and create long-lived state changes unrelated to the immediate response. In an agent environment, this is dangerous because a content/reference file is effectively requesting side effects and state mutation without an explicit authorization boundary.
The document tells the agent to write user-derived conventions, benchmarks, and trade information into persistent local files without warning, confirmation, or any discussion of permanence. This can cause silent retention of sensitive business information and contaminate future interactions with stale or manipulated state. The danger is higher because these writes are framed as routine behavior rather than exceptional actions requiring consent.
The skill tells the agent to mark a shared contacts file with negative client dispute context, which creates a durable reputational record outside the immediate dispute workflow. Even though it says to keep notes factual and avoid slurs, this still risks unnecessary propagation of sensitive allegations or commercially harmful information to broader shared systems without a clear need-to-know boundary.
The skill explicitly instructs writing decision details to files under ~/Clawic/data/freelance/... without any warning, confirmation, or indication that local records will be modified. While the content is business-oriented rather than overtly harmful, silent persistence to user files can cause unintended data modification, privacy issues, or overwrite/record-retention problems if an agent follows the instruction automatically.
The instruction to create reusable artifact documents expands the skill's behavior from advisory guidance into generating persistent files. That capability is not necessary for merely applying trade norms and increases the attack surface by enabling durable content creation that could later influence outputs or store unsafe material. Even if intended as convenience, it introduces unnecessary stateful side effects.
No suspicious patterns detected.