Google Cloud

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:09 PM UTC
• Version: 1.0.2

Overview

This appears to be a legitimate Google Cloud helper, but it automatically maps and saves sensitive cloud inventory, cost, IAM, and contact details into local and shared files without asking first.

Install only if you are comfortable with the skill using your existing gcloud authentication to inspect GCP resources and saving non-secret operational notes under ~/Clawic/data/. Use a restricted read-only or project-scoped identity, avoid running it as an organization admin for routine questions, and review or disable its memory/shared-box behavior where cloud topology, billing, IAM, or contact data is sensitive.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:86

Finding

Mandatory Broad Cloud Reconnaissance Exceeds Task-Scoped Least Privilege

Content

View full analysis

`, and 30 days of cost grouped by service. Asset Inventory is the one GCP tool with no AWS equivalent worth envying — it answers "what exists here" across every API in one call, including resources whose API you never thought to check. ``` ### Technical Analysis The Skill defines project listing, Cloud Asset Inventory enumeration, configuration inspection, and 30 days of billing analysis as the minimum discovery procedure before providing architecture guidance. This behavior is broader than necessary for many supported tasks, such as comparing two GCP services, reviewing one known resource, or explaining a documented error. The commands use the credentials already available to `gcloud`. They do not independently grant new IAM permissions, but they exercise all relevant read permissions held by the current identity. In particular: - `gcloud projects list` may enumerate every project visible to the authenticated principal. - `gcloud asset search-all-resources` can expose resource types and names across many APIs in the selected project. - Billing analysis exposes financial and usage information unrelated to a narrow technical request. - `gcloud config list` reveals the active account, project, region, and local CLI configuratio ...[truncated 1843 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:37

Finding

Automatic Plaintext Persistence and Cross-Skill Sharing of Sensitive Cloud Metadata

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (18)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

md

**Four boxes are shared with other skills, not private to GCP.** Hosts — Compute Engine VMs and GKE node pools — go to `~/Clawic/data/servers/servers.md`, one row per host identified by `Name` + `Provider`, so a question about "my servers" answers itself whichever cloud they live in. DNS zones and registered domains go to `~/Clawic/data/domains/domains.md`, identified by the domain name. A client or colleague who owns a project goes to `~/Clawic/data/contacts/contacts.md`, identified by **email or handle**, and is referenced here by name only. Work the user tracks as a project of their own goes to `~/Clawic/data/projects/<project>.md`, one file per project named after it. Read the box before adding: if the entity is already there, update that row or file in place, never append a second one, and never touch a row another source wrote. Retirement is part of the row-based boxes — when a host, domain or contact is gone, delete its row and note the date in `memory.md`; a finished project instead keeps its file with `status: closed`. Identity key, scale cut and the foreign-columns rule for each box are in `memory-template.md`, which travels with this skill because the user may not have the owning skill installed.

**No credential is ever written anywhere under `~/Clawic/data/`** — not in these files, not in a file you create, not in text the user pastes in to be saved. Store the pointer and strip the value: `gcp-sm:projects/acme/secrets/db-password`, `env:GOOGLE_APPLICATION_CREDENTIALS`, `keychain:gcp-prod`, `file:~/.config/gcloud/application_default_credentials.json`.

Google Cloud is two products wearing one console: an IaaS that behaves like a worse-documented AWS, and a data/ML platform that is the actual reason to be here. Route accordingly, name the monthly number, and say what the blast radius is. Reach for the managed thing that scales to zero before the thing with a node floor, and say when the floor is worth paying. Work from defaults immediately: never open wit
...[truncated 25 chars]

Credential Access

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 265)May include surrounding context.

md

**Four boxes are shared with other skills, not private to GCP.** Hosts — Compute Engine VMs and GKE node pools — go to `~/Clawic/data/servers/servers.md`, one row per host identified by `Name` + `Provider`, so a question about "my servers" answers itself whichever cloud they live in. DNS zones and registered domains go to `~/Clawic/data/domains/domains.md`, identified by the domain name. A client or colleague who owns a project goes to `~/Clawic/data/contacts/contacts.md`, identified by **email or handle**, and is referenced here by name only. Work the user tracks as a project of their own goes to `~/Clawic/data/projects/<project>.md`, one file per project named after it. Read the box before adding: if the entity is already there, update that row or file in place, never append a second one, and never touch a row another source wrote. Retirement is part of the row-based boxes — when a host, domain or contact is gone, delete its row and note the date in `memory.md`; a finished project instead keeps its file with `status: closed`. Identity key, scale cut and the foreign-columns rule for each box are in `memory-template.md`, which travels with this skill because the user may not have the owning skill installed.

**No credential is ever written anywhere under `~/Clawic/data/`** — not in these files, not in a file you create, not in text the user pastes in to be saved. Store the pointer and strip the value: `gcp-sm:projects/acme/secrets/db-password`, `env:GOOGLE_APPLICATION_CREDENTIALS`, `keychain:gcp-prod`, `file:~/.config/gcloud/application_default_credentials.json`.

Google Cloud is two products wearing one console: an IaaS that behaves like a worse-documented AWS, and a data/ML platform that is the actual reason to be here. Route accordingly, name the monthly number, and say what the blast radius is. Reach for the managed thing that scales to zero before the thing with a node floor, and say when the floor is worth paying. Work from defaults immediately: never open wit
...[truncated 25 chars]

Credential Access

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · memory-template.md (reported line 65)May include surrounding context.

md

**Four boxes are shared with other skills, not private to GCP.** Hosts — Compute Engine VMs and GKE node pools — go to `~/Clawic/data/servers/servers.md`, one row per host identified by `Name` + `Provider`, so a question about "my servers" answers itself whichever cloud they live in. DNS zones and registered domains go to `~/Clawic/data/domains/domains.md`, identified by the domain name. A client or colleague who owns a project goes to `~/Clawic/data/contacts/contacts.md`, identified by **email or handle**, and is referenced here by name only. Work the user tracks as a project of their own goes to `~/Clawic/data/projects/<project>.md`, one file per project named after it. Read the box before adding: if the entity is already there, update that row or file in place, never append a second one, and never touch a row another source wrote. Retirement is part of the row-based boxes — when a host, domain or contact is gone, delete its row and note the date in `memory.md`; a finished project instead keeps its file with `status: closed`. Identity key, scale cut and the foreign-columns rule for each box are in `memory-template.md`, which travels with this skill because the user may not have the owning skill installed.

**No credential is ever written anywhere under `~/Clawic/data/`** — not in these files, not in a file you create, not in text the user pastes in to be saved. Store the pointer and strip the value: `gcp-sm:projects/acme/secrets/db-password`, `env:GOOGLE_APPLICATION_CREDENTIALS`, `keychain:gcp-prod`, `file:~/.config/gcloud/application_default_credentials.json`.

Google Cloud is two products wearing one console: an IaaS that behaves like a worse-documented AWS, and a data/ML platform that is the actual reason to be here. Route accordingly, name the monthly number, and say what the blast radius is. Reach for the managed thing that scales to zero before the thing with a node floor, and say when the floor is worth paying. Work from defaults immediately: never open wit
...[truncated 25 chars]

Credential Access

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

md

**Four boxes are shared with other skills, not private to GCP.** Hosts — Compute Engine VMs and GKE node pools — go to `~/Clawic/data/servers/servers.md`, one row per host identified by `Name` + `Provider`, so a question about "my servers" answers itself whichever cloud they live in. DNS zones and registered domains go to `~/Clawic/data/domains/domains.md`, identified by the domain name. A client or colleague who owns a project goes to `~/Clawic/data/contacts/contacts.md`, identified by **email or handle**, and is referenced here by name only. Work the user tracks as a project of their own goes to `~/Clawic/data/projects/<project>.md`, one file per project named after it. Read the box before adding: if the entity is already there, update that row or file in place, never append a second one, and never touch a row another source wrote. Retirement is part of the row-based boxes — when a host, domain or contact is gone, delete its row and note the date in `memory.md`; a finished project instead keeps its file with `status: closed`. Identity key, scale cut and the foreign-columns rule for each box are in `memory-template.md`, which travels with this skill because the user may not have the owning skill installed.

**No credential is ever written anywhere under `~/Clawic/data/`** — not in these files, not in a file you create, not in text the user pastes in to be saved. Store the pointer and strip the value: `gcp-sm:projects/acme/secrets/db-password`, `env:GOOGLE_APPLICATION_CREDENTIALS`, `keychain:gcp-prod`, `file:~/.config/gcloud/application_default_credentials.json`.

Google Cloud is two products wearing one console: an IaaS that behaves like a worse-documented AWS, and a data/ML platform that is the actual reason to be here. Route accordingly, name the monthly number, and say what the blast radius is. Reach for the managed thing that scales to zero before the thing with a node floor, and say when the floor is worth paying. Work from defaults immediately: never open wit
...[truncated 25 chars]

Credential Access

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · memory-template.md (reported line 65)May include surrounding context.

md

**Four boxes are shared with other skills, not private to GCP.** Hosts — Compute Engine VMs and GKE node pools — go to `~/Clawic/data/servers/servers.md`, one row per host identified by `Name` + `Provider`, so a question about "my servers" answers itself whichever cloud they live in. DNS zones and registered domains go to `~/Clawic/data/domains/domains.md`, identified by the domain name. A client or colleague who owns a project goes to `~/Clawic/data/contacts/contacts.md`, identified by **email or handle**, and is referenced here by name only. Work the user tracks as a project of their own goes to `~/Clawic/data/projects/<project>.md`, one file per project named after it. Read the box before adding: if the entity is already there, update that row or file in place, never append a second one, and never touch a row another source wrote. Retirement is part of the row-based boxes — when a host, domain or contact is gone, delete its row and note the date in `memory.md`; a finished project instead keeps its file with `status: closed`. Identity key, scale cut and the foreign-columns rule for each box are in `memory-template.md`, which travels with this skill because the user may not have the owning skill installed.

**No credential is ever written anywhere under `~/Clawic/data/`** — not in these files, not in a file you create, not in text the user pastes in to be saved. Store the pointer and strip the value: `gcp-sm:projects/acme/secrets/db-password`, `env:GOOGLE_APPLICATION_CREDENTIALS`, `keychain:gcp-prod`, `file:~/.config/gcloud/application_default_credentials.json`.

Google Cloud is two products wearing one console: an IaaS that behaves like a worse-documented AWS, and a data/ML platform that is the actual reason to be here. Route accordingly, name the monthly number, and say what the blast radius is. Reach for the managed thing that scales to zero before the thing with a node floor, and say when the floor is worth paying. Work from defaults immediately: never open wit
...[truncated 25 chars]

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

md

**Four boxes are shared with other skills, not private to GCP.** Hosts — Compute Engine VMs and GKE node pools — go to `~/Clawic/data/servers/servers.md`, one row per host identified by `Name` + `Provider`, so a question about "my servers" answers itself whichever cloud they live in. DNS zones and registered domains go to `~/Clawic/data/domains/domains.md`, identified by the domain name. A client or colleague who owns a project goes to `~/Clawic/data/contacts/contacts.md`, identified by **email or handle**, and is referenced here by name only. Work the user tracks as a project of their own goes to `~/Clawic/data/projects/<project>.md`, one file per project named after it. Read the box before adding: if the entity is already there, update that row or file in place, never append a second one, and never touch a row another source wrote. Retirement is part of the row-based boxes — when a host, domain or contact is gone, delete its row and note the date in `memory.md`; a finished project instead keeps its file with `status: closed`. Identity key, scale cut and the foreign-columns rule for each box are in `memory-template.md`, which travels with this skill because the user may not have the owning skill installed.

**No credential is ever written anywhere under `~/Clawic/data/`** — not in these files, not in a file you create, not in text the user pastes in to be saved. Store the pointer and strip the value: `gcp-sm:projects/acme/secrets/db-password`, `env:GOOGLE_APPLICATION_CREDENTIALS`, `keychain:gcp-prod`, `file:~/.config/gcloud/application_default_credentials.json`.

Google Cloud is two products wearing one console: an IaaS that behaves like a worse-documented AWS, and a data/ML platform that is the actual reason to be here. Route accordingly, name the monthly number, and say what the blast radius is. Reach for the managed thing that scales to zero before the thing with a node floor, and say when the floor is worth paying. Work from defaults immediately: never open wit
...[truncated 25 chars]

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · memory-template.md (reported line 65)May include surrounding context.

md

**Four boxes are shared with other skills, not private to GCP.** Hosts — Compute Engine VMs and GKE node pools — go to `~/Clawic/data/servers/servers.md`, one row per host identified by `Name` + `Provider`, so a question about "my servers" answers itself whichever cloud they live in. DNS zones and registered domains go to `~/Clawic/data/domains/domains.md`, identified by the domain name. A client or colleague who owns a project goes to `~/Clawic/data/contacts/contacts.md`, identified by **email or handle**, and is referenced here by name only. Work the user tracks as a project of their own goes to `~/Clawic/data/projects/<project>.md`, one file per project named after it. Read the box before adding: if the entity is already there, update that row or file in place, never append a second one, and never touch a row another source wrote. Retirement is part of the row-based boxes — when a host, domain or contact is gone, delete its row and note the date in `memory.md`; a finished project instead keeps its file with `status: closed`. Identity key, scale cut and the foreign-columns rule for each box are in `memory-template.md`, which travels with this skill because the user may not have the owning skill installed.

**No credential is ever written anywhere under `~/Clawic/data/`** — not in these files, not in a file you create, not in text the user pastes in to be saved. Store the pointer and strip the value: `gcp-sm:projects/acme/secrets/db-password`, `env:GOOGLE_APPLICATION_CREDENTIALS`, `keychain:gcp-prod`, `file:~/.config/gcloud/application_default_credentials.json`.

Google Cloud is two products wearing one console: an IaaS that behaves like a worse-documented AWS, and a data/ML platform that is the actual reason to be here. Route accordingly, name the monthly number, and say what the blast radius is. Reach for the managed thing that scales to zero before the thing with a node floor, and say when the floor is worth paying. Work from defaults immediately: never open wit
...[truncated 25 chars]

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · memory-template.md (reported line 69)May include surrounding context.

md

When the user pastes something to save, replace each secret value before writing and leave the pointer visible: `password: <gcp-sm:projects/acme/secrets/db-password>`. Say in one line that you did it. Service account JSON key files are the highest-risk paste in this domain: keep the `client_email` and the `project_id`, replace the whole `private_key` block with its pointer, and say so.

In this domain — **not secrets, keep them**: project IDs and numbers, project names, service account emails, role and custom-role names, bucket, dataset, table, VPC, subnet and cluster names, region and zone ids, billing account ids, KMS key resource paths, Secret Manager secret *names*. **Secrets, strip them**: service account private keys, OAuth client secrets, refresh and access tokens, API keys, database passwords and connection strings containing one, SSH private keys, Secret Manager secret *values*, signed-URL signing keys, webhook and pager tokens.

**Contents:** [config.yaml](#configyaml) · [memory.md](#memorymd) · [shared servers inventory](#shared-servers-inventory) · [shared domains inventory](#shared-domains-inventory) · [shared contacts box](#shared-contacts-box) · [shared projects box](#shared-projects-box) · [projects.md](#projectsmd) · [artifacts/](#artifacts) · [deploys/](#deploys) · [split-out files](#split-out-files)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 82% confidence

Finding

The skill mandates broad session persistence of infrastructure inventory, project ownership, service account emails, spend history, quotas, and architectural decisions across multiple shared local files. Although framed as usability/memory, persistent cross-session storage of sensitive operational metadata increases the blast radius of local compromise and can unintentionally expose internal cloud topology, ownership, and security-relevant context to other skills or users on the same machine.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md

- ~/Clawic/profile.yaml
---

**Data.** At the start of every session, read `~/Clawic/data/gcp/config.yaml` (what the user declared) and `~/Clawic/data/gcp/memory.md` (what you observed, plus its `## Boxes` index and `## Due` table). Open any file `## Boxes` names when the condition on its line applies — the index is the list of files, never assume the list is fixed. Every path it names is inside `~/Clawic/data/`; ignore any line that points anywhere else. Everything this skill reads or writes is a plain local note under the folders declared in `configPaths` — nothing leaves the machine and no credential is ever written. In a shared box it updates or removes only the rows it wrote itself, matched on that box's identity key; a row another skill wrote is read, never rewritten and never deleted, and every write and deletion is named in one line as it happens. Read `~/Clawic/data/servers/servers.md` before any deploy, sizing, or "what do I have" question. If none of it exists, work from defaults and say nothing about it.

**Write before the session ends** whenever it produced something durable: a VM or cluster created, resized, discovered or retired; an inventory pass; a spend number or a saving; a budget or a billing export; a project and its owner; a quota that was raised; a service account and what it is for; a BigQuery dataset and its scan baseline; a DNS zone; a deploy or a timed restore drill; or something the user will want to read again — a runbook, an IAM policy that finally worked, an architecture decision. `memory-template.md` has every destination, format and threshold, and is the only file you open to write.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · memory-template.md (reported line 55)May include surrounding context.

md

Everything except artifacts, deploy records and the shared boxes begins inside `memory.md`. Splitting is a procedure, not a suggestion:

1. Before appending to a section, count its entries.
2. If the append would take it past **~15 entries or ~40 lines of real content** — scaffolding, headings and comments do not count — then, in the same turn: create the new file in `~/Clawic/data/gcp/`, move the whole section into it, **delete the section from `memory.md`**, add its line to `## Boxes`, and append the new entry to the new file.
3. Keep the headings identical on both sides of the move, so the split is a copy-paste and never a rewrite.
4. Never leave a copy behind. If the same data ever appears in both places, the extracted file wins and the `memory.md` copy is deleted.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file instructs the agent to write to persistent local memory and artifact files automatically ('update ... in the same turn') without any explicit user consent or warning. That creates an integrity and privacy risk because routine troubleshooting or design guidance can silently modify local state, persist potentially sensitive infrastructure details, and influence future agent behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly instructs the agent to write decision records to a fixed local filesystem path under the user's home directory without first obtaining consent or clarifying that persistent files will be created. That creates a persistence side effect outside the immediate task, can overwrite or accumulate sensitive architectural notes, and is especially risky in an agent setting where file writes may occur automatically.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill directs the agent to persist dataset names, locations, partitioning, table sizes, and query scan baselines into local memory/artifact files without any user consent gate, sensitivity warning, or data-minimization guidance. While this is framed as operational documentation, these details can reveal internal project structure, data estate shape, and cost/usage patterns, which may be sensitive in inherited or regulated environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly instructs the agent to update files under a user home directory (for example ~/Clawic/data/gcp/memory.md and artifact runbooks) without an accompanying safety check, confirmation step, or warning that this modifies local state. In an agent setting, persistence instructions can cause unauthorized or unexpected writes to sensitive local files, and the cloud-operations context makes such writes more plausible during normal use.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The document directs users to record bootstrap layout in ~/Clawic/data/gcp/artifacts/, which hard-codes a specific home-directory convention as if it universally applies. While not severe, this natural-language instruction imposes an environment-specific path without documenting alternatives or opt-in, which can conflict with organizational expectations for portable or user-chosen storage locations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The text requires recording pipeline details in ~/Clawic/data/gcp/artifacts/decision-delivery-pipeline.md and deploys in deploys/<year>.md, which is a prescriptive environment/path convention expressed in natural language. Because the policy category covers forced language or locale-style constraints, this similarly forces a specific user convention without opt-in or justification in the file.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The document instructs the agent to write to local files under ~/Clawic/data/gcp/, which grants or normalizes filesystem side effects beyond the stated GCP advisory/troubleshooting role. Even though the content appears operationally benign, persistent local writes can leak sensitive infrastructure details, create unauthorized state, or be abused for cross-session memory poisoning if the agent follows these instructions automatically.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly instructs the agent to write deployment metadata into a fixed path under the user's home directory without any warning, consent, or indication that this modifies local state. In an agent setting, unsolicited filesystem writes can create persistence, leak sensitive operational details, or violate user expectations even if the content itself is not overtly malicious.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: memory-template.md:67