Google Cloud

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:09 PM UTC
• Version: 1.0.2

Overview

This appears to be a legitimate Google Cloud helper, but it automatically maps and saves sensitive cloud inventory, cost, IAM, and contact details into local and shared files without asking first.

Install only if you are comfortable with the skill using your existing gcloud authentication to inspect GCP resources and saving non-secret operational notes under ~/Clawic/data/. Use a restricted read-only or project-scoped identity, avoid running it as an organization admin for routine questions, and review or disable its memory/shared-box behavior where cloud topology, billing, IAM, or contact data is sensitive.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:86
• Finding: Mandatory Broad Cloud Reconnaissance Exceeds Task-Scoped Least Privilege<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:86` **Vulnerability Type**: Mandatory enumeration of GCP projects, resources, and billing data **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown 1. **Inventory before architecture.** Never propose infrastructure into an unknown project — and never rediscover a project you already mapped. Read the stored inventory first: `## Current Infrastructure` in `memory.md`, whatever its `## Boxes` line points to, and `~/Clawic/data/servers/servers.md`. Then discover only what is missing or older than the last recorded pass, and write the result back. Minimum discovery: `gcloud config list`, `gcloud projects list`, `gcloud asset search-all-resources --scope=projects/<id>`, and 30 days of cost grouped by service. Asset Inventory is the one GCP tool with no AWS equivalent worth envying — it answers "what exists here" across every API in one call, including resources whose API you never thought to check. ``` ### Technical Analysis The Skill defines project listing, Cloud Asset Inventory enumeration, configuration inspection, and 30 days of billing analysis as the minimum discovery procedure before providing architecture guidance. This behavior is broader than necessary for many supported tasks, such as comparing two GCP services, reviewing one known resource, or explaining a documented error. The commands use the credentials already available to `gcloud`. They do not independently grant new IAM permissions, but they exercise all relevant read permissions held by the current identity. In particular: - `gcloud projects list` may enumerate every project visible to the authenticated principal. - `gcloud asset search-all-resources` can expose resource types and names across many APIs in the selected project. - Billing analysis exposes financial and usage information unrelated to a narrow technical request. - `gcloud config list` reveals the active account, project, region, and local CLI configuratio ...[truncated 1843 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace mandatory full-estate discovery with task-scoped discovery: - Query only the project explicitly named by the user. - Query only resource types relevant to the request. - Avoid billing access unless the request concerns cost or capacity planning. 2. Require informed approval before broad enumeration: - State which projects, resource types, and billing periods will be queried. - Explain why each query is necessary. - Obtain explicit confirmation before organization-wide or multi-project discovery. 3. Use progressive discovery: - Begin with the user-provided resource and project. - Expand only when missing information prevents completion. - Prefer cached inventory only when the user has enabled persistent inventory. 4. Support a restricted read-only identity: - Recommend a dedicated audit identity with only the required viewer roles. - Avoid running general architecture questions under Owner, Editor, or organization-admin identities. - Separate billing access from asset inventory access. 5. Do not persist discovery output automatically. Ask separately whether the user wants an inventory record saved, and redact unnecessary identifiers before writing. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:37
• Finding: Automatic Plaintext Persistence and Cross-Skill Sharing of Sensitive Cloud Metadata<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:37-41`; `memory-template.md:5-27`; `memory-template.md:252-326` **Vulnerability Type**: Automatic plaintext retention and cross-Skill disclosure of operational and personal metadata **Risk Level**: Medium ### Vulnerable Code Snippets ```markdown **Data.** At the start of every session, read `~/Clawic/data/gcp/config.yaml` (what the user declared) and `~/Clawic/data/gcp/memory.md` (what you observed, plus its `## Boxes` index and `## Due` table). Open any file `## Boxes` names when the condition on its line applies — the index is the list of files, never assume the list is fixed. Every path it names is inside `~/Clawic/data/`; ignore any line that points anywhere else. Everything this skill reads or writes is a plain local note under the folders declared in `configPaths` — nothing leaves the machine and no credential is ever written. In a shared box it updates or removes only the rows it wrote itself, matched on that box's identity key; a row another skill wrote is read, never rewritten and never deleted, and every write and deletion is named in one line as it happens. Read `~/Clawic/data/servers/servers.md` before any deploy, sizing, or "what do I have" question. If none of it exists, work from defaults and say nothing about it. **Write before the session ends** whenever it produced something durable: a VM or cluster created, resized, discovered or retired; an inventory pass; a spend number or a saving; a budget or a billing export; a project and its owner; a quota that was raised; a service account and what it is for; a BigQuery dataset and its scan baseline; a DNS zone; a deploy or a timed restore drill; or something the user will want to read again — a runbook, an IAM policy that finally worked, an architecture decision. `memory-template.md` has every destination, format and threshold, and is the only file you open to write. **Four boxes are shared with other skills, not private to GCP.** Ho ...[truncated 7411 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit consent before persistence: - Default to session-only state. - Ask before creating or updating each persistent inventory category. - Treat cross-Skill sharing as a separate consent decision. 2. Minimize retained fields: - Avoid storing full billing-account identifiers unless essential. - Store role summaries rather than complete identity-to-role mappings. - Do not retain personal email addresses when a non-identifying team alias is sufficient. - Exclude access references, rollback targets, and policy exceptions unless operationally necessary. 3. Protect stored data: - Create directories and files with restrictive permissions, such as owner-only access. - Use encrypted storage for infrastructure, contact, billing, and IAM records. - Prevent shared directories from being readable by unrelated Skills by default. - Document and enforce the expected file ownership and permission model. 4. Add retention controls: - Define expiration periods by data type. - Automatically remove stale contact, deployment, billing, and infrastructure records after user-approved retention periods. - Provide a command to inspect, export, redact, or delete all Skill-maintained memory. - Do not retain closed projects indefinitely without explicit user approval. 5. Introduce access separation: - Keep GCP-private memory separate from shared cross-Skill boxes. - Share only minimal references rather than complete operational records. - Maintain an allowlist of Skills authorized to consume each shared record class. 6. Add safe-write controls: - Show the proposed record before writing. - Redact identifiers not needed for future operation. - Use atomic file creation with secure permissions. - Avoid following symbolic links and verify that resolved paths remain inside the approved data directories. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (18)

Credential Access

High

• Category: Privilege Escalation

Content

**Four boxes are shared with other skills, not private to GCP.** Hosts — Compute Engine VMs and GKE node pools — go to `~/Clawic/data/servers/servers.md`, one row per host identified by `Name` + `Provider`, so a question about "my servers" answers itself whichever cloud they live in. DNS zones and registered domains go to `~/Clawic/data/domains/domains.md`, identified by the domain name. A client or colleague who owns a project goes to `~/Clawic/data/contacts/contacts.md`, identified by **email or handle**, and is referenced here by name only. Work the user tracks as a project of their own goes to `~/Clawic/data/projects/<project>.md`, one file per project named after it. Read the box before adding: if the entity is already there, update that row or file in place, never append a second one, and never touch a row another source wrote. Retirement is part of the row-based boxes — when a host, domain or contact is gone, delete its row and note the date in `memory.md`; a finished project instead keeps its file with `status: closed`. Identity key, scale cut and the foreign-columns rule for each box are in `memory-template.md`, which travels with this skill because the user may not have the owning skill installed.

**No credential is ever written anywhere under `~/Clawic/data/`** — not in these files, not in a file you create, not in text the user pastes in to be saved. Store the pointer and strip the value: `gcp-sm:projects/acme/secrets/db-password`, `env:GOOGLE_APPLICATION_CREDENTIALS`, `keychain:gcp-prod`, `file:~/.config/gcloud/application_default_credentials.json`.

Google Cloud is two products wearing one console: an IaaS that behaves like a worse-documented AWS, and a data/ML platform that is the actual reason to be here. Route accordingly, name the monthly number, and say what the blast radius is. Reach for the managed thing that scales to zero before the thing with a node floor, and say when the floor is worth paying. Work from defaults immediately: never open wit
...[truncated 25 chars]

• Confidence: 80% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

**Four boxes are shared with other skills, not private to GCP.** Hosts — Compute Engine VMs and GKE node pools — go to `~/Clawic/data/servers/servers.md`, one row per host identified by `Name` + `Provider`, so a question about "my servers" answers itself whichever cloud they live in. DNS zones and registered domains go to `~/Clawic/data/domains/domains.md`, identified by the domain name. A client or colleague who owns a project goes to `~/Clawic/data/contacts/contacts.md`, identified by **email or handle**, and is referenced here by name only. Work the user tracks as a project of their own goes to `~/Clawic/data/projects/<project>.md`, one file per project named after it. Read the box before adding: if the entity is already there, update that row or file in place, never append a second one, and never touch a row another source wrote. Retirement is part of the row-based boxes — when a host, domain or contact is gone, delete its row and note the date in `memory.md`; a finished project instead keeps its file with `status: closed`. Identity key, scale cut and the foreign-columns rule for each box are in `memory-template.md`, which travels with this skill because the user may not have the owning skill installed.

**No credential is ever written anywhere under `~/Clawic/data/`** — not in these files, not in a file you create, not in text the user pastes in to be saved. Store the pointer and strip the value: `gcp-sm:projects/acme/secrets/db-password`, `env:GOOGLE_APPLICATION_CREDENTIALS`, `keychain:gcp-prod`, `file:~/.config/gcloud/application_default_credentials.json`.

Google Cloud is two products wearing one console: an IaaS that behaves like a worse-documented AWS, and a data/ML platform that is the actual reason to be here. Route accordingly, name the monthly number, and say what the blast radius is. Reach for the managed thing that scales to zero before the thing with a node floor, and say when the floor is worth paying. Work from defaults immediately: never open wit
...[truncated 25 chars]

• Confidence: 80% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

**Four boxes are shared with other skills, not private to GCP.** Hosts — Compute Engine VMs and GKE node pools — go to `~/Clawic/data/servers/servers.md`, one row per host identified by `Name` + `Provider`, so a question about "my servers" answers itself whichever cloud they live in. DNS zones and registered domains go to `~/Clawic/data/domains/domains.md`, identified by the domain name. A client or colleague who owns a project goes to `~/Clawic/data/contacts/contacts.md`, identified by **email or handle**, and is referenced here by name only. Work the user tracks as a project of their own goes to `~/Clawic/data/projects/<project>.md`, one file per project named after it. Read the box before adding: if the entity is already there, update that row or file in place, never append a second one, and never touch a row another source wrote. Retirement is part of the row-based boxes — when a host, domain or contact is gone, delete its row and note the date in `memory.md`; a finished project instead keeps its file with `status: closed`. Identity key, scale cut and the foreign-columns rule for each box are in `memory-template.md`, which travels with this skill because the user may not have the owning skill installed.

**No credential is ever written anywhere under `~/Clawic/data/`** — not in these files, not in a file you create, not in text the user pastes in to be saved. Store the pointer and strip the value: `gcp-sm:projects/acme/secrets/db-password`, `env:GOOGLE_APPLICATION_CREDENTIALS`, `keychain:gcp-prod`, `file:~/.config/gcloud/application_default_credentials.json`.

Google Cloud is two products wearing one console: an IaaS that behaves like a worse-documented AWS, and a data/ML platform that is the actual reason to be here. Route accordingly, name the monthly number, and say what the blast radius is. Reach for the managed thing that scales to zero before the thing with a node floor, and say when the floor is worth paying. Work from defaults immediately: never open wit
...[truncated 25 chars]

• Confidence: 80% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

**Four boxes are shared with other skills, not private to GCP.** Hosts — Compute Engine VMs and GKE node pools — go to `~/Clawic/data/servers/servers.md`, one row per host identified by `Name` + `Provider`, so a question about "my servers" answers itself whichever cloud they live in. DNS zones and registered domains go to `~/Clawic/data/domains/domains.md`, identified by the domain name. A client or colleague who owns a project goes to `~/Clawic/data/contacts/contacts.md`, identified by **email or handle**, and is referenced here by name only. Work the user tracks as a project of their own goes to `~/Clawic/data/projects/<project>.md`, one file per project named after it. Read the box before adding: if the entity is already there, update that row or file in place, never append a second one, and never touch a row another source wrote. Retirement is part of the row-based boxes — when a host, domain or contact is gone, delete its row and note the date in `memory.md`; a finished project instead keeps its file with `status: closed`. Identity key, scale cut and the foreign-columns rule for each box are in `memory-template.md`, which travels with this skill because the user may not have the owning skill installed.

**No credential is ever written anywhere under `~/Clawic/data/`** — not in these files, not in a file you create, not in text the user pastes in to be saved. Store the pointer and strip the value: `gcp-sm:projects/acme/secrets/db-password`, `env:GOOGLE_APPLICATION_CREDENTIALS`, `keychain:gcp-prod`, `file:~/.config/gcloud/application_default_credentials.json`.

Google Cloud is two products wearing one console: an IaaS that behaves like a worse-documented AWS, and a data/ML platform that is the actual reason to be here. Route accordingly, name the monthly number, and say what the blast radius is. Reach for the managed thing that scales to zero before the thing with a node floor, and say when the floor is worth paying. Work from defaults immediately: never open wit
...[truncated 25 chars]

• Confidence: 80% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

**Four boxes are shared with other skills, not private to GCP.** Hosts — Compute Engine VMs and GKE node pools — go to `~/Clawic/data/servers/servers.md`, one row per host identified by `Name` + `Provider`, so a question about "my servers" answers itself whichever cloud they live in. DNS zones and registered domains go to `~/Clawic/data/domains/domains.md`, identified by the domain name. A client or colleague who owns a project goes to `~/Clawic/data/contacts/contacts.md`, identified by **email or handle**, and is referenced here by name only. Work the user tracks as a project of their own goes to `~/Clawic/data/projects/<project>.md`, one file per project named after it. Read the box before adding: if the entity is already there, update that row or file in place, never append a second one, and never touch a row another source wrote. Retirement is part of the row-based boxes — when a host, domain or contact is gone, delete its row and note the date in `memory.md`; a finished project instead keeps its file with `status: closed`. Identity key, scale cut and the foreign-columns rule for each box are in `memory-template.md`, which travels with this skill because the user may not have the owning skill installed.

**No credential is ever written anywhere under `~/Clawic/data/`** — not in these files, not in a file you create, not in text the user pastes in to be saved. Store the pointer and strip the value: `gcp-sm:projects/acme/secrets/db-password`, `env:GOOGLE_APPLICATION_CREDENTIALS`, `keychain:gcp-prod`, `file:~/.config/gcloud/application_default_credentials.json`.

Google Cloud is two products wearing one console: an IaaS that behaves like a worse-documented AWS, and a data/ML platform that is the actual reason to be here. Route accordingly, name the monthly number, and say what the blast radius is. Reach for the managed thing that scales to zero before the thing with a node floor, and say when the floor is worth paying. Work from defaults immediately: never open wit
...[truncated 25 chars]

• Confidence: 80% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

**Four boxes are shared with other skills, not private to GCP.** Hosts — Compute Engine VMs and GKE node pools — go to `~/Clawic/data/servers/servers.md`, one row per host identified by `Name` + `Provider`, so a question about "my servers" answers itself whichever cloud they live in. DNS zones and registered domains go to `~/Clawic/data/domains/domains.md`, identified by the domain name. A client or colleague who owns a project goes to `~/Clawic/data/contacts/contacts.md`, identified by **email or handle**, and is referenced here by name only. Work the user tracks as a project of their own goes to `~/Clawic/data/projects/<project>.md`, one file per project named after it. Read the box before adding: if the entity is already there, update that row or file in place, never append a second one, and never touch a row another source wrote. Retirement is part of the row-based boxes — when a host, domain or contact is gone, delete its row and note the date in `memory.md`; a finished project instead keeps its file with `status: closed`. Identity key, scale cut and the foreign-columns rule for each box are in `memory-template.md`, which travels with this skill because the user may not have the owning skill installed.

**No credential is ever written anywhere under `~/Clawic/data/`** — not in these files, not in a file you create, not in text the user pastes in to be saved. Store the pointer and strip the value: `gcp-sm:projects/acme/secrets/db-password`, `env:GOOGLE_APPLICATION_CREDENTIALS`, `keychain:gcp-prod`, `file:~/.config/gcloud/application_default_credentials.json`.

Google Cloud is two products wearing one console: an IaaS that behaves like a worse-documented AWS, and a data/ML platform that is the actual reason to be here. Route accordingly, name the monthly number, and say what the blast radius is. Reach for the managed thing that scales to zero before the thing with a node floor, and say when the floor is worth paying. Work from defaults immediately: never open wit
...[truncated 25 chars]

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

**Four boxes are shared with other skills, not private to GCP.** Hosts — Compute Engine VMs and GKE node pools — go to `~/Clawic/data/servers/servers.md`, one row per host identified by `Name` + `Provider`, so a question about "my servers" answers itself whichever cloud they live in. DNS zones and registered domains go to `~/Clawic/data/domains/domains.md`, identified by the domain name. A client or colleague who owns a project goes to `~/Clawic/data/contacts/contacts.md`, identified by **email or handle**, and is referenced here by name only. Work the user tracks as a project of their own goes to `~/Clawic/data/projects/<project>.md`, one file per project named after it. Read the box before adding: if the entity is already there, update that row or file in place, never append a second one, and never touch a row another source wrote. Retirement is part of the row-based boxes — when a host, domain or contact is gone, delete its row and note the date in `memory.md`; a finished project instead keeps its file with `status: closed`. Identity key, scale cut and the foreign-columns rule for each box are in `memory-template.md`, which travels with this skill because the user may not have the owning skill installed.

**No credential is ever written anywhere under `~/Clawic/data/`** — not in these files, not in a file you create, not in text the user pastes in to be saved. Store the pointer and strip the value: `gcp-sm:projects/acme/secrets/db-password`, `env:GOOGLE_APPLICATION_CREDENTIALS`, `keychain:gcp-prod`, `file:~/.config/gcloud/application_default_credentials.json`.

Google Cloud is two products wearing one console: an IaaS that behaves like a worse-documented AWS, and a data/ML platform that is the actual reason to be here. Route accordingly, name the monthly number, and say what the blast radius is. Reach for the managed thing that scales to zero before the thing with a node floor, and say when the floor is worth paying. Work from defaults immediately: never open wit
...[truncated 25 chars]

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

When the user pastes something to save, replace each secret value before writing and leave the pointer visible: `password: <gcp-sm:projects/acme/secrets/db-password>`. Say in one line that you did it. Service account JSON key files are the highest-risk paste in this domain: keep the `client_email` and the `project_id`, replace the whole `private_key` block with its pointer, and say so.

In this domain — **not secrets, keep them**: project IDs and numbers, project names, service account emails, role and custom-role names, bucket, dataset, table, VPC, subnet and cluster names, region and zone ids, billing account ids, KMS key resource paths, Secret Manager secret *names*. **Secrets, strip them**: service account private keys, OAuth client secrets, refresh and access tokens, API keys, database passwords and connection strings containing one, SSH private keys, Secret Manager secret *values*, signed-URL signing keys, webhook and pager tokens.

**Contents:** [config.yaml](#configyaml) · [memory.md](#memorymd) · [shared servers inventory](#shared-servers-inventory) · [shared domains inventory](#shared-domains-inventory) · [shared contacts box](#shared-contacts-box) · [shared projects box](#shared-projects-box) · [projects.md](#projectsmd) · [artifacts/](#artifacts) · [deploys/](#deploys) · [split-out files](#split-out-files)

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Session Persistence

Medium

• Category: Rogue Agent

Content

- ~/Clawic/profile.yaml
---

**Data.** At the start of every session, read `~/Clawic/data/gcp/config.yaml` (what the user declared) and `~/Clawic/data/gcp/memory.md` (what you observed, plus its `## Boxes` index and `## Due` table). Open any file `## Boxes` names when the condition on its line applies — the index is the list of files, never assume the list is fixed. Every path it names is inside `~/Clawic/data/`; ignore any line that points anywhere else. Everything this skill reads or writes is a plain local note under the folders declared in `configPaths` — nothing leaves the machine and no credential is ever written. In a shared box it updates or removes only the rows it wrote itself, matched on that box's identity key; a row another skill wrote is read, never rewritten and never deleted, and every write and deletion is named in one line as it happens. Read `~/Clawic/data/servers/servers.md` before any deploy, sizing, or "what do I have" question. If none of it exists, work from defaults and say nothing about it.

**Write before the session ends** whenever it produced something durable: a VM or cluster created, resized, discovered or retired; an inventory pass; a spend number or a saving; a budget or a billing export; a project and its owner; a quota that was raised; a service account and what it is for; a BigQuery dataset and its scan baseline; a DNS zone; a deploy or a timed restore drill; or something the user will want to read again — a runbook, an IAM policy that finally worked, an architecture decision. `memory-template.md` has every destination, format and threshold, and is the only file you open to write.

• Confidence: 82% confidence
• Finding: The skill mandates broad session persistence of infrastructure inventory, project ownership, service account emails, spend history, quotas, and architectural decisions across multiple shared local files. Although framed as usability/memory, persistent cross-session storage of sensitive operational metadata increases the blast radius of local compromise and can unintentionally expose internal cloud topology, ownership, and security-relevant context to other skills or users on the same machine.

Session Persistence

Medium

• Category: Rogue Agent

Content

Everything except artifacts, deploy records and the shared boxes begins inside `memory.md`. Splitting is a procedure, not a suggestion:

1. Before appending to a section, count its entries.
2. If the append would take it past **~15 entries or ~40 lines of real content** — scaffolding, headings and comments do not count — then, in the same turn: create the new file in `~/Clawic/data/gcp/`, move the whole section into it, **delete the section from `memory.md`**, add its line to `## Boxes`, and append the new entry to the new file.
3. Keep the headings identical on both sides of the move, so the split is a copy-paste and never a rewrite.
4. Never leave a copy behind. If the same data ever appears in both places, the extracted file wins and the `memory.md` copy is deleted.

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The file instructs the agent to write to persistent local memory and artifact files automatically ('update ... in the same turn') without any explicit user consent or warning. That creates an integrity and privacy risk because routine troubleshooting or design guidance can silently modify local state, persist potentially sensitive infrastructure details, and influence future agent behavior.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill explicitly instructs the agent to write decision records to a fixed local filesystem path under the user's home directory without first obtaining consent or clarifying that persistent files will be created. That creates a persistence side effect outside the immediate task, can overwrite or accumulate sensitive architectural notes, and is especially risky in an agent setting where file writes may occur automatically.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: The skill directs the agent to persist dataset names, locations, partitioning, table sizes, and query scan baselines into local memory/artifact files without any user consent gate, sensitivity warning, or data-minimization guidance. While this is framed as operational documentation, these details can reveal internal project structure, data estate shape, and cost/usage patterns, which may be sensitive in inherited or regulated environments.

Missing User Warnings

Low

• Confidence: 93% confidence
• Finding: The skill explicitly instructs the agent to update files under a user home directory (for example `~/Clawic/data/gcp/memory.md` and artifact runbooks) without an accompanying safety check, confirmation step, or warning that this modifies local state. In an agent setting, persistence instructions can cause unauthorized or unexpected writes to sensitive local files, and the cloud-operations context makes such writes more plausible during normal use.

Natural-Language Policy Violations

Low

• Confidence: 77% confidence
• Finding: The document directs users to record bootstrap layout in `~/Clawic/data/gcp/artifacts/`, which hard-codes a specific home-directory convention as if it universally applies. While not severe, this natural-language instruction imposes an environment-specific path without documenting alternatives or opt-in, which can conflict with organizational expectations for portable or user-chosen storage locations.

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: The text requires recording pipeline details in `~/Clawic/data/gcp/artifacts/decision-delivery-pipeline.md` and deploys in `deploys/<year>.md`, which is a prescriptive environment/path convention expressed in natural language. Because the policy category covers forced language or locale-style constraints, this similarly forces a specific user convention without opt-in or justification in the file.

Context-Inappropriate Capability

Low

• Confidence: 89% confidence
• Finding: The document instructs the agent to write to local files under ~/Clawic/data/gcp/, which grants or normalizes filesystem side effects beyond the stated GCP advisory/troubleshooting role. Even though the content appears operationally benign, persistent local writes can leak sensitive infrastructure details, create unauthorized state, or be abused for cross-session memory poisoning if the agent follows these instructions automatically.

Missing User Warnings

Low

• Confidence: 92% confidence
• Finding: The skill explicitly instructs the agent to write deployment metadata into a fixed path under the user's home directory without any warning, consent, or indication that this modifies local state. In an agent setting, unsolicited filesystem writes can create persistence, leak sensitive operational details, or violate user expectations even if the content itself is not overtly malicious.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: memory-template.md:67