Growth

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:23 PM UTC
• Version: 1.0.2

Overview

This growth skill is not malicious, but it automatically writes and deletes persistent business notes, including finance, project, and contact records, without an explicit approval step.

Install only if you are comfortable with the agent maintaining local Growth memory and updating shared Clawic finance, project, and contact notes. Before using it on real business data, require your agent to show proposed file changes and get approval before writing or deleting anything.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (34)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md

---
name: Growth
slug: growth
version: 1.0.2
description: 'Runs growth as a system: finds which funnel stage is the constraint, picks the loop that compounds, and sizes the channel and experiment program. Use when growth stalled or a number has to be hit and nobody can say which stage is broken; when choosing, scaling, or killing acquisition channels; when CAC, payback, LTV:CAC, or blended-versus-paid has to be computed or defended; when signups grow but activation, retention, or paid conversion does not; when designing a referral program, a lifecycle messaging map, or a north-star metric and the events behind it; when forecasting from a

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · memory-template.md (reported line 69)May include surrounding context.

md

Nothing under `~/Clawic/data/` ever holds a secret value — not the files named here, not files you create, not text the user pastes in and asks you to keep. A pasted tracking snippet, ad-platform export, ESP configuration, `.env` or webhook setup is the densest source of secrets in this domain: strip each value **before** writing and leave its pointer in place, in this shape: `<kind>:<locator>`.

`env:SEGMENT_WRITE_KEY` · `env:ESP_API_KEY` · `keychain:meta-ads` · `1password:Work/Analytics/amplitude` · `bitwarden:Growth/Klaviyo` · `vault:secret/growth/ga4` · `ssm:/prod/stripe/key` · `file:~/.config/ga/credentials.json`

In a text, the pointer goes where the value was: `write_key: <env:SEGMENT_WRITE_KEY>`. Say in one line that you did it.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · memory-template.md (reported line 73)May include surrounding context.

md

In a text, the pointer goes where the value was: `write_key: <env:SEGMENT_WRITE_KEY>`. Say in one line that you did it.

In this domain — **not secrets, keep them**: GA4 property and measurement ids, ad account ids, campaign, ad set and creative names, UTM values, experiment and variant keys, audience and segment names, plan names and public prices, app store ids and bundle ids, domain and subdomain names, list and flow names, public referral codes, and every aggregate metric. **Secrets, strip them**: analytics write keys and server-side API secrets, ad-platform access and refresh tokens, ESP and SMS API keys, payment-processor secret keys, webhook signing secrets, CRM and warehouse credentials, connection strings, and personal access tokens sitting inside a pasted config.

One more rule that is not about credentials: **raw user-level exports** — rows carrying emails, names, addresses or phone numbers — never go into `~/Clawic/data/`. Keep the aggregate (the rate, the cohort, the count), drop the rows, and say so in one line.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · paid.md (reported line 45)May include surrounding context.

md

cile against the billing system, which is the only source of truth for money (`instrumentation.md`).

## Attribution Reality

- iOS App Tracking Transparency (2021) ended reliable deterministic user-level attribution on iOS; SKAdNetwork returns delayed, aggregated, privacy-thresholded data — mobile UA must be run on cohort and incrementality logic, not per-user ROAS (`mobile.md`).
- Third-party cookies have been off by default in Safari and Firefox for years, so cross-site retargeting reach is smaller than dashboards imply.
- Server-side conversion APIs improve signal quality for optimisation; they do not restore truth about which touch caused what.
- Practical stance: **platform numbers for optimisation inside a platform, incrementality tests for allocation between platforms, billing data for the total.** Multi-touch model mechanics and their politics: `marketing-attribution`.

## Bidding and Budget Mechanics

Stable across platforms, whatever the interface calls them:

- **The lear

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest explicitly excludes 'churn cohort depth (churn-analysis)' from this skill's intended use. However, the entire document focuses on retention curves, churn causes, resurrection, cohort tables, and post-refresh churn analysis workflows, which directly contradicts the stated boundary of the skill's purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill instructs the agent to write to multiple persistent local files, including growth memory, finance budgets, contacts, and artifacts, which expands its behavior from analysis into stateful system modification. This creates a real risk of unintended data tampering, scope creep, and propagation of incorrect or sensitive information across unrelated stores if the skill is triggered in the wrong context or manipulated by adversarial inputs.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The instruction to check and treat named champions, buyers, or agencies via a shared contacts file introduces contact-record handling that is broader than pure growth analysis. This can expose or normalize access to personal/business contact data and encourages the agent to interact with a shared CRM-like store without clear necessity, consent boundaries, or minimization controls.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document instructs the agent to persistently modify multiple local files after completing analysis, which expands the skill from advisory guidance into state-changing file operations. This creates a scope-creep risk: an agent granted this skill could overwrite shared memory, project, or artifact files with incorrect, excessive, or privacy-sensitive data, especially because the writes are framed as mandatory ('write it back in the same turn').

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file explicitly directs updating shared contact records for people and writing deal ownership information into project files, which is CRM-style data maintenance outside the stated analytical scope. Because these are persistent shared records, misuse or mistakes could corrupt operational data, create privacy/compliance issues, and let an analysis-oriented skill mutate business systems of record.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file explicitly instructs the agent to write diagnosis results into local memory and artifact files, which turns an analytical skill into one that mutates persistent state. That can cause unauthorized file modification, cross-session data contamination, and leakage of user or business data into shared memory without an explicit user request or confirmation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The markdown instructs the skill to modify local memory and create artifact files without warning the user that files will be changed. Silent persistence is risky because users may believe they are receiving analysis only, while the skill is actually storing potentially sensitive business metrics and conclusions on disk for later reuse.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly instructs the agent to persist analysis outputs into shared memory and artifact files, which expands scope from advisory analysis into state-changing filesystem writes. This is dangerous because it can silently modify long-lived context or project artifacts without clear user consent, causing cross-session data contamination, prompt poisoning, or unintended propagation of incorrect business data.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs writing outputs into multiple persistent files outside the immediate forecasting artifact, including shared memory, finance, and project records. That expands scope from analysis into state-changing actions and can cause unauthorized or unintended modifications to important operational data if the skill is invoked without explicit user approval for each write target.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation authorizes updates to shared finance and project-tracking documents as part of a forecasting workflow, even though those records may have broader organizational significance and different ownership. This creates an overprivileged behavior pattern where a forecasting skill can alter budgeting and project state, increasing the risk of integrity loss, accidental propagation of incorrect assumptions, or cross-domain changes beyond user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The markdown directs the agent to write forecast data back into persistent files in the same turn, but provides no warning, consent checkpoint, or confirmation flow for modifying project data. In context, this is dangerous because the changes affect durable shared records and could silently overwrite or append planning assumptions that downstream teams treat as authoritative.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs the agent to write to ~/Clawic/data/growth/memory.md and create new files under ~/Clawic/data/growth/artifacts/ without requiring user confirmation or clarifying that filesystem modification is optional. In an agent context, this can cause unauthorized local state changes, persistence of potentially sensitive user/project data, and unintended file creation simply from reading or following the skill.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document explicitly instructs the agent to write marketplace metrics and launch outputs into local memory and shared budget files, which goes beyond a purely analytical/advisory role into persistent state modification. That creates a real risk of unauthorized or incorrect changes to shared operational records, especially because the writes are framed as mandatory follow-up actions rather than optional user-confirmed output.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill claims a growth-analysis purpose, but the content directs modification of shared finance and memory records such as memory.md, markets.md, and budget.md. This mismatch expands the effective capability of the skill without clear justification, increasing the chance that an analysis workflow can alter sensitive cross-team records or pollute decision-making inputs for later agents and users.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The instruction 'Read this file only when WRITING' defines when the skill guidance applies, but it does not clearly specify what actions count as 'writing' versus adjacent behaviors like planning, summarizing, or preparing changes. That ambiguity could cause unintended invocation in common editing contexts.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 87% confidence

Finding

The template authorizes persistent file creation, migration, and deletion as an automatic maintenance procedure triggered by size thresholds rather than explicit user approval. In an agent setting, this can lead to unintended retention of sensitive business context and destructive reorganization of prior records, increasing privacy and integrity risk if the agent misclassifies content or acts on adversarial prompts.

Content

Scanner excerpt · memory-template.md (reported line 58)May include surrounding context.

md

1. **Who**: the agent about to add the entry that crosses the line — not a later cleanup.
2. **When**: count the section's entries **before** appending. If the append would take it past **~15 entries or ~40 lines of real content** — scaffolding, headings and comments do not count — split first, then append.
3. **What happens to the original**: in the same turn, create the file in `~/Clawic/data/growth/`, move the whole section into it, **delete the section from `memory.md`** leaving only its `## Boxes` line, and add the new entry to the new file.
4. **Precedence**: never leave a copy behind. If the same data ever appears in both places, the extracted file wins and the `memory.md` copy is deleted.

**Isomorphism**: the extracted file keeps exactly the headings the section had — a `###` sub-heading becomes a `##` heading in the new file, same name, same order, nothing renamed and nothing merged. That is what makes the split a copy-paste instead of a rewrite that loses rows.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This instruction directs the skill to write pricing, conversion, and artifact updates into persistent local files, which expands the skill from analysis into state mutation. Even if the content is business-related, automatic persistence can create unauthorized or misleading long-lived changes, and a malicious or mistaken invocation could poison memory used by later runs.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file directs the agent to consult and update shared growth and finance files even though the skill is described primarily as analytical guidance. This broadens capability and trust boundaries unnecessarily, increasing the chance of data integrity issues or accidental propagation of incorrect business-critical numbers into shared records.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to write results into multiple local and shared records in the same turn after analytical work. That expands the skill from advisory analysis into state-changing file operations, creating risk of unauthorized or unintended modification of memory, finance, and experiment records if the agent follows the instructions automatically.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The markdown contains imperative instructions to write updates to shared files without warning the user that persistent data will be modified. In an agent setting, silent state changes are dangerous because they can alter business records, budgets, and experiment logs without informed consent or review.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.