Back to skill

Security audit

Growth

Security checks across malware telemetry and agentic risk

Overview

This growth-planning skill is coherent and not deceptive, but it can automatically modify local growth, budget, project, and contact records without asking first.

Install only if you want the agent to maintain local growth memory and shared business notes. Before use, consider requiring approval or previewed diffs before it changes budget, project, contact, or memory files, especially in shared workspaces.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (19)

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The skill directs the agent to write to multiple persistent files outside the core analysis artifact, including growth memory, budget records, contacts, and postmortems. This expands the skill from analysis into cross-domain state mutation, increasing the chance of unintended or unauthorized changes to operational data if the skill is invoked with incomplete, adversarial, or mistaken inputs.

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
The instruction to update `contacts.md` is not necessary for channel analysis and introduces a side effect into contact-management data. Because contact records are a separate business domain, this can cause integrity issues, unwanted data creation, or persistence of unverified third-party details based solely on analysis flow rather than deliberate user intent.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The skill explicitly instructs the agent to write analysis outputs back into persistent memory files and create artifacts in the same turn. That expands the skill from read/analysis into state-changing behavior, which can overwrite prior context, poison future runs, or persist inaccurate/sensitive business data without an explicit user request or confirmation.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The documented capability to modify persistent memory and create reusable artifact files is not necessary for diagnosis itself and introduces durable side effects. In an agent environment, unjustified persistence can become a vector for context pollution, accidental data retention, or propagation of incorrect assumptions into later decisions.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The file is presented as forecasting guidance, but it also instructs the agent to persist changes into multiple memory, finance, and project files. That expands the skill from analysis into state-changing file operations, creating a risk of unintended or overbroad modification of persistent user data if the agent follows the instructions automatically.

Context-Inappropriate Capability

Medium
Confidence
82% confidence
Finding
The instructions direct updates to finance and project records that are only loosely related to producing a forecast, which creates an unnecessary privilege expansion. Even if well-intentioned, coupling forecasting with cross-file record updates can cause integrity issues, unauthorized changes, or propagation of incorrect assumptions into operational documents.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The file goes beyond marketplace analysis and instructs the agent to write derived conclusions into persistent shared memory files and finance artifacts. That creates an integrity risk: if the analysis is wrong, stale, or manipulated by adversarial inputs, the agent may persist incorrect business state and budget data that later workflows trust.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The instruction to update a shared budget file is operationally sensitive and exceeds the stated purpose of a growth-analysis skill. Because budget artifacts influence financial planning and may be consumed by other agents or humans, an adversarial or mistaken run could seed unauthorized subsidy programs or alter finance assumptions indirectly.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The skill explicitly instructs the agent to modify persistent shared files (`memory.md`, `budget.md`, and experiment records) after analysis. That expands the skill from advisory analysis into state-changing operations, creating risk of unauthorized or accidental changes to financial and planning records if the agent is invoked in the wrong context or with bad inputs.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
The document authorizes updates to a shared finance budget file even though the skill is described primarily as paid media economics and planning guidance. This broader capability can let the agent alter sensitive business records outside its narrow analytical purpose, increasing the blast radius of misuse or prompt-injection-driven actions.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The skill explicitly instructs the agent to persist analysis outputs into local memory and artifact files in the same turn, creating side effects beyond pure growth analysis. That can silently modify long-lived state, contaminate future runs, and overwrite or append to local knowledge stores without explicit user consent or confirmation.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The prescribed writes to ~/Clawic/data/growth/memory.md, retention-curves.md, and artifacts/<kebab-name>.md are not necessary for answering a retention-analysis request and expand the skill's behavior into persistent local state manipulation. In an agent setting, this increases the risk of unintended data alteration, stale or poisoned memory, and surprising filesystem changes that affect subsequent decisions.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The markdown directs local file writes without warning the user that stored data will be modified. Silent persistence is risky because users may not expect side effects, and the saved diagnosis may include sensitive metrics, stale constraints, or business assumptions that influence future agent behavior.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill explicitly instructs the agent to persist analysis outputs into specific local files and paths without any indication that user approval is required before modifying data. In an agent setting, this creates an integrity risk: routine use of the skill can silently overwrite, append to, or contaminate local memory/artifact files, especially because the instruction is framed as mandatory workflow ('write it back in the same turn').

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The markdown explicitly tells the agent to write to several persistent user files, but it does not warn that these actions modify durable state or may overwrite existing records. In an agent setting, absent write warnings and confirmation gates can lead to silent data corruption, accidental overwrites, and hard-to-audit changes across memory and finance artifacts.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The template authorizes writes with 'No permission needed' and broad event-driven triggers, which can cause the agent to persist data automatically without a clear user confirmation boundary. In an agent setting, this increases the risk of storing sensitive, incorrect, or adversarially supplied content simply because a writing condition was met.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill explicitly instructs the agent to write data into persistent local memory and artifact files 'in the same turn' without requiring user confirmation or warning that state will be modified. In an agent environment with filesystem or memory-write capabilities, this can cause unauthorized persistence, silent state contamination, and future-behavior manipulation based on data the user did not knowingly approve.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The markdown directs file writes without warning the user that stored data will be modified, which violates the principle of transparent consent for side effects. Because the writes target persistent local knowledge files, a user asking for analysis could unknowingly trigger durable changes that are difficult to audit or revert.

Session Persistence

Medium
Category
Rogue Agent
Content
1. **Who**: the agent about to add the entry that crosses the line — not a later cleanup.
2. **When**: count the section's entries **before** appending. If the append would take it past **~15 entries or ~40 lines of real content** — scaffolding, headings and comments do not count — split first, then append.
3. **What happens to the original**: in the same turn, create the file in `~/Clawic/data/growth/`, move the whole section into it, **delete the section from `memory.md`** leaving only its `## Boxes` line, and add the new entry to the new file.
4. **Precedence**: never leave a copy behind. If the same data ever appears in both places, the extracted file wins and the `memory.md` copy is deleted.

**Isomorphism**: the extracted file keeps exactly the headings the section had — a `###` sub-heading becomes a `##` heading in the new file, same name, same order, nothing renamed and nothing merged. That is what makes the split a copy-paste instead of a rewrite that loses rows.
Confidence
88% confidence
Finding
The split-and-delete procedure encourages durable session persistence and cross-session memory growth, including movement of data into additional files and deletion of originals. While operationally useful, this can preserve more user data than necessary and makes retention harder to audit or minimize, especially in shared boxes and long-lived artifacts.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.