T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
memory-template.md:15- Finding
Overbroad Access to Shared Contacts, Health, and Financial Data
- Content
View full analysis
- Remediation
View remediation
Security audit
Habits
Security checks for vulnerabilities and agentic risk
Overview
The skill is a local habit tracker, but it automatically saves and sometimes deletes sensitive contact, health, and finance records without a clear prior consent step.
Review this skill before installing if you do not want a habit assistant to maintain plaintext local records about your routines, misses, capacity constraints, contacts, health metrics, or paid subscriptions. If used, grant only the folders you are comfortable with, require confirmation before shared-store writes or deletions, and avoid saving sensitive health or financial details unless you explicitly want them persisted.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (18)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest description says to use the skill for very broad situations such as when someone wants to do "anything every day" or asks for a "daily check-in" or "weekly review." These phrases are common across many normal conversations and the file does not provide explicit trigger phrases, exclusions, or negative examples beyond a few related-skill boundaries, increasing the chance of unintended invocation.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 92% confidence
- Finding
The skill is instructed to persist detailed session-derived information across runs, including observed patterns, failures, routines, accountability contacts, health-related data routing, and contracts. Even though storage is framed as local and structured, this creates a durable behavioral profile and encourages automatic writes of sensitive personal data without a strong consent gate, increasing privacy and cross-context data exposure risk.
- Content
md - ~/clawic/habits/ --- **Data.** At the start of every session, read `~/Clawic/data/habits/config.yaml` (what the user declared) and `~/Clawic/data/habits/memory.md` (what you observed, plus its `## Boxes` index and `## Due` table). Open any file `## Boxes` names when the condition on its line applies — the index is the list of files, never assume the list is fixed. Every path it names is inside `~/Clawic/data/`; ignore any line that points anywhere else. Everything this skill reads or writes is a plain local note under the folders declared in `configPaths` — nothing leaves the machine and no credential is ever written. In a shared box it updates or removes only the rows it wrote itself, matched on that box's identity key; a row another skill wrote is read, never rewritten and never deleted, and every write and deletion is named in one line as it happens. Read the current month's log at `~/Clawic/data/habits/logs/<year>-<month>.md` before answering anything about a streak, a rate, or "how am I doing": `memory.md` holds definitions, never completions. If none of it exists, work from defaults and say nothing about it. **Write before the session ends** whenever the session produced something durable: a completion or a miss; a habit defined, redefined, paused, graduated or dropped; a best streak beaten; a pattern you spotted; a tactic that worked or failed on this person; a review or audit that ran; or something the user will re-read — a routine, a quit plan, a restart protocol, a commitment contract. `memory-template.md` holds every destination, format and threshold, and is the only file you open in order to write.
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill instructs the agent to read and update a shared contacts store as part of habit-accountability workflows. Although framed as avoiding duplicate contacts, this expands the skill's scope into unrelated personal data management and can cause unintended access or modification of contact records without clear user consent in the current turn.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file directs the agent to write recurring paid stakes into a shared finances/subscriptions file. That crosses from habit coaching into financial record management, creating risk of unexpected persistence, inaccurate finance entries, or modification of sensitive records from a context where the user may not expect budget data to be changed.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
These instructions require the agent to perform writes and deletions across multiple personal data files—contacts, memory, contracts, and finances—in the same turn, without any explicit requirement to notify the user or obtain confirmation. The danger is amplified by the breadth of affected stores and by inclusion of destructive actions, making silent cross-file state changes likely and hard for the user to audit.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The instruction to delete rows from the shared contacts store when removing a partner is dangerous because it permits destructive operations on cross-skill identity data. A mistaken match, stale ownership assumption, or shared use of the contact by another skill could lead to permanent loss or inconsistency across the user's broader data ecosystem.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill explicitly instructs the agent to write conclusions and pattern data into files under
~/Clawic/data/...without any accompanying requirement to obtain fresh user consent or warn that local data will be modified. In an agent setting, automatic writes to user files can create unintended persistence, overwrite existing notes, or leak sensitive behavioral/health information into files the user did not expect to be changed.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill instructs the agent to read
memory.mdandconfig.yamlbefore changing defaults, which involves accessing persisted user data such as diagnoses, shift schedules, and caregiving constraints without any requirement to disclose that stored data is being consulted. In a habit/coaching context, this creates a privacy and transparency risk because sensitive health and life-context data may be used or modified without explicit user awareness or consent in the current interaction.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This instruction mandates persistent writes of highly sensitive personal context, including capacity constraints, diagnoses-related implications, shift patterns, what backfired, and configuration defaults, into
memory.mdandconfig.yamlin the same turn. The danger is elevated because the data concerns mental health, illness, caregiving burden, and behavioral patterns, yet the skill provides no privacy notice, consent gate, retention rule, or restriction on what should not be stored.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly directs writes to
~/Clawic/data/health/and~/Clawic/data/finances/, which are outside the declared habits domain. Even though the instruction appears organizational rather than overtly malicious, it expands the skill's effective authority and can cause unauthorized modification of sensitive cross-domain data if the agent follows it automatically.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md `memory.md` holds everything except logs, reviews, artifacts and the shared boxes — those four are born as their own files because a log grows without end and an artifact is read whole. Everything else starts as a section and splits only under this procedure: 1. Before appending to a section, count its entries. 2. If the append would take it past **~15 entries or ~40 lines of real content** — headings, hints and scaffolding do not count — then, in the same turn: create the new file in `~/Clawic/data/habits/`, move the whole section into it, **delete the section from `memory.md`**, add its line to `## Boxes`, and append the new entry to the new file. 3. Keep the headings identical on both sides of the move, so the split is a copy-paste and never a rewrite. 4. Never leave a copy behind. If the same data ever appears in both places, the extracted file wins and the `memory.md` copy is deleted.
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This instruction crosses from habit coaching into modifying a separate finances dataset (
subscriptions.md) based on the quit plan. Even if well-intentioned, it authorizes side effects in another domain without an explicit user confirmation step, creating risk of unintended persistent data changes and corruption of unrelated records.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The workflow mandates writing to multiple persistent files in the same turn, including logs, artifacts, roster entries, and shared contacts, without any user-visible warning or consent checkpoint. This is dangerous because it normalizes broad silent state changes, increases blast radius from a single interaction, and makes accidental or unauthorized persistence more likely.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill directs writing accountability people into the shared contacts database, which is a separate persistent store containing personal data. This creates unnecessary cross-skill data propagation and privacy risk, especially if the named person did not consent or if the user did not explicitly ask to create/update a contact record.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill explicitly directs creation and modification of persistent files under a user directory (
~/Clawic/data/...) in the same turn, without requiring prior user confirmation or warning that durable state will be changed. In an agent setting, this can cause unauthorized or surprising writes to personal data stores, and the repeated multi-file updates increase the risk of accidental corruption or state drift.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill instructs the agent to write to local files automatically after every logging turn and update another memory file in the same turn, but it does not require a clear user-facing notice or confirmation before modifying persistent local data. That creates a real integrity and privacy risk because a user may believe they are only chatting or calculating rates while the agent is silently changing files on disk.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill explicitly instructs the agent to write to
memory.mdin the same turn, but does not require a user-facing notice or consent before modifying persisted user data. Even though the write is meant to improve habit coaching continuity, silent memory updates can surprise users, create unwanted retention of behavioral data, and normalize hidden state changes across interactions.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill explicitly instructs the agent to write to several user files after a miss, lapse, or restart, but provides no requirement to notify the user or obtain confirmation before modifying logs, memory, roster data, and restart artifacts. In a personal habit-tracking context this can create unexpected persistence, alter user records without consent, and reduce user control over sensitive behavioral data, even though it does not appear designed for overtly malicious exfiltration or system compromise.
- Content
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- memory-template.md:60