HTML

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:05 PM UTC
• Version: 1.0.2

Overview

This is a coherent HTML helper with no executable payload or exfiltration, but it automatically reads and writes persistent local/shared notes in a way users should review.

Install only if you want this skill to maintain Clawic local memory for HTML work. Keep `~/Clawic/data/` writable only by trusted users/tools, review unexpected `## Boxes` entries, and watch for announced writes to project/domain notes because those records can influence future sessions.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:30

Finding

Untrusted Persistent Notes Are Automatically Loaded Across Sessions and Skills

Content

View full analysis

.md` when the markup belongs to a tracked project. If none of it exists, work from defaults and say nothing about it. **Write before the session ends** whenever the session produced something durable: a page or template mapped, its landmark structure, its LCP element or its `lang`; a rendering quirk that cost effort to find (an Outlook collapse, a Safari gap, how a screen reader announces a pattern, a CMS that strips an attribute); an accessibility or validation pass and what it found; a canonical host or locale-to-hostname map; or something the user will re-read — a `` boilerplate, an accessible component pattern that finally worked, an email template, a sanitizer allowlist, a decision about a native element versus a library. ` ...[truncated 3708 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (52)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md

| Choosing between `<div>` and a real element | Semantic map by meaning; landmarks; heading order is a tree, not a font size | `semantics.md` |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

md

| Choosing between `<div>` and a real element | Semantic map by meaning; landmarks; heading order is a tree, not a font size | `semantics.md` |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 206)May include surrounding context.

md

| Choosing between `<div>` and a real element | Semantic map by meaning; landmarks; heading order is a tree, not a font size | `semantics.md` |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md

| Screen reader reads a filename, "button", or nothing | Accessible name precedence; `alt` decision table | `accessibility.md` |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

md

| Screen reader reads a filename, "button", or nothing | Accessible name precedence; `alt` decision table | `accessibility.md` |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

md

| Screen reader reads a filename, "button", or nothing | Accessible name precedence; `alt` decision table | `accessibility.md` |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.

md

| Screen reader reads a filename, "button", or nothing | Accessible name precedence; `alt` decision table | `accessibility.md` |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

md

| Screen reader reads a filename, "button", or nothing | Accessible name precedence; `alt` decision table | `accessibility.md` |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 180)May include surrounding context.

md

| Screen reader reads a filename, "button", or nothing | Accessible name precedence; `alt` decision table | `accessibility.md` |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 207)May include surrounding context.

md

| Screen reader reads a filename, "button", or nothing | Accessible name precedence; `alt` decision table | `accessibility.md` |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

md

| Modal, accordion, tooltip, tabs, combobox, toast | Native element first — the element-versus-pattern table with the cost of each | `interactive.md` |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

md

| Modal, accordion, tooltip, tabs, combobox, toast | Native element first — the element-versus-pattern table with the cost of each | `interactive.md` |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

md

| Modal, accordion, tooltip, tabs, combobox, toast | Native element first — the element-versus-pattern table with the cost of each | `interactive.md` |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

md

| Modal, accordion, tooltip, tabs, combobox, toast | Native element first — the element-versus-pattern table with the cost of each | `interactive.md` |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.

md

| Modal, accordion, tooltip, tabs, combobox, toast | Native element first — the element-versus-pattern table with the cost of each | `interactive.md` |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.

md

| Modal, accordion, tooltip, tabs, combobox, toast | Native element first — the element-versus-pattern table with the cost of each | `interactive.md` |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

md

| Rendering user-generated or pasted HTML | Sanitize with an allowlist, escape by context, `sandbox` for isolation | `security.md` |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

md

| Rendering user-generated or pasted HTML | Sanitize with an allowlist, escape by context, `sandbox` for isolation | `security.md` |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

md

| Rendering user-generated or pasted HTML | Sanitize with an allowlist, escape by context, `sandbox` for isolation | `security.md` |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 178)May include surrounding context.

md

| Rendering user-generated or pasted HTML | Sanitize with an allowlist, escape by context, `sandbox` for isolation | `security.md` |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.

md

| Rendering user-generated or pasted HTML | Sanitize with an allowlist, escape by context, `sandbox` for isolation | `security.md` |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 184)May include surrounding context.

md

| Rendering user-generated or pasted HTML | Sanitize with an allowlist, escape by context, `sandbox` for isolation | `security.md` |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 193)May include surrounding context.

md

| Rendering user-generated or pasted HTML | Sanitize with an allowlist, escape by context, `sandbox` for isolation | `security.md` |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 216)May include surrounding context.

md

| Rendering user-generated or pasted HTML | Sanitize with an allowlist, escape by context, `sandbox` for isolation | `security.md` |

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · accessibility.md (reported line 20)May include surrounding context.

md

Consequences worth memorizing:

- `aria-label` on a `<button>` **replaces** its visible text. A button reading "Delete" with `aria-label="Remove item 4"` is announced as the label; speech-input users saying "click Delete" then miss it. WCAG 2.5.3 requires the visible text to be contained in the accessible name — so `aria-label="Delete invoice 4821"` is fine, `aria-label="Remove"` is a failure.
- `aria-labelledby` may point at an element that is hidden with `display:none`, and it still works. Referencing a *missing* id yields an empty name and no warning.
- `aria-describedby` is additive, not a name: it is read after the name and role, for hints and error text.
- Naming only works on elements whose role supports it. `aria-label` on a `<div>`, `<span>`, or `<p>` with no role is ignored by the name computation.
- Only the *first* matching id is used when ids are duplicated (SKILL.md Rule 2).

Static analysis

No suspicious patterns detected.