HTML

• Outcome: Pass
• Latest audit: Jul 27, 2026 · 8:50 AM UTC
• Version: 1.0.2

Overview

This HTML skill is a documentation-only helper with disclosed local note storage, scoped to Clawic data folders and explicit secret-stripping rules.

Install only if you are comfortable with the skill maintaining local Clawic memory files about HTML decisions, audits, templates, hostnames, and project notes. It should not store secrets or transmit data, but it will create or update local notes under ~/Clawic/data/ during normal use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The skill instructs the agent to append audit rows under a user home-directory path and to save pattern artifacts to disk, which extends beyond HTML markup review into persistent filesystem modification. In an agent setting, undocumented side effects on local files are dangerous because they can overwrite, pollute, or exfiltration-prime user data stores without explicit user consent.

Intent-Code Divergence

Medium

• Confidence: 86% confidence
• Finding: The document states that testing belongs in `auditing.md` but later tells the reader to perform and record an accessibility pass within this skill, creating conflicting operational scope. Scope ambiguity is risky in agent skills because it can cause the agent to perform actions the user did not expect, including testing workflows and persistence steps that should live in a separate, explicitly invoked capability.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill instructs the agent to write persistent files under a user home directory and update memory records as part of normal operation, which goes beyond HTML email authoring and creates side effects on the local filesystem. In an agent setting, this can enable unauthorized persistence, workspace contamination, or silent modification of shared memory/state without explicit user consent.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill instructs the agent to write persistent data to a local path in the user's home directory and update shared memory/config state, even though that behavior is not necessary to answer most HTML form questions. This creates an integrity and privacy risk because untrusted prompt content or user-provided patterns could be stored locally, causing cross-session data retention or contamination of future agent behavior.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill includes instructions to write to persistent cross-skill state files (`~/Clawic/data/domains/domains.md`, `memory.md`, `config.yaml`) as part of an HTML internationalization workflow. That expands the skill from markup guidance into durable state mutation, creating a channel for unintended persistence, cross-task contamination, and possible policy bypass if later agents trust those files as authoritative inputs.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The instruction to read `~/Clawic/data/domains/domains.md` before writing `hreflang` extends the skill beyond HTML authoring into consumption of shared project memory. This creates hidden dependencies on external state that may be stale, attacker-influenced, or inconsistent, and it can steer the agent's behavior using data outside the user's immediate request.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The final paragraph instructs the agent to update shared records in `domains.md`, `memory.md`, and `config.yaml`, adding persistent recordkeeping behavior not described by the HTML skill's manifest. This is dangerous because it turns a content-editing skill into a cross-skill state writer, enabling unauthorized persistence of user declarations and creating opportunities for later tasks to be influenced by injected or incorrect state.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The document instructs the agent to write measured page details and structural constraints into persistent local memory and artifact files outside the immediate task output. That creates unnecessary cross-session retention of potentially sensitive project information and expands the skill's scope from HTML guidance into data persistence, which can leak internal implementation details or user-provided context into later sessions.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The HTML tables skill unexpectedly instructs the agent to create persistent artifacts under a user home-directory path, which is outside the stated scope of markup guidance. This crosses from documentation advice into filesystem side effects, creating a risk of unauthorized file creation, overwrite, and hidden persistence if an agent follows the instruction automatically.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Embedding persistent memory/artifact management behavior in an HTML guidance document grants the skill an unnecessary capability unrelated to its declared purpose. In an agent setting, this can be exploited to plant durable state, influence later runs, or bypass user expectations about what a markup-help skill should do.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The documentation instructs the agent to write persistent files under ~/Clawic/data/html/artifacts and memory.md, which is outside the core scope of editing or analyzing HTML markup. Persistent memory behavior can cause unintended data retention, cross-task contamination, and unauthorized modification of local state, especially if the agent follows these instructions automatically during unrelated HTML assistance.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill also instructs saving pattern artifacts to `artifacts/pattern-<name>.md` without disclosing file creation or update behavior. Undisclosed artifact generation is dangerous because it can litter repositories, overwrite existing documentation, and create durable outputs that later systems may trust as validated evidence.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill also instructs saving pattern artifacts to `artifacts/pattern-<name>.md` without disclosing file creation or update behavior. Undisclosed artifact generation is dangerous because it can litter repositories, overwrite existing documentation, and create durable outputs that later systems may trust as validated evidence.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The markdown directs saving verified templates and updating memory files without warning that local files will be written, which is unsafe because it can trigger unexpected persistence and hidden state changes. Users asking for rendering help would not reasonably expect the skill to create files in ~/Clawic/data or mutate memory tracking documents.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The markdown explicitly directs saving form patterns to ~/Clawic/data/html/artifacts/form-<name>.md and modifying config.yaml without any user-facing warning or consent. Hidden persistent writes are dangerous because they can leak sensitive form details, create unauthorized local state changes, and be abused for prompt persistence or poisoning across future sessions.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The skill explicitly instructs the agent/user to write information into specific local files under `~/Clawic/data/html/...` without any warning, confirmation step, or scope limitation. While the content being recorded is benign troubleshooting metadata, this still creates a state-changing side effect on user data and can lead to unintended modification of local notes or audit logs if followed automatically.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The markdown directs saving to a specific home-directory path without warning about file creation or overwrite behavior. That is dangerous because it normalizes writes to user storage without consent, may clobber existing content, and can leave persistent artifacts the user did not ask for.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: Persisting page measurement details to a cross-session memory file can retain user or project data beyond the current engagement, including URLs, page structure, performance constraints, and implementation decisions. In an agent setting, this creates a data handling risk because future tasks may surface or rely on retained context that the user did not intend to store long term.

VirusTotal

1/64 vendors flagged this skill as malicious, and 63/64 flagged it as clean.

Static analysis

No suspicious patterns detected.