T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:34- Finding
Automatic Persistent Profiling Without Prior User Consent
- Content
View full analysis
- Remediation
View remediation
Security audit
Japanese
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent Japanese-writing assistant, but it automatically reads, writes, deletes, and migrates local/shared memory, contacts, and project records without asking first.
Install only if you are comfortable with this skill maintaining local writing memory and shared contact/project records automatically. Review or back up ~/Clawic/data before use, avoid pasting secrets, and prefer an explicit-confirmation or stateless workflow when handling sensitive business or personal communications.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:17- Finding
Overbroad Cross-Skill Access to Shared Contacts and Project Data
- Content
View full analysis
.md`. Read the box before adding and update the existing entry in place. The honorific, the politeness level and the name's reading stay here, in `## Recipients`, keyed by their contacts key: the person belongs to every skill, how you address them in Japanese belongs to this one. Formats and identity keys travel in `memory-template.md`, so this works whether or not the owning skills are installed. **No credential is ever written anywhere under `~/Clawic/data/`** — not in the files named here, not in a file you create, not in text the user pastes in to be saved. Platform and 会社 accounts are the temptation: store the pointer and strip the value — `env:LINE_CHANNEL_SECRET`, `keychain:note-login`, `1password:Work/X/ops`. If data sits at an old location (`~/japanese/` or `~/clawic/japanese/`), move it to `~/Clawic/data/japanese/`, and say in one line that you moved it and from where. ``` The shared-contact rules also permit updates and deletion: ```markdown - Read the file be ...[truncated 3402 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (38)
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
These instructions direct the skill to write templates, meeting records, and contact information into persistent local and shared files, turning a writing assistant into a data-management agent. That broadens the attack surface to unauthorized retention, propagation, and modification of potentially sensitive business information beyond the user's immediate request.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Maintaining a shared contacts database is outside the narrow purpose of improving Japanese writing and introduces a separate capability to alter organizational identity data. If misused or triggered on untrusted input, it can poison shared records, leak third-party data, or create durable corruption that affects later communications.
- Content
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 55% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md - **Name the constraint, not the preference.** リソースの都合で / 予算の関係で / 社内の方針で. A refusal attributed to a circumstance leaves the relationship intact; one attributed to a judgement does not. - **One reason, one clause.** Three reasons read as excuse-making and invite the reader to solve them one at a time. - **Offer the adjacent yes.** 今回は難しいのですが、9月以降であれば調整可能です. The counter-offer is what makes the refusal a negotiation instead of a door. - **Do not apologise twice for the same no.** 申し訳ございません at the top and ご期待に添えず申し訳ございません at the bottom reads as insincere padding; pick the one that carries the weight. - **難しい means no.** When a Japanese counterpart says 難しい, the correct reading is refusal, not difficulty. Treating it as an invitation to argue is the classic import from English negotiation. ## The Apology Ladder
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 55% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md - **Name the constraint, not the preference.** リソースの都合で / 予算の関係で / 社内の方針で. A refusal attributed to a circumstance leaves the relationship intact; one attributed to a judgement does not. - **One reason, one clause.** Three reasons read as excuse-making and invite the reader to solve them one at a time. - **Offer the adjacent yes.** 今回は難しいのですが、9月以降であれば調整可能です. The counter-offer is what makes the refusal a negotiation instead of a door. - **Do not apologise twice for the same no.** 申し訳ございません at the top and ご期待に添えず申し訳ございません at the bottom reads as insincere padding; pick the one that carries the weight. - **難しい means no.** When a Japanese counterpart says 難しい, the correct reading is refusal, not difficulty. Treating it as an invitation to argue is the classic import from English negotiation. ## The Apology Ladder
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 70% confidence
- Finding
Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.
- Content
md Destinations, all in `memory-template.md`: - **Anything that landed badly** — a refusal read as curt, a joke that did not travel, an apology read as evasive — → `## Pain Points`, with the cause, not just the event. This is the single highest-value section in the memory file for this domain, because pragmatic failures are invisible to the writer and obvious to the reader. - **A person's pragmatic preferences** — they prefer directness, they dislike クッション言葉, they never answer chat and always answer email → their `## Recipients` row. - **A phrasing that resolved something difficult** — the refusal that kept the relationship, the apology that closed the incident → `artifacts/template-<what>.md` with what it was for and what happened next.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md When the user pastes something to save — a platform API config, an account handover note, a 社内 wiki page with a login in it — replace each secret value before writing and leave the pointer visible: `channel_secret: <env:LINE_CHANNEL_SECRET>`. Say in one line that you did it. In this domain — **not secrets, keep them**: names and their readings, 敬称 and 役職, company and 部署 names, handles and account names, group names, city and 都道府県 names, post URLs, follower and 文字数 counts, prices with their currency, invoice numbers. **Secrets, strip them**: platform app secrets and access tokens, account passwords, verification codes, マイナンバー, 基礎年金番号, full bank account and 口座 numbers, 印鑑登録 numbers, private phone numbers and home addresses the user has not asked to keep, anything inside a pasted config or `.env`. One rule that is not about credentials: **a piece of writing often carries someone else's private business** — a 退職願 names a reason, a 忌引 message names a death, a 始末書 names a failure. Keep the template and the level decision, not the personal detail; if a full text must be kept as a reference, strip the names and the reason and say so.
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The instruction "Produce the Japanese first; explain in English only when asked" imposes a specific output language for explanations rather than offering the user a language choice. This is a natural-language locale policy issue because it defaults explanatory content to English without explicit user opt-in or a documented regional justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The title and content explicitly prescribe Japanese business email and document-writing behavior, including mandatory Japanese forms and wording. Under the stated policy, forcing a specific language/locale without user opt-in is a natural-language policy violation unless the regional constraint is clearly documented and justified.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill explicitly instructs reading from a persistent local memory file before composing an email, which expands behavior from text generation into data access. That creates unnecessary exposure of stored personal/contact data and couples routine writing tasks to local-file retrieval without an explicit need, consent boundary, or minimization rule.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Recommending full-thread quoting as a default can unnecessarily replicate prior messages containing personal, confidential, or irrelevant third-party information. In business email, that increases the chance of over-disclosure when recipients change, messages are forwarded, or sensitive context is preserved longer than needed.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill tells the agent to store contact and recipient data in shared memory files without warning about privacy, consent, retention, or third-party data handling. In a business context, names, readings, affiliations, and communication preferences are personal or sensitive operational data, so silent persistence increases privacy and compliance risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The file prescribes Japanese chat conventions throughout, including required forms of address, punctuation norms, and register rules for LINE and Slack, without any indication that the user can opt into or out of this locale-specific behavior. The policy allows locale constraints only when clearly documented and justified as region-specific; here the skill is strongly locale-bound but does not explicitly frame itself as opt-in or region-limited guidance.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill directs the agent to read relationship- and channel-specific data from persistent memory files before composing a message. That expands the skill from text editing into profile-based data access, creating unnecessary exposure of personal and behavioral information that is not strictly required to rewrite Japanese naturally. In context, this is more dangerous because the file ties writing behavior to named individuals and communication channels, encouraging retrieval of stored interpersonal preferences without an explicit need or consent check.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation instructs persistent recording of channel rules, recipient-specific traits, and negative interaction history such as 'pain points.' That is a data-retention behavior outside the declared purpose of Japanese writing assistance and can accumulate sensitive interpersonal profiles over time, including inferred preferences and reputational notes. The skill context makes this more concerning because the stored notes are designed to influence future communications with specific people, increasing privacy and misuse risk.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly instructs reading from a persistent memory file before producing documents that name a person or company. That expands the skill from transient text composition into cross-session data access, creating a privacy and data-minimization risk if names, company details, or prior context are accessed without an explicit per-request need and user consent.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file instructs the agent to create and update persistent templates, due tables, and environment records based on user interactions. This can cause silent retention of sensitive business documents, workflow patterns, and personal correspondence artifacts beyond the original session, increasing the risk of unintended disclosure, over-collection, and later misuse.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill directs storage of confirmed name readings, exact company names, and accepted document templates into memory files without any warning about the sensitivity of personal or organizational data. Because these fields can include personally identifiable information and business-specific details, persistent storage without notice or consent creates a clear privacy and confidentiality risk.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file explicitly instructs the skill to inspect a user-specific memory file in the home directory to tailor outputs. That creates unnecessary access to potentially sensitive local data beyond the manifest’s stated role of writing/editing Japanese, and can expose personal preferences, contacts, or prior interactions without clear need or consent.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly instructs the agent to read
~/Clawic/data/japanese/characters/<name>.mdbefore generating dialogue, which expands the skill from text editing into persistent local data access. That is dangerous because it causes undisclosed access to user-local files and creates a path for unintended data exposure or dependence on sensitive local state unrelated to the immediate prompt.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The requirement to read character files from the user's home directory is not surfaced as a user-facing capability or warning, so the skill may access local content without meaningful disclosure. In this context, the skill is for writing/editing Japanese, so hidden file reads are not expected by users and are therefore more suspicious and more likely to violate privacy expectations.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This section directs the skill to write character voices, plot events, project conventions, terms, and environment constraints into local files under structured paths. That introduces persistent memory-management behavior beyond the stated purpose of Japanese composition, increasing the risk of unauthorized retention of user content, cross-task data leakage, and silent modification of local files.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The statement "The topic goes first, always" is part of a prescriptive set of language rules that constrain responses to Japanese-specific structure without indicating any user choice of language or locale. This can amount to forcing a specific language/locale behavior rather than offering it as an option.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The heading explicitly scopes the template to Japanese, which is a language-specific constraint. Under the policy, language forcing is a finding unless the skill offers a language choice or clearly documents a justified region-specific constraint; this file does not do either.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 76% confidence
- Finding
The skill directs broad, automatic persistence of user-derived observations and generated content across sessions, including migration into multiple durable files and shared boxes. Even without malicious intent, this creates privacy and data-minimization risk because sensitive personal or business context may be retained longer than necessary, reused in later contexts, or exposed to other skills reading shared stores.
- Content
md Everything except style guides, character sheets, the pieces log, artifacts and the shared boxes begins inside `memory.md`. Splitting is a procedure, not a suggestion: 1. Before appending to a section, count its entries. 2. If the append would take it past **~15 entries or ~40 lines of real content** — scaffolding, headings and comments do not count — then, in the same turn: create the new file, move the whole section into it, **delete the section from `memory.md`**, add its line to `## Boxes`, and append the new entry to the new file. 3. Keep the headings identical on both sides of the move, promoted one level (`### Terms` inside `memory.md` becomes `## Terms` in `glossary.md`), so the split is a copy-paste and never a rewrite. 4. Never leave a copy behind. If the same data ever appears in both places, the extracted file wins and the `memory.md` copy is deleted.
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file directs the agent to persist information across multiple artifacts such as character sheets, term lists, and correction logs. Unscoped memory writes can store user content, preferences, or project data beyond the immediate task, increasing risks of privacy leakage, cross-project contamination, and unauthorized retention.
- Content
Static analysis
No suspicious patterns detected.