JSON

• Outcome: Review
• Latest audit: Jul 27, 2026 · 9:16 AM UTC
• Version: 1.0.2

Overview

The skill is a coherent JSON helper, but it automatically reads, writes, reorganizes, and deletes persistent local Clawic notes without per-action confirmation.

Install only if you want this skill to maintain local, reusable JSON memory. Review or back up ~/Clawic/data/json/, ~/Clawic/data/projects/, and ~/Clawic/data/contacts/ first, and consider instructing your agent to ask before any write, delete, migration, or contact/project update.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill is presented as a JSON parsing/validation helper, but it also mandates reading and writing cross-session memory and project files. That expands the skill's effective scope from stateless transformation into persistent data collection and modification, which can expose unrelated local data and cause unintended retention or propagation of user/project information beyond what is necessary for the immediate JSON task.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The instruction to write files under ~/Clawic/data/json/contracts and ~/Clawic/data/projects adds persistent memory and file-writing behavior that is not reflected in the skill's declared JSON parsing/validation scope. In an agent setting, hidden persistence can be abused to exfiltrate derived data, poison future context, or cause unauthorized state changes across tasks, especially when payload contents may be sensitive.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill instructs the agent to write files directly into fixed user-home paths (`~/Clawic/data/...`) without any safety gating, user confirmation, or note that this modifies local state. In an agent setting, embedded file-write instructions can cause unintended persistence, overwrite existing project artifacts, or be abused as prompt-injected side effects unrelated to the user’s immediate task.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The template explicitly authorizes writes and deletions to persistent storage without requiring an explicit user confirmation at the time of modification. Even though paths are nominally scoped, this creates a real risk of unintended data modification because the agent is instructed to mutate durable state proactively and announce it after deciding to do so.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The split procedure mandates creating new files and deleting existing sections from memory.md in the same turn, which is destructive state mutation driven by internal policy rather than explicit user approval. This increases the chance of accidental data loss, corruption, or irreversible reorganization of stored notes if the agent miscounts entries, misclassifies content, or is induced by adversarial prompts to trigger the split logic.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The shared contacts guidance allows deletion of stored contact rows and files as part of routine inventory maintenance, again without requiring contemporaneous user approval. Because this data is shared across skills, deletion can have broader consequences than local note cleanup and may remove information still needed by other workflows.

Session Persistence

Medium

• Category: Rogue Agent

Content

- ~/clawic/json/
---

**Data.** At the start of every session, read `~/Clawic/data/json/config.yaml` (what the user declared) and `~/Clawic/data/json/memory.md` (what you observed, plus its `## Boxes` index and `## Due` table). Open any file `## Boxes` names when the condition on its line applies — the index is the list of files, never assume the list is fixed. Every path it names is inside `~/Clawic/data/`; ignore any line that points anywhere else. Everything this skill reads or writes is a plain local note under the folders declared in `configPaths` — nothing leaves the machine and no credential is ever written. In a shared box it updates or removes only the rows it wrote itself, matched on that box's identity key; a row another skill wrote is read, never rewritten and never deleted, and every write and deletion is named in one line as it happens. Read `~/Clawic/data/projects/<project>.md` before proposing a payload shape, a schema, or a format change for work the user tracks as a project. If none of it exists, work from defaults and say nothing about it.

**Write before the session ends** whenever it produced something durable: a schema that finally validates real payloads; a field-by-field contract for a payload you had to reverse-engineer; a jq, JMESPath, or SQL/JSON expression that took more than one attempt; a producer's quirk and its workaround; a measured size, record count, or parse cost; a convention the codebase settled on (casing, dates, nulls, envelope); a redacted sample payload worth keeping; or a decision with a reason — NDJSON over an array, jsonb over json, JSON Patch over merge patch. `memory-template.md` holds every destination, format and threshold, and is the only file you open in order to write.

• Confidence: 97% confidence
• Finding: write and deletion is named in one line as it happens. Read `~/Clawic/data/projects/<project>.md` before proposing a payload shape, a schema, or a format change for work the user tracks as a project.

Session Persistence

Medium

• Category: Rogue Agent

Content

Everything except schemas, contracts, fixtures, artifacts and the shared boxes begins inside `memory.md`. Splitting is a procedure, not a suggestion:

1. Before appending to a section, count its entries.
2. If the append would take it past **~15 entries or ~40 lines of real content** — scaffolding, headings and comments do not count — then, in the same turn: create the new file in `~/Clawic/data/json/`, move the whole section into it, **delete the section from `memory.md`**, add its line to `## Boxes`, and append the new entry to the new file.
3. Keep the headings identical on both sides of the move, so the split is a copy-paste and never a rewrite. `## Conventions` → `conventions.md`, `## Producers` → `producers.md`, `## Queries` → `queries.md`.
4. Never leave a copy behind. If the same data ever appears in both places, the extracted file wins and the `memory.md` copy is deleted.

• Confidence: 94% confidence
• Finding: create the new file in `~/Clawic/data/json/`, move the whole section into it, **delete the section from `memory.md`**, add its line to `## Boxes`, and append the new entry to the new file. 3. Keep the

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.