Learn

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:25 PM UTC
• Version: 1.0.4

Overview

This learning skill is mostly coherent, but it asks to automatically read and change persistent local learning, contact, project, and finance records, including deletions or subscription cancellation steps, without enough user confirmation.

Install only if you are comfortable with a learning assistant maintaining local long-term records and touching related project, contact, and subscription files. Before use, consider requiring manual approval for any finance/contact edit, subscription cancellation, file migration, or deletion, and keep backups of ~/Clawic/data/.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:17

Finding

Overbroad Access to Shared Personal and Financial Data

Content

View full analysis

.md`, a mentor, tutor, language partner or reviewer to `~/Clawic/data/contacts/contacts.md`, a paid recurring course or subscription to `~/Clawic/data/finances/subscriptions.md` — one entity, one home, referenced here by name only. ``` Related data schemas are defined at `memory-template.md:17-21` and `memory-template.md:256-310`. ### Technical Analysis The Skill is primarily a self-directed learning planner, but its declared access includes shared contact and financial directories. It can read and modify mentor contact records, email identifiers, communication preferences, subscription prices, renewal data, and payment-card last-four digits. The `## Boxes` mechanism compounds this exposure by instructing the agent to open a mutable list of files whenever their textual condition applies. Although indexed paths are restricted to `~/Clawic/data/`, that boundary still encompasses data unrelated to the active learning task. There is no per-file authorization check, active-topic restriction, or explicit approval requirement before shared data enters the agent ...[truncated 1615 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: memory-template.md:25

Finding

Automatic Destructive File Mutations Without Prior Confirmation or Reliable Ownership Metadata

Content

View full analysis

.md`, and the revision line inside it | | A topic was started, promoted a mastery level, paused or retired | Its row in `## Topics` | | Items were added to the queue, or graded in a review | The queue rows (interval, ease, next due, lapses) | | A mistake was made and its cause identified | `## Error Log` — the misconception, not just the wrong answer | | A practice session ran | A row in `sessions/.md` with minutes and success rate | | A resource was finished, abandoned, or demoted to lookup | `## Resources`, with the verdict in one clause | | A cheat sheet, a from-memory explanation, an assessment, or a how-to-learn-this decision came out of the session | `artifacts/` | | The learner started building something to learn with | `~/Clawic/data/projects/.md`, referenced by name in the plan | | A mentor, reviewer or partner entered the loop — or left it | `~/Clawic/data/contacts/contacts.md`: the row, added or deleted, with the date of a departure noted in `memory.md` | | A paid course or platform was subscribed to or cancelled | `~/Clawic/data/finances/subscriptions.md` | | A cadence was agreed or run (review day, plan review, maintenance touch) | `## Due` | | The learner declared a preference | Its key in `config.yaml` | ``` The destructive split procedure at `memory-template.md:43-48` further instructs the agent to create a new file ...[truncated 2833 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (17)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md

---
name: Learn
slug: learn
version: 1.0.4
description: 'Runs self-directed learning as a system: a curriculum with an exit test, deliberate practice, spaced review, and proof it transferred. Use when someone is teaching themselves a skill or subject with no course and no exam — a language, an instrument, a programming language, a new field at work; when they ask how to learn X, what to learn first, or how long it will honestly take; when months of tutorials produced nothing they can build; when material learned earlier is gone, reviews pile up, or the queue gets skipped for weeks; when progress stalls on a plateau, motivation collap

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 85% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md

**No credential is ever written anywhere under `~/Clawic/data/`** — not in the files named here, not in a file you create, not in text the learner pastes in to be saved. Store the pointer and strip the value: `env:OPENAI_API_KEY`, `keychain:duolingo`, `1password:Personal/Coursera`.

Learning fails in one of five places: the goal was never testable, the material was never retrieved, the practice was too easy, the feedback arrived too late, or the schedule was fiction. Name which one before proposing a fix. Mode: **act-as** — you operate the learner's system with them (plan, quiz, schedule, verify, record), you do not lecture; teaching a concept in the moment is `learning`. Work from defaults immediately: never open with questions about their goals, their hours, or how proactive to be. Precedence for any value: `config.yaml` → `~/Clawic/profile.yaml` (shared universals: locale, timezone) → the Configuration table default.

## When To Use

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · memory-template.md (reported line 56)May include surrounding context.

md

Nothing under `~/Clawic/data/` ever holds a secret value — not the files named here, not files you create, not text the learner pastes in and asks you to keep. Store the pointer in its place, in this shape: `<kind>:<locator>`.

`env:OPENAI_API_KEY` · `keychain:duolingo` · `1password:Personal/Coursera` · `bitwarden:Learning/italki` · `file:~/.ssh/id_ed25519` · `profile:school`

When the learner pastes something to save — a course login, an API key inside a practice snippet, an exported `.env` from a tutorial project — replace each secret value before writing and leave the pointer visible: `api_key: <env:OPENAI_API_KEY>`. Say in one line that you did it.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill description is extremely broad and likely to trigger on many ordinary 'how do I learn X' or 'how long will this take' requests. Overbroad routing can cause this skill to activate in contexts where it should not, leading the agent to read and write persistent local files and steer the interaction into its own workflow unnecessarily.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · curriculum.md (reported line 18)May include surrounding context.

md

| "Understand machine learning" | Take a raw CSV to a validated model with a written error analysis, no template repo |
| "Learn guitar" | Play three songs start to finish at tempo, from memory, for someone in the room |

Tests for the test: could a stranger grade it without asking follow-up questions? Could you attempt it *today* and fail cleanly? If the answer to either is no, the goal is still a topic, not a target.

**Level check.** An exit test set at a level far above the current one produces a plan of unknown length. If the honest range (below) exceeds ~6 months, split the test into a first milestone you can reach in 4-8 weeks and keep the far target as a line in the plan, not as the thing being scheduled.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The maintenance guidance for a learning skill instructs the agent to cancel entries in a finance subscriptions file, which is outside the skill’s declared learning scope and touches account-affecting data. Even if intended as housekeeping, this expands the skill’s authority into unrelated financial record management and could cause unauthorized or mistaken cancellation actions when a user only asked to retire a skill.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This workflow explicitly directs updates to learning records and also cancellation of a row in ~/Clawic/data/finances/subscriptions.md, crossing from educational maintenance into financial/account-affecting operations. That scope expansion is dangerous because an agent following routine maintenance instructions may alter sensitive non-learning data without a separate user request or contextual safety check.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The template explicitly instructs the agent to delete sections from memory.md as part of a split procedure and to prefer extracted files over in-file copies. Even if intended for data hygiene, destructive operations without an explicit user confirmation or backup step can cause irreversible loss if the move is interrupted, misapplied, or targets the wrong section.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The contacts guidance says that when a mentor or reviewer leaves, their row should be deleted. Removing rows from a shared contacts store without a confirmation, tombstone, or archive mechanism risks accidental loss of relationship history and can affect data used by other skills or workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The subscription guidance instructs cancellation to delete the row from finance records. This can erase billing history and make auditing, budgeting, or later reconciliation impossible, especially in a shared finance file.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs modification of ~/Clawic/data/finances/subscriptions.md, which is outside the stated learning/plateau-management scope and touches personal financial records. Even though framed as a practical cleanup step, it expands the skill's authority into unrelated sensitive data, creating risk of unintended edits or normalization of cross-domain file access.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file gives conflicting lifecycle rules for project records: one section says the project file content is deleted on closing, while a later section says project identity is preserved and retirement is recorded in-file, never by deletion. In a skill that explicitly stores ongoing learning state across sessions, this ambiguity can cause an agent or user to delete records that should be retained, breaking traceability and potentially losing review and error-tracking context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The text instructs deletion of project-associated state without any warning, confirmation step, or backup guidance. Because this skill manages persistent files under a user data path, an agent following this instruction could remove learning history or in-progress notes unexpectedly, creating avoidable data loss and undermining the skill's stated goal of preserving progress across sessions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This markdown file includes invocation guidance with several broad natural-language conditions such as "when a topic starts" and "when a resource is not working." These conditions are not specific enough to clearly distinguish when the skill should activate versus when it should not, which could lead to over-triggering in ordinary workflow contexts.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · ai-assisted.md (reported line 44)May include surrounding context.

md

- **Reveal the answer while asking for a confidence rating.** The rating must precede the reveal or the column carries no information.
- **Let recognition pass as recall**, by phrasing questions so that the answer appears among the options or inside the question.
- **Turn a verification test into a teaching session.** During verification, the agent grades and says nothing else until the test is over.
- **Silently expand scope** — answering the interesting adjacent question instead of the one asked spends the session's budget on the agent's interest.

## What an Agent Is Uniquely Good At

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The document describes canceling an associated subscription as part of retirement but provides no warning, confirmation step, or distinction between marking a record and actually canceling a real-world service. In an agentic context, omission of such safeguards can normalize destructive or account-affecting actions as routine maintenance, increasing the chance of accidental user harm.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The instruction to cancel a subscription and modify a subscriptions record lacks any warning that the action affects personal financial information. This can lead users or downstream agents to perform sensitive account/record changes without heightened consent or verification, increasing the chance of accidental financial disruption.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: memory-template.md:58