ClawHub
Back to skill

Security audit

Learning

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed adaptive tutoring helper that keeps local learning notes, with no evidence of hidden execution, exfiltration, or unrelated authority.

Install this if you want a tutor that remembers local learning preferences and topic progress across sessions. Before installing, be comfortable with it creating or updating files under ~/Clawic/data/learning/ and reading ~/Clawic/profile.yaml for shared language/locale defaults; review or delete those local files if you do not want retained learning history.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill description and usage guidance include very broad natural-language triggers such as 'explain this,' 'break it down,' and especially heuristic conditions like when an explanation 'is not landing' or the user 'goes quiet.' These can cause unintended activation on ordinary conversation, potentially routing unrelated requests into this skill and causing inappropriate file access to the learner log or behavior changes without clear user intent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The setup explicitly instructs the skill to read and persist learner preferences and session/topic history in local files, which expands behavior beyond a transient teaching interaction into stateful data collection. Even if intended to personalize learning, this creates privacy and scope-creep risk because user data is retained without clear consent, minimization, or retention controls in this file.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

Maintaining a persistent learner profile plus longitudinal topic logs enables ongoing profiling of the user across sessions, which is broader than a one-off teaching assistant and close to the excluded curriculum-tracking behavior. In context, the danger is mainly privacy and unexpected accumulation of behavioral data rather than direct code execution or system compromise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill writes learner data to local files 'immediately, without ceremony' and records session results every session, but this file provides no user-facing warning or consent step. That makes the persistence covert from the learner's perspective, increasing privacy risk and the chance of storing sensitive educational or behavioral data unexpectedly.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
76% confidence
Finding

The setup authorizes the skill to autonomously infer preferences from user behavior and commit those in memory/topic logs without confirmation in some cases. In this context, the risk is not arbitrary action execution but silent profiling and state changes that affect future interactions without the user's awareness.

Content

Scanner excerpt · setup.md (reported line 22)May include surrounding context.

md
- User declares a preference ("just show me code", "keep it short") → update the matching key in `~/Clawic/data/learning/config.yaml` immediately, without ceremony.
- Observed format signal (a correct generation after a format, a re-ask after a format) → hypothesis in `memory.md`; confirmed at 2 consistent signals (SKILL.md Rule 8); a contradicting signal resets the count.
- Session results (level placed, concepts covered, misses, retirements) → the topic log in `memory.md` every session. This is operational data, not preference — it needs no confirmation threshold.
- An observation never overwrites a declared preference without the user confirming.

If the user has said and shown nothing, store nothing beyond the topic log.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

Line 3 states not to interview the learner, but line 16 requires every fresh session to open with two diagnostic probes. Those probes are learner questions used to assess prior knowledge, so the documentation contradicts itself about whether the skill questions the learner at session start.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.