Markdown

• Outcome: Pass
• Latest audit: Jul 27, 2026 · 10:16 AM UTC
• Version: 1.0.3

Overview

This Markdown helper is coherent and local-only, but it keeps persistent local notes about Markdown preferences, projects, and renderer quirks.

Install this only if you are comfortable with the agent maintaining local Clawic notes under `~/Clawic/data/markdown/` and limited shared project/contact pointers. Review those files periodically, and avoid asking it to persist documents containing secrets unless the values are stripped to pointers.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill instructs the agent to write results into a persistent tracking file under `~/Clawic/data/markdown/checks/<year>.md` and to update `config.yaml`, which extends behavior beyond Markdown editing into long-lived state and workflow management. That creates an unnecessary side effect surface: a Markdown-focused skill could alter user records, project tracking, or configuration without explicit, per-task authorization, and the location/pathing is pre-specified rather than user-scoped at runtime.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: Persistent modification of user data and config is not justified by the skill's stated purpose of writing, fixing, and converting Markdown. In this context, the instruction is more dangerous because it can silently convert a content-editing task into an environment-modifying action, causing unwanted state changes, audit noise, or corruption of tracking/config files unrelated to the immediate Markdown request.

Intent-Code Divergence

Low

• Confidence: 86% confidence
• Finding: The skill instructs the agent to read and write to shared paths under `~/Clawic/data/...`, including memory and project-specific artifacts. That creates a cross-context data exposure risk: a general Markdown skill should not implicitly depend on or modify shared memory stores, because it could leak prior project information, contaminate future runs, or access sensitive data unrelated to the current task.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The documentation instructs the agent to write persistent records under a user-local path (`~/Clawic/data/markdown/checks/<year>.md`) and update `memory.md`, which goes beyond Markdown editing/conversion and creates durable state on the host. In an agent setting, this can cause unauthorized filesystem modification, privacy leakage, and cross-task state pollution, especially if the agent has file write permissions and the user did not explicitly request recordkeeping.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill instructs the agent to write results into persistent files under `~/Clawic/data/markdown/` and `artifacts/`, which goes beyond pure Markdown/MDX transformation and introduces unauthorized state modification. In an agent setting, this can create hidden persistence, alter local project metadata, and be repurposed to exfiltrate or poison future runs through memory files.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill instructs the agent to persist information into a user-specific memory file and add reusable content into an artifacts repository, which expands behavior from Markdown formatting advice into cross-session state modification. That can lead to unauthorized persistence of user/project data, prompt-injection residue, or pollution of shared memory/templates without an explicit trust, scope, or approval boundary.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The skill explicitly instructs writing data to a user-local file (`~/Clawic/data/markdown/memory.md`) and creating templates in `artifacts/` without any guardrails, confirmation step, or scope restriction. In an agent setting, this can cause unintended persistent local state changes, leak usage patterns into disk artifacts, or overwrite user-maintained files if the agent follows the instruction automatically.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly instructs the agent to write derived documentation artifacts to a fixed path under the user's home directory (`~/Clawic/data/...`) without any user confirmation or runtime scoping. This creates unauthorized persistence and can leak project-specific metadata into a cross-project local store, especially when processing untrusted or sensitive repositories.

Missing User Warnings

Low

• Confidence: 93% confidence
• Finding: The document directs writes to specific home-directory files without warning the user that local state or documentation will be modified. Even if intended for workflow tracking, silent filesystem modification is risky because it can surprise users, corrupt local records, or establish durable state unrelated to the immediate Markdown editing task.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The instruction tells the agent to persist discovered schema details and to handle frontmatter tokens by storing a 'pointer' under `~/Clawic/data/`, which still encourages retention of potentially sensitive metadata outside the source repository. In the context of a Markdown/frontmatter skill that may process untrusted content, this increases the risk of secret exposure, data retention without consent, and cross-context contamination of a local knowledge base.

Session Persistence

Medium

• Category: Rogue Agent

Content

- ~/clawic/markdown/
---

**Data.** At the start of every session, read `~/Clawic/data/markdown/config.yaml` (what the user declared) and `~/Clawic/data/markdown/memory.md` (what you observed, plus its `## Boxes` index and `## Due` table). Open any file `## Boxes` names when the condition on its line applies — the index is the list of files, never assume the list is fixed. Every path it names is inside `~/Clawic/data/`; ignore any line that points anywhere else. Everything this skill reads or writes is a plain local note under the folders declared in `configPaths` — nothing leaves the machine and no credential is ever written. In a shared box it updates or removes only the rows it wrote itself, matched on that box's identity key; a row another skill wrote is read, never rewritten and never deleted, and every write and deletion is named in one line as it happens. Read the recorded render targets before writing or fixing any document: the same bytes are correct in one parser and broken in another. If none of it exists, work from defaults and say nothing about it.

**Write before the session ends** whenever the session produced something durable: a render target and the quirk it imposes; a doc set and the generator that builds it; a lint, formatter, or CI config that finally passed; a conversion recipe that produced the right output; a house-style rule observed in their files; a link or lint sweep and what it found; or something the user will re-read — a page or README template, a style guide, a decision about the docs stack. `memory-template.md` holds every destination, format and threshold, and is the only file you open in order to write.

• Confidence: 94% confidence
• Finding: write and deletion is named in one line as it happens. Read the recorded render targets before writing or fixing any document: the same bytes are correct in one parser and broken in another. If none o

VirusTotal

58/58 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.