T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:34- Finding
Automatic Plaintext Persistence of Sensitive Financial and Personal Data
- Content
View full analysis
- Remediation
View remediation
Security audit
Money
Security checks for vulnerabilities and agentic risk
Overview
This is a real personal-finance advice skill, but it automatically saves and edits detailed financial records in shared local files without asking first.
Install only if you want this skill to maintain a durable local financial memory. Review the ~/Clawic/data paths, keep them private and backed up, and be aware that account balances, debts, income, contacts, fraud history, and decisions may be written in plaintext unless your agent adds its own confirmation and storage controls.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
memory-template.md:208- Finding
Ambiguous Name-Based Ownership Can Cause Cross-Skill Record Modification or Deletion
- Content
View full analysis
.md` with the same columns, and `accounts.md` becomes the index (`Name | Institution | Type | → file`). If you arrive and the folder already looks like that, follow it — never start a parallel `accounts.md`. - **Foreign columns win.** If the file already exists with a different column set, match its columns and add anything missing as a trailing note. Never rewrite its header. - Access reference is a pointer only, never a number, login or password. ## Shared subscriptions `~/Clawic/data/finances/subscriptions.md`. Identity is `Name`; update in place, delete the row when it is cancelled and note the date and the saving in `memory.md`. ``` `memory-templ ...[truncated 3751 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Findings (41)
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest for Money says it is not for picking funds or brokers and distinguishes that scope from
invest. This file is an investing policy skill covering whether to invest, portfolio proportions, equity/bond allocations by risk posture, rebalancing, and tax-aware asset location; those are specialized investment capabilities outside the stated Money skill purpose.- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | Name | Institution | Type | Purpose | Rate | Balance | As of | Access reference | |------|-------------|------|---------|------|---------|-------|------------------| | Joint current | Banco X | current | bills and direct debits | 0% | 2,100 EUR | 2026-07-26 | keychain:bancox-joint | | Buffer | Banco Y | savings | emergency fund | 2.4% AER | 9,800 EUR | 2026-07-26 | keychain:bancoy | | Visa | Banco X | credit card | — | 21.9% APR | -3,400 EUR | 2026-07-26 | keychain:bancox-card | | Mortgage | Banco Z | mortgage | home | 2.1% fixed to 2033 | -58,000 EUR | 2026-07-26 | file:~/Documents/mortgage.pdf |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | Name | Institution | Type | Purpose | Rate | Balance | As of | Access reference | |------|-------------|------|---------|------|---------|-------|------------------| | Joint current | Banco X | current | bills and direct debits | 0% | 2,100 EUR | 2026-07-26 | keychain:bancox-joint | | Buffer | Banco Y | savings | emergency fund | 2.4% AER | 9,800 EUR | 2026-07-26 | keychain:bancoy | | Visa | Banco X | credit card | — | 21.9% APR | -3,400 EUR | 2026-07-26 | keychain:bancox-card | | Mortgage | Banco Z | mortgage | home | 2.1% fixed to 2033 | -58,000 EUR | 2026-07-26 | file:~/Documents/mortgage.pdf |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | Name | Institution | Type | Purpose | Rate | Balance | As of | Access reference | |------|-------------|------|---------|------|---------|-------|------------------| | Joint current | Banco X | current | bills and direct debits | 0% | 2,100 EUR | 2026-07-26 | keychain:bancox-joint | | Buffer | Banco Y | savings | emergency fund | 2.4% AER | 9,800 EUR | 2026-07-26 | keychain:bancoy | | Visa | Banco X | credit card | — | 21.9% APR | -3,400 EUR | 2026-07-26 | keychain:bancox-card | | Mortgage | Banco Z | mortgage | home | 2.1% fixed to 2033 | -58,000 EUR | 2026-07-26 | file:~/Documents/mortgage.pdf |
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill directs the agent to create and update several persistent records containing fraud incidents, decisions, sensitivities, and adviser details. This materially broadens the skill into long-term dossier building on highly sensitive financial and household matters, which can expose users to privacy harm, profiling, and secondary misuse if those files are accessed by other skills or parties.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The instruction 'Every euro allocated is a euro not allocated elsewhere' imposes euro-specific wording even though the configuration later allows currency to vary by user and default. This creates a natural-language locale inconsistency that can force a specific regional convention without explicit opt-in.
- Content
Context Window Stuffing
Medium
- Category
- Memory Poisoning
- Confidence
- 85% confidence
- Finding
Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
- Content
md | 1 | Capture the full employer match, where one exists — the wrapper name depends on `country` | Contributing at least up to the match ceiling; a 50% match is an instant 50% return, unmatched by anything below | | 2 | One month of core spending in cash | Buffer ≥ one month of core spend + the largest insurance deductible | | 3 | Clear every balance priced above `high_interest_rate_pct` | Nothing left above the line (`debt.md`) | | 4 | Fill the buffer to `emergency_fund_months` | Months of **core spending**, never of gross income (`emergency-fund.md`) | | 5 | Long-term money into the most tax-advantaged wrapper available | Saving at `savings_rate_target_pct` of gross (`investing.md`, `retirement.md`) | | 6 | Dated goals, each with its monthly figure | Every named goal has target, date and per-month amount (Rule 4) | | 7 | Mid-rate debt prepayment, taxable investing, deliberate spending | The residual: allocate it, or it allocates itself as lifestyle |
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md | Trap | Why it fails | Do instead | |---|---|---| | Answering "should I invest?" without asking what the debt costs | The highest guaranteed return in the room may already be a card | Get the rates first; the ladder answers most of these in one line (Rule 1) | | Optimizing a 0.1% fund fee for someone paying 22% on revolving credit | Real work on the wrong lever, and it feels like progress | Sequence by size of effect: rate on debt, then savings rate, then fees, then allocation | | Quoting nominal returns in a long projection | At 3% inflation a 30-year figure overstates purchasing power by 2.4× | Every projection over 5 years is quoted in real terms (Rule 2) | | Sizing the emergency fund on gross income | Inflates the target by the tax rate and delays steps 5-7 by months | Core monthly spending × `emergency_fund_months`, core defined by what survives a cut |
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill instructs the agent to write several records into user data files under ~/Clawic/data, but it does so as a default operational step and without any explicit safety guard, confirmation requirement, or limitation on when writes are allowed. Because the content being written includes decisions, financial accounts, budgets, and artifacts, a mistaken, manipulated, or premature execution could alter persistent financial records and influence future decisions based on corrupted state.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The documentation requires reading and maintaining budget and memory files, which effectively turns the skill into a personal finance tracker despite the manifest saying tracker/import behavior is out of scope. This scope mismatch is dangerous because users and upstream controls may grant the skill trust or permissions appropriate for advice, not for maintaining persistent financial records.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill explicitly instructs writing budgeting outputs and financial profile data into persistent shared files, which extends beyond advisory behavior into storing sensitive personal finance records. This creates privacy and integrity risk because the agent may overwrite, alter, or persist highly sensitive data without clear user confirmation or scope limits.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill tells the agent to write sensitive financial data to local shared files but provides no warning, confirmation step, or safeguards around modifying existing user data. In practice, this can lead to silent overwrites, corruption of prior records, or unintended persistence of private financial information.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill tells the agent to store identity-theft dispute details, dates, and reference numbers in local artifact files without any explicit requirement to obtain user consent or warn that sensitive information will be written to disk. Because this content concerns fraud incidents and personal financial records, unintended persistence increases privacy and exposure risk if the local workspace is later accessed, synced, or exfiltrated.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs persistent updates to memory and accounts files with freeze status, report pulls, card limits, rates, and identity-incident tracking, again without a user-facing warning or consent checkpoint. In a personal-finance context this is especially sensitive, since these files aggregate high-value financial metadata that could aid profiling, fraud, or privacy violations if stored automatically.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill mandates reading persistent financial memory and account files before answering any debt question, creating a broad default access pattern to sensitive data. Even if intended for continuity, this expands unnecessary data exposure and couples routine advice to full financial-history access.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs the agent to write detailed debt plans, balances, rates, and projected interest savings into persistent user files without any explicit consent, minimization, or retention warning. Because this is highly sensitive financial data, default persistence increases exposure if those files are later accessed by other skills, users, or systems.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill directs the agent to persist debt decisions, balances, rates, account updates, and payoff-plan artifacts as a standard workflow. This creates ongoing retention of sensitive financial data in multiple locations, increasing the attack surface and the chance of overcollection beyond what is needed to answer the current request.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill requires reading multiple persistent memory files before answering, including broad personal finance context that may exceed what is necessary for a housing question. This violates least-privilege principles by granting broad access to sensitive user data and increases the chance of unnecessary data exposure or cross-context leakage into responses.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill instructs the agent to write to several persistent local files, including memory, decisions, accounts, and due-date records, even though the skill is described primarily as advisory guidance about housing choices. That expands the skill from analysis into durable state modification, which can create privacy, integrity, and over-collection risks if done automatically or without explicit user consent and tight scoping.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly instructs the agent to write household income details, compensation changes, and decision artifacts into persistent local files. That expands the skill from transient advice into long-term recordkeeping of sensitive financial data, which increases privacy and data-minimization risk if the user did not knowingly consent to storage or if other skills/processes can later read those files.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The instruction to write financial details to ~/Clawic/data/money/memory.md and related artifact files occurs without any warning to the user that sensitive household financial information will be persisted. In a money-management skill, this is especially risky because salary, bonus, household structure, and decision rationale are highly sensitive and could be unexpectedly retained or exposed to later access.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill directs the agent to persist user financial details and session-derived decisions in plain-language memory and artifact files, which creates a durable, human-readable record of sensitive data. Natural-language records are harder to constrain, easier to over-collect, and more likely to contain incidental sensitive context than narrowly scoped structured storage, increasing disclosure risk if accessed by other components or users.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest explicitly says Money is not for building a tracker or importing statements (
personal-finance-tracker) and not for a recurring-payment list (subscriptions). But this file instructs the agent to persist insurance data intocoverage-map.md,budget.md, decision logs, due lists, and claim artifacts, which is tracker-style record maintenance rather than decision guidance alone.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill instructs the agent to persistently write to several local memory and artifact files, expanding its behavior from advice into state mutation. Persistent writes can silently alter future agent behavior, create inaccurate financial records, or overwrite user data without explicit consent, which is risky in a finance context where records influence later recommendations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill directs the agent to modify multiple persistent files without any user-facing warning or consent flow. Silent state changes are dangerous because users may not realize records, policies, due items, and decision logs are being created or changed, and those artifacts can affect future financial advice or leak sensitive financial context into local storage.
- Content
Static analysis
No suspicious patterns detected.