T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:34- Finding
Automatic Plaintext Persistence and Cross-Skill Sharing of Sensitive Health Data
- Content
View full analysis
- Remediation
View remediation
Security audit
Nutrition
Security checks for vulnerabilities and agentic risk
Overview
This nutrition skill is coherent and not malicious, but it automatically stores sensitive health information in plaintext shared local files without asking first.
Install only if you are comfortable with this skill keeping local plaintext health and nutrition notes under ~/Clawic/data/ and sharing some health facts with other health-adjacent skills. Use extra caution on shared, backed-up, or synced machines, and review the saved files regularly for accuracy and deletion needs. Avoid pasting portal exports or highly sensitive identifiers unless you understand what will be saved; the skill strips credentials but intentionally keeps medical facts such as medications, labs, diagnoses, and pregnancy/life-stage details.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (49)
Harmful Content Injection
Critical
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
This content may contain harmful instructions that could cause physical harm if followed. CRITICAL: Review carefully before use.
- Content
md Two populations, and they need different answers. **Celiac disease** is a medical necessity with strict cross-contamination rules (`restrictions.md`, `conditions.md`). **Non-celiac choice** is a preference — and often the outcome of an untested self-diagnosis. - **Screen for celiac before removing gluten.** The test requires gluten in the diet; removing it first means a diagnostic gap that takes a supervised gluten challenge to close. - Nutrient cost: most gluten-free flours are unfortified where wheat flour is fortified, so fiber, folate, iron, and B vitamins all drop. In folic-acid-fortifying countries this matters most for women who might become pregnant. - Fixes: oats certified gluten-free where tolerated, buckwheat, quinoa, teff, legumes, and brown rice over white rice flour products. Naturally gluten-free whole foods beat gluten-free replicas of bread and cake, which are usually lower in fiber and higher in fat and sugar. - Arsenic in rice is worth a mention for diets that lean heavily on rice-based gluten-free products: vary the grain rather than eliminating rice. ## Mediterranean The pattern with the strongest cardiovascular evidence base, and the one people implement as "olive oil and pasta".
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The instruction to write condition details, nutrient status, monitoring schedules, and clinician-set targets into persistent files grants the skill state-changing access over sensitive health records, which exceeds a nutrition advice role. This is dangerous because it can silently modify longitudinal medical data without explicit user consent, creating privacy, integrity, and safety risks if later advice or other systems rely on inaccurate or unauthorized entries.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file effectively gives the skill a health-record management function by directing updates to profile, due-tracking, and condition plan artifacts. In the context of a nutrition assistant, that capability is broader than necessary and increases the blast radius from answering a question to mutating regulated/sensitive health information that may affect future care guidance.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The instruction to write newly learned medications into a persistent health profile and related memory files stores highly sensitive personal health data without explicit disclosure or consent. Medication lists can reveal diagnoses, chronic conditions, and risk factors, so silent persistence materially increases privacy exposure and the chance of unauthorized reuse across future interactions.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Persisting newly learned medications into a long-lived health profile creates a durable record of sensitive medical information that may outlast the immediate task and be consumed by other skills or future sessions. In a health context, this is especially dangerous because medication data is highly revealing and errors or unauthorized access can have both privacy and safety consequences.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file directs the skill to write lab values, interpretations, and due-date reminders into persistent files, which is a clear data persistence capability involving sensitive health information. This expands the skill from nutrition advice into medical recordkeeping and creates confidentiality, integrity, and consent risks if data is stored automatically, incorrectly, or without user awareness.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file explicitly instructs the agent to write nutrient status assessments, intake estimates, targets, and supporting evidence to persistent memory. This is high risk because it stores derived health assessments plus rationale, creating a durable profile of sensitive health information that could be leaked, reused out of context, or relied on after becoming outdated.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill instructs automatic persistence of highly sensitive health data, including lab values, conditions, medications, symptoms, and supplement history, without requiring explicit user consent at the time of storage. Even though it claims data stays local, local persistence of health records still creates privacy and safety risk on shared devices, backups, sync targets, or later reuse by other skills, especially because the skill also writes into a shared health box consumed by other components.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file explicitly instructs the agent to persistently write meal/timing changes into user memory and profile-adjacent records. That exceeds simple nutrition guidance and creates a state-changing capability that can silently alter long-term user data, leading to incorrect future recommendations, privacy issues, or record corruption if the write is wrong or unauthorized.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The instruction grants an unjustified long-term memory update behavior not clearly required to answer a one-turn nutrition absorption question. In a health context, unauthorized persistence is especially risky because future advice may rely on stale or incorrect health-related notes that the user never intended to store.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The content directs the agent to write into user data files 'in the same turn' without any warning, confirmation, or audit cue. Silent modification of stored records is dangerous because users may be unaware their health-related notes are being changed, and those changes can propagate into later decisions or disclosures.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The markdown directs persistent writes to sensitive health files in the same turn, but it provides no requirement to warn the user or obtain consent before modifying those records. That omission is dangerous because users may believe they are receiving advice only, while the system silently stores or changes medical information that could later be surfaced as authoritative.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file explicitly instructs the agent to write nutrient status, lab values, due dates, and treatment protocol details into persistent user data files and artifacts. That expands behavior from providing nutrition guidance into modifying long-lived medical records, which is risky because it can store sensitive health information or alter records without clear user consent and can propagate incorrect advice across future interactions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The instruction to 'write in the same turn' to health profile and memory files creates silent persistence of sensitive medical data and protocol artifacts without any user-facing warning. In a health context, undisclosed writes are especially dangerous because users may not expect symptoms, labs, and supplement protocols to be stored, and future agent behavior may rely on stale or inaccurate persisted data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The file provides substantive health-management guidance, including elimination diets, constipation treatment steps, and references to magnesium citrate or oxide, but it does not clearly state that this is not medical advice or when professional supervision is required beyond scattered red-flag routing. In a nutrition skill, users may reasonably treat this as individualized medical guidance, creating risk of delayed care, inappropriate self-treatment, or harmful diet restriction.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The file directs the agent to persist user health observations and protocol state into memory and artifact files, which is operational behavior beyond simple nutrition guidance. In a health context, these writes can store sensitive symptom and condition data without clear scoping, consent, minimization, or manifest-level disclosure, increasing privacy and integrity risk if the agent over-collects or writes inaccurately.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This instruction requires the agent to update multiple persistent stores in the same turn, including reactions, nutrient status, due dates, and protocol artifacts. That broad write scope increases the chance of unauthorized persistence of sensitive medical-like data, cross-file contamination, and hidden state changes that affect future interactions in ways the user may not expect.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file requires reading and correlating medication and supplement data from multiple persistent locations before giving advice, which normalizes broad access and propagation of sensitive health data in plain language. Even if clinically useful, this increases the data surface area and the likelihood of unnecessary exposure, stale-data errors, or unintended downstream reuse.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill directs the agent to write schedules and interaction details into persistent records/artifacts without an explicit user-facing warning or consent step. Because the content concerns medications and supplement use, these writes involve sensitive health information and can surprise users who believed they were only receiving a conversational answer.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly instructs the agent to write to multiple persistent files, including health profile, nutrition memory, due items, and an artifact schedule. That expands behavior from answering a transient nutrition question into silent state mutation and cross-file propagation of sensitive data, which can create privacy, integrity, and scope-control risks if done without explicit consent and clear boundaries.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file explicitly instructs the agent to persist derived nutrition data into user memory and configuration files in the same turn. That exceeds a narrow read/analyze skill boundary and creates an integrity risk: incorrect, stale, or user-unapproved health-related data can be written into long-lived records and influence later recommendations.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill explicitly instructs the agent to read and rely on persistent local health profile files and historical lab records before answering. That creates stateful handling of sensitive medical data beyond simple in-session nutrition guidance, increasing privacy risk and enabling unauthorized retention or reuse of health information if the user did not clearly consent to persistent storage.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill instructs writing sensitive health data to profile files in the same turn without any explicit disclosure that persistent files will be modified. Silent persistence of medical information is dangerous because users may believe they are receiving transient advice while the agent is actually creating or updating long-lived records and reminders.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file instructs the agent to read from and rely on persistent memory files for user-specific nutrient status and food history. This extends behavior from transient nutrition guidance into stateful collection and reuse of health-related data, which increases privacy risk and creates opportunities for stale, over-broad, or cross-session data exposure.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Persisting and reusing user-specific nutrition status and supplement details creates a natural-language retention risk involving sensitive health information. If the memory store is later accessed by other tools, sessions, or operators without strict controls, the user’s health inferences and habits may be exposed or misused.
- Content
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- memory-template.md:60