Contacts

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 5:03 PM UTC
• Version: 1.0.3

Overview

This is a local contacts/address-book skill that stores personal relationship notes, but its storage, limits, and privacy safeguards are disclosed and aligned with that purpose.

Install only if you want an agent to maintain a durable local address book about people you mention. Expect it to write and update local Clawic contact files automatically during relevant conversations; review those files if third-party privacy, sensitive life events, or deletion behavior matters to you.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (22)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The debrief instructions tell the agent to write contact-related commitments into ~/Clawic/data/people/memory.md, which is a different store from the contact records described elsewhere in the skill. Crossing data boundaries like this can cause personal relationship data to be duplicated, exposed to unrelated skills, or written into a broader memory file with different retention and access assumptions. In a contacts skill handling sensitive personal facts, that mismatch is a real data-integrity and privacy risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The file repeatedly instructs the agent to persist meeting-derived personal data such as illnesses, family deaths, separations, commitments, and other sensitive facts, but gives no privacy gating, minimization rules, or sensitivity warning at the point of capture/write. In this context, that omission is dangerous because it normalizes storing highly sensitive third-party information by default, increasing the chance of unnecessary retention, misuse, or disclosure of personal data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly directs the agent to write personal contact records, meeting context, and event debrief artifacts to persistent files without requiring any privacy notice, consent check, or data-minimization step. Because this skill is specifically designed to collect relationship history and potentially sensitive personal details about third parties, the lack of an explicit warning or gating increases the risk of over-collection and silent retention of personal data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The file instructs the agent to write date records, update shared indexes, add entries to a suppression list, and remove dates from the index "in the same turn" without any explicit requirement for user confirmation at the point of action. That creates a state-changing workflow around sensitive personal data where an automated or over-eager agent could modify or delete records based on inferred events, stale inputs, or ambiguous conversation context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file explicitly instructs the agent to write personal details into local contact records in the same turn, but it does not require confirming user intent or warning about privacy implications at the moment of storage. Even though the document includes some privacy-limiting guidance, it still operationalizes retention of sensitive relationship, household, and behavioral data, which can lead to over-collection or recording information about third parties without clear user awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The merge workflow explicitly says to delete the losing row and file in the same turn, which is irreversible if the merge proof was wrong or incomplete. In a personal knowledge system containing relationship history, a mistaken deletion can silently destroy provenance and context with no recovery guidance or backup requirement.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The manifest describes a personal address book centered on contacts and contact-related maintenance. This file says imports never land in contacts.md and instead are written to ~/Clawic/data/people/candidates.md, introducing a broader 'people' staging store rather than operating directly within the address book the skill claims to maintain.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The instruction explicitly tells the agent to write contact-derived information into ~/Clawic/data/people/memory.md, which is outside the Contacts store and therefore crosses a data-boundary between skills. That creates unnecessary propagation of personal data into a shared file, increasing the risk of over-collection, unintended disclosure to other skills, and modification of records the user may not expect this skill to touch.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The markdown instructs the agent to update contacts.md, modify a person's file, create that file if needed, and write open loops, all 'in the same turn' without any requirement to notify the user or confirm persistent changes. Because this skill handles sensitive personal relationship data, silent record creation and modification can lead to privacy harm, inaccurate records, and user surprise about where and when personal information is being stored.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · introductions.md (reported line 18)May include surrounding context.

md

3. Make declining costless and unembarrassing: "no is completely fine, and I won't mention it." Then honor that — an unexplained silence back to the requester is the correct outcome of a no.
4. Only after a yes, send the connecting message.

Cost of skipping it: the receiver's time is spent without consent, the requester gets an unenthusiastic response, and the connector is the one who looks careless. The one exception is two friends of equal standing in an obviously symmetric context — a dinner invitation, two people who both asked to meet.

## The Forwardable Blurb

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly instructs the agent to write to several persistent user data files in the same turn, including contact records, memory, dates, artifacts, and a do-not-surface list, without requiring explicit user confirmation at the time of modification. In a skill that handles sensitive life events and third-party personal data, this creates a real risk of silent persistence, over-collection, and unintended alteration of personal records based on inferred or draft-stage information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly authorizes autonomous writes and deletions with 'No permission needed' and permits row/file removal during maintenance operations. In a contacts skill handling sensitive third-party personal data, this can lead to unexpected persistence, modification, or deletion of personal records without sufficiently clear user-facing disclosure in the skill description.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 93% confidence

Finding

The template instructs the agent to persistently restructure session data by creating new files, moving content, and deleting originals as a mandatory procedure. This increases the risk of silent long-term retention and state mutation across sessions, especially because the skill stores relationship, health, legal, financial, and bereavement-related details about third parties.

Content

Scanner excerpt · memory-template.md (reported line 48)May include surrounding context.

md

Everything except the address book, artifacts, the suppression list and the candidate list begins inside `memory.md`. Splitting is a procedure, not a suggestion:

1. Before appending to a section, count its entries.
2. If the append would take it past **~15 entries or ~40 lines of real content** — scaffolding, headings and comments do not count — then, in the same turn: create the new file in `~/Clawic/data/people/`, move the whole section into it, **delete the section from `memory.md`**, add its line to `## Boxes`, and append the new entry to the new file.
3. Keep the headings **and the table columns** identical on both sides of the move, so the split is a copy-paste and never a rewrite. `## Dates` becomes `date-index.md` with the same six columns it already had; `## Open Loops` becomes `open-loops.md`; `## Groups` becomes `groups.md`. A section that would have to be reshaped on the way out was written in the wrong shape on day one.
4. Never leave a copy behind. If the same data ever appears in both places, the extracted file wins and the `memory.md` copy is deleted.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The template states 'Writes in Spanish and English, prefers voice notes to calls,' which encodes language behavior in natural-language instructions. Because the file does not present this as an explicit user choice or opt-in at that point, it can cause the skill to assume a language policy for outputs.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · names.md (reported line 44)May include surrounding context.

md

## Name Orders Across Cultures

Order errors are systematic, not random, which means they repeat forever once encoded wrong. Store the **family name explicitly** rather than trusting position.

- **Hungarian, Japanese, Chinese, Korean, Vietnamese and others** conventionally place the family name first in their own context; many people reorder it in international settings and some do not. Whichever order they used when introducing themselves is the one to store and mirror.
- **Spanish and Portuguese naming** carries two family names (paternal and maternal in Spanish; frequently reversed in Portuguese). The everyday form usually uses the first of them in Spanish and the last in Portuguese — store the full form and the everyday form separately.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file tells the agent to read from ~/Clawic/data/contacts/contacts.md but later to write new tags and memory gaps into ~/Clawic/data/people/.... In a skill managing sensitive personal information, inconsistent storage targets are dangerous because they can cause data to be written into the wrong repository, bypass expected review boundaries, or mix two schemas in ways that expose or lose personal data.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document is a retrieval-focused search workflow, but line 79 instructs the agent to write back to user data and does so under a different namespace (people) than the rest of the skill (contacts). That creates an integrity risk: a simple recall query can unexpectedly mutate files, and the path mismatch increases the chance of writing to the wrong dataset or silently corrupting adjacent personal records.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The instruction to 'write in the same turn' causes user data files to be modified automatically as part of answering a question, without any requirement to notify the user or obtain confirmation. In the context of an address book containing third-party personal details, silent mutation is risky because it can add inaccurate tags, create privacy-sensitive records, and leave the user unaware that persistent data was changed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 62% confidence

Finding

The directive to write every line in a particular form could be read as enforcing a single language/style policy, but the file does not present this as a user-selectable preference. This is a weak signal, but there is no explicit opt-in or alternative for users who may want records maintained in another language or locale.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The manifest limits the skill to maintaining and querying a personal address book. Advising the agent that unreachable contacts are 'a reason to ask the network' goes beyond recording and curating contact facts and implies outreach or information gathering through third parties, which is not part of the declared scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The import section directs ingestion of third-party data from exports, address books, and other tools into candidate records without an explicit privacy warning, consent check, or minimization requirement beyond some source-specific filtering. This can normalize storing personal data about people who did not directly provide it, increasing privacy and compliance risk even if the intent is organizational hygiene.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill explicitly instructs the agent to write to several user data files in the same turn, including contact records, memory logs, and do-not-surface state, without an explicit confirmation or caution about modifying persistent records. In an agent setting, this can cause unintended or premature persistence of sensitive relationship data, especially if the user asked for advice or drafting help rather than record changes.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.