Security audit

Contacts

Security checks across malware telemetry and agentic risk

Overview

This is a local contacts-memory skill that clearly discloses persistent address-book writes and does not show exfiltration, hidden execution, or credential handling.

Install only if you want the agent to maintain local contact notes directly. It will write and update personal relationship data under ~/Clawic/data/people/ and ~/Clawic/data/contacts/ as conversations reveal durable facts, so review those files periodically and avoid using it for secrets or details you would not want stored locally.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The skill explicitly instructs writing contact-derived meeting commitments into `~/Clawic/data/people/memory.md`, which is outside the stated contacts address-book scope and creates cross-store propagation of personal data. That broadens retention and access surface for sensitive interpersonal information, increasing the chance of overcollection, misclassification, or later unintended reuse in a different memory context.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The search guidance includes side effects during a recall workflow: it instructs the agent to write tags/fields to a person's record and update review memory/config files in the same turn. This is dangerous because a user asking a read-only question can trigger silent modification of personal data and broader memory state, increasing the chance of unwanted persistence, data corruption, or privacy-impacting record changes.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The workflow directs updates not only to contact records but also to shared configuration and cross-skill memory files such as conventions.tags and memory.md. That expands the blast radius of a simple search query into persistent schema and memory changes outside the immediate task, which can poison future behavior, create inconsistent taxonomy, and store sensitive inferences beyond what the user requested.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The file directs automatic post-meeting writes of personal facts, commitments, and contact history to persistent records in the same turn, without any guardrail for consent, confirmation, or sensitivity filtering. In a contacts skill, this is especially risky because the data includes third-party personal details, potentially sensitive life events, and inferred relationship context that may be stored permanently even when it should not be recorded.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill explicitly instructs the agent to write personal contact details into local files during the same turn, but it does not require a user-facing confirmation or warning before modifying persistent personal records. In a contacts skill, silent persistence of personal and potentially sensitive third-party information increases privacy and consent risk, especially when users may not realize the conversation is being converted into durable records.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The deletion guidance authorizes irreversible removal of contact data, related files, dates, loops, and group entries without requiring an explicit confirmation or warning at execution time. In a memory-management skill handling personal data, accidental or misinterpreted commands could cause permanent loss of records and privacy-relevant audit gaps, especially since the note retained in Roster Shape is anonymous and insufficient for recovery.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The instruction explicitly tells the agent to write in the same turn to several persistent personal-data files, including memory, interaction logs, and detail records, without any requirement to notify the user or obtain confirmation first. In a contacts skill handling sensitive relationship data, silent multi-file writes increase the risk of unwanted persistence, over-collection, and accidental recording of socially sensitive facts.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill explicitly instructs the agent to write to multiple user data files in the same turn, including updating contact records, memory logs, and suppression lists, without any visible requirement to confirm with the user before modifying persistent records. This creates a real risk of unauthorized or surprising state changes, especially because the skill is framed as a recurring sweep and could cause batch edits to sensitive personal data based on inferred workflow rather than explicit consent.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The instruction block directs the agent to persist highly sensitive life-event data and relationship changes across multiple personal data files in the same turn, including bereavement, divorce, illness-adjacent handling notes, and recurring dates, without requiring an explicit confirmation step or a user-facing warning that permanent writes will occur. In a contacts skill, storing some relationship context is expected, but this specific guidance increases the risk of over-collection, incorrect persistence, and privacy harm because it operationalizes sensitive updates by default and fans them out to several files.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill explicitly instructs the agent to write and rename files in persistent contact storage and to update multiple linked records in the same turn, but it does not require explicit user confirmation before modifying stored personal data. In a contacts skill, this is risky because routine conversational input could trigger unintended edits, renames, or propagation of sensitive identity changes across files.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The instruction explicitly tells the agent to write sensitive relationship data, favors, asks, and group-mapping information into a fixed local file path without any user consent, visibility, or data-minimization guidance. In a contacts skill, this context makes the issue more serious because the stored content can include private interpersonal history and inferred social graphs, which are sensitive even if not traditionally classified as credentials or secrets.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The instruction to 'write in the same turn' causes immediate modification of user data files without warning or consent, even when the user's request is framed as a question. In a contacts skill handling sensitive personal information, silent writes are especially risky because they may persist incorrect facts, generate new sensitive labels, or create audit and privacy issues the user did not intend.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.