Plan

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 5:43 PM UTC
• Version: 1.0.3

Overview

This is a planning helper that keeps local planning notes and learned preferences, with no evidence of hidden code execution or data exfiltration.

Install only if you are comfortable with local planning records being kept under ~/Clawic/data/plan/. Review or delete that directory if plans may contain sensitive project details, and keep destructive, production, financial, external-send, or other irreversible work in always_validate rather than using auto-execute defaults.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly stores user preferences, active plans, and outcome logs under a persistent directory, but it does not present any privacy warning, retention guidance, or constraints on what data should be written there. Because plans and logs can contain sensitive operational details, credentials-adjacent information, or user behavioral history, silent persistence increases the risk of inadvertent data exposure or over-collection.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The phrase "Anything else / unsure" is an overly broad invocation condition in a markdown skill description. It lacks clear scope boundaries or exclusions, so it could overlap with many ordinary situations and make it unclear when this skill should activate versus when another skill should be used.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- **Promote depth after ONE failure** attributable to plan depth — and name what the deeper level would have caught. If you cannot name it, it was not a planning failure and no promotion happens.
- **Demote depth after 3 consecutive successes** where the extra depth went unused. Observable signal: plan sections never consulted during execution.
- **Auto-execute after 5 consecutive successful validated runs** of a plan type: ask "Should I auto-start [type] plans without validation?" One failure resets the streak and restores validation. The bar is higher than demotion because this removes a human safety net, not just ceremony. Types in `always_validate` never auto-execute.

Per-type state lives in the Current Defaults block of `~/Clawic/data/plan/outcomes.md`:

• Confidence: 85% confidence
• Finding: This is a duplicate detection of the same 'auto-execute' behavior at the same line. The concern is valid because the skill proposes waiving validation after repeated success, which can normalize autonomous action beyond the originally approved scope.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- **Promote depth after ONE failure** attributable to plan depth — and name what the deeper level would have caught. If you cannot name it, it was not a planning failure and no promotion happens.
- **Demote depth after 3 consecutive successes** where the extra depth went unused. Observable signal: plan sections never consulted during execution.
- **Auto-execute after 5 consecutive successful validated runs** of a plan type: ask "Should I auto-start [type] plans without validation?" One failure resets the streak and restores validation. The bar is higher than demotion because this removes a human safety net, not just ceremony. Types in `always_validate` never auto-execute.

Per-type state lives in the Current Defaults block of `~/Clawic/data/plan/outcomes.md`:

• Confidence: 85% confidence
• Finding: This is a duplicate detection of the same 'auto-execute' behavior at the same line. The concern is valid because the skill proposes waiving validation after repeated success, which can normalize autonomous action beyond the originally approved scope.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

Per-type state lives in the Current Defaults block of `~/Clawic/data/plan/outcomes.md`:

```
### Auto-Execute (validation waived by human)
- refactor/small: L2 [streak: 7]

### Validate First

• Confidence: 85% confidence
• Finding: The example 'Auto-Execute (validation waived by human)' shows persistent state that can operationalize approval bypass for future tasks. Even though framed as user-waived validation, encoding this as a reusable default can lead to stale consent and inappropriate execution when task details differ subtly from earlier safe cases.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- migration/data: L4 [always — in always_validate]

### Learning
- api/integration: L2, streak 3/5 toward auto-execute proposal
```

Logging: append a record after every L2+ task; L0/L1 only when they failed (a failed "trivial" task is evidence the type needs promotion). Strategy verdicts need a why — "Parallel → merge conflicts" teaches; "Parallel → didn't work" does not. Record format, last-5 analysis, and review cadence: `outcomes.md`.

• Confidence: 85% confidence
• Finding: Tracking streaks 'toward auto-execute proposal' creates an optimization pressure toward less oversight over time. In security-sensitive contexts, this kind of learned autonomy can degrade defenses by turning historical success into a substitute for current authorization and risk review.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Skim-Approvers

- Repeated instant approvals on L3/L4 plans = validation has become theater. Propose the honest version: "I'll start these without asking and pause only before irreversible steps." Record the change (SKILL.md, Learning Loop); types in `always_validate` keep validation regardless.
- A user who consistently trims your plans is data: bias that user's per-type defaults one level down (`outcomes.md`, Feedback Questions).

## "Just Do It"

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- [concrete change to depth, strategy, or format — or "none"]
```

The "Planned vs actual" section is the payload: deviations feed the replan trigger and next time's plan (`replanning.md`). The Estimate → Actual pair is the calibration data (`estimation.md`, Calibration Loop). A record with empty deviations and no lesson is still worth appending — success streaks are the currency of auto-execute promotion.

## Outcome Analysis

• Confidence: 86% confidence
• Finding: The phrase 'success streaks are the currency of auto-execute promotion' describes a mechanism where the system can reduce oversight and move toward autonomous execution based on prior outcomes. In a planning skill, this can make risky because it encourages the agent to take future actions with less explicit review, potentially including irreversible or externally impactful tasks if the surrounding system relies on these defaults.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The instruction 'Read this on first use to load planning state' is ambiguous because it does not clearly constrain what counts as 'first use' or which workflows should trigger setup. In an agent environment, vague activation conditions can cause the setup behavior to run in unintended contexts, leading to unnecessary file reads, state loading, or cross-task interference.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

Write to config or the defaults block **only** when the user states a preference in the course of the work — never as a preflight questionnaire.

- User names a threshold, artifact preference, or a type that must always be validated → update the matching key in `config.yaml`.
- User waives validation, trims plans, or asks for deeper plans on a type → adjust that type's line in the Current Defaults block of `outcomes.md` (Learning Loop rules in `SKILL.md` still gate auto-execute).
- User corrects your depth choice → record which signal you misread, adjust the type default.

If the user has said nothing, store nothing.

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

Write to config or the defaults block **only** when the user states a preference in the course of the work — never as a preflight questionnaire.

- User names a threshold, artifact preference, or a type that must always be validated → update the matching key in `config.yaml`.
- User waives validation, trims plans, or asks for deeper plans on a type → adjust that type's line in the Current Defaults block of `outcomes.md` (Learning Loop rules in `SKILL.md` still gate auto-execute).
- User corrects your depth choice → record which signal you misread, adjust the type default.

If the user has said nothing, store nothing.

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

Write to config or the defaults block **only** when the user states a preference in the course of the work — never as a preflight questionnaire.

- User names a threshold, artifact preference, or a type that must always be validated → update the matching key in `config.yaml`.
- User waives validation, trims plans, or asks for deeper plans on a type → adjust that type's line in the Current Defaults block of `outcomes.md` (Learning Loop rules in `SKILL.md` still gate auto-execute).
- User corrects your depth choice → record which signal you misread, adjust the type default.

If the user has said nothing, store nothing.

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: The skill explicitly instructs the agent to append outcome records to a persistent user-local file, but the description does not include any requirement to disclose that retention to the user or obtain consent. Even though the file is local, the records can contain task descriptions, estimates, failures, and workflow details that may reveal sensitive project or behavioral information over time.

Static analysis

No suspicious patterns detected.