T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
memory-template.md:270- Finding
Automatic Cross-Skill Persistence of Personal and Commercial Data Without Consent
- Content
View full analysis
.md`. Pricing rows reference them by name only — duplicating the person or the project is the most common way two skills start contradicting each other. Both formats, with their identity keys and scale cuts, travel inside `memory-template.md`. ``` `memory-template.md:20`: ```markdown | Customers, prospects, and interviewees named anywhere above | `~/Clawic/data/contacts/contacts.md` (**shared**) | One row per person, every skill writing into one file | ``` `memory-template.md:29`: ```markdown No permission needed; every write is announced in one line that names the file. Writes and deletions stay inside the paths declared in this skill's `configPaths`. A deletion is named in that same line, and in a shared box only rows this skill itself wrote are ever updated or removed. ``` `memory-template.md:270-283`: ```markdown Lives at `~/Clawic/data/contacts/contacts.md` and is shared with every other skill that knows people — the user may have none of them installed, so the format travels with this skill. ```markdown # Contacts | Name | Key | Role | Preferred channel | Context | Last contact | File | |------|-----|------|-------------------|---------|--------------|------| | Ana Ruiz | ana.ruiz@northwind.example | procurement lead, Northwind | email | 24-month deal at 20% off, prepaid | 2026-06-20 | — | ``` - **Identity is the `Key` column**: lowercase email, else the handle, else `` pl ...[truncated 3394 chars]- Remediation
View remediation