ClawHub
Back to skill

Security audit

RAG

Security checks across malware telemetry and agentic risk

Overview

This RAG skill stores local operational notes and logs for pipeline work, but the behavior is disclosed, scoped, and aligned with its purpose.

Before installing, be comfortable with the skill keeping local RAG notes under ~/Clawic/data/, including corpus inventories, query/eval diagnostics, cost records, and shared infrastructure rows. Do not use verbose logging with sensitive production queries unless access controls, retention, and erasure handling are in place.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Context-Inappropriate Capability

Low
Confidence
90% confidence
Finding
The skill instructs the agent to write persistent records under a user-home path (`~/Clawic/data/rag/memory.md` and `artifacts/ingest-<source>.md`) that are outside the immediate ingestion task. Persistent memory writes can create unintended data retention, leak source metadata, and let untrusted document-derived content influence future runs through a local state channel. In this RAG context, the risk is elevated slightly because ingestion routinely handles sensitive corpus details such as owners, access fields, refresh cadence, and parser decisions.

Missing User Warnings

Low
Confidence
86% confidence
Finding
The skill explicitly instructs writing files to fixed paths under the user's home directory without an accompanying safety warning or confirmation step. In an agent setting, this can cause unintended local file modification, overwrite existing evaluation artifacts, or create persistence side effects even if the content itself is operationally legitimate.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The guidance explicitly recommends logging raw query text and active filters, which can capture personal data, sensitive business terms, and security-relevant access constraints. In a RAG system, queries often contain user-supplied secrets, identifiers, or regulated data, so retaining them without minimization, redaction, or retention controls creates a real privacy and data-exposure risk.

Session Persistence

Medium
Category
Rogue Agent
Content
Everything except golden sets, eval logs, artifacts and the shared boxes begins inside `memory.md`. Splitting is a procedure, not a suggestion:

1. Before appending to a section, count its entries.
2. If the append would take it past **~15 entries or ~40 lines of real content** — scaffolding, headings and comments do not count — then, in the same turn: create the new file in `~/Clawic/data/rag/`, move the whole section into it, **delete the section from `memory.md`**, add its line to `## Boxes`, and append the new entry to the new file.
3. Keep the headings identical on both sides of the move, so the split is a copy-paste and never a rewrite.
4. Never leave a copy behind. If the same data ever appears in both places, the extracted file wins and the `memory.md` copy is deleted.
Confidence
76% confidence
Finding
The template instructs persistent storage of operational memory, corpus metadata, evaluation history, project data, and shared infrastructure records across sessions. Even though it warns against storing raw secrets and confidential chunk text, this still creates durable retention of potentially sensitive business metadata, identifiers, tenant information, and user-provided operational context that could outlive the original task or be reused inappropriately.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.prompt_injection_instructions

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
memory-template.md:58

Prompt-injection style instruction pattern detected.

Warn
Code
suspicious.prompt_injection_instructions
Location
generation.md:20