Security audit

Recipes

Security checks across malware telemetry and agentic risk

Overview

This recipe-management skill is broadly coherent and disclosed, with local persistence and shared allergy/contact notes that are sensitive but purpose-aligned.

Install only if you want a recipe assistant that keeps a durable local recipe collection and may also use local allergy, intolerance, guest dietary, and cookbook/catering project notes. Review the Clawic data folders periodically if you do not want those facts retained long term.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (17)

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The template explicitly authorizes the Recipes skill to read and write `~/Clawic/data/health/profile.md`, which contains sensitive medical data such as allergies, intolerances, and conditions. Even if intended for dietary safety, this is cross-domain access to high-sensitivity information and expands the skill’s authority beyond a recipe collection, increasing privacy and misuse risk if the skill is compromised or over-collects data.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: The template allows the Recipes skill to update shared contacts records outside its own storage area, including personal context about named individuals. This is unnecessary expansion of write scope into another shared dataset and can lead to unauthorized modification, privacy leakage, or corruption of contact records used by other skills.

Context-Inappropriate Capability

Medium

Confidence: 78% confidence
Finding: The template authorizes creating and updating shared project files in `~/Clawic/data/projects/`, which broadens the Recipes skill into a general project-management writer. Cross-skill write access raises integrity risks because the skill can alter status, milestones, and decisions in files that may be consumed by unrelated workflows.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill instructs the agent to read and update `~/Clawic/data/contacts/contacts.md` with guests' restrictions during recipe planning, which extends beyond recipe collection management into unrelated personal contacts data. This creates unnecessary cross-domain access and persistence of personal information without an explicit need-to-know boundary or user confirmation, increasing privacy risk and the chance of unauthorized modification of contact records.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: This instruction directs the skill to access sensitive health data from a profile file even though a recipe-substitution task can usually be completed by asking the user for current dietary constraints in-session. Pulling from health records expands data access beyond the minimum necessary and creates unnecessary privacy exposure if the skill is triggered in the wrong context or by ambiguous user input.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: Storing guest dietary restrictions in a contacts database is unrelated data persistence for a recipe operation and increases collection of personal/sensitive information. This creates a risk of over-retention, secondary use, and leakage of health-adjacent data about third parties who may not have consented to long-term storage.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill explicitly instructs the agent to write a recipe file and update an index in the same turn, but it does not require an explicit confirmation step immediately before modifying local files. Because the skill accepts content from URLs, photos, and batch inputs, this creates a real risk of unintended or over-broad local data modification if the user did not clearly understand that persistence would occur.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to write durable facts into a persistent user memory file (`~/Clawic/data/recipe/memory.md`) without any requirement for user confirmation, visibility, or caution about modifying long-lived data. This creates a state-manipulation risk: content derived from recipes, URLs, OCR, or other untrusted inputs could be stored permanently and later influence future behavior or conversions in ways the user did not intend.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill explicitly instructs the agent to persist data into a local user memory file after a costing pass, but it does not require clear user consent or a warning that local data will be modified. In an agent setting, automatic writes to persistent storage can create unintended side effects, overwrite trusted notes, or accumulate incorrect data from unverified receipts or scraped sources.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The file explicitly instructs the agent to write durable changes into persistent user files (`## Variations` in a recipe and `~/Clawic/data/recipe/memory.md`, plus `config.yaml`) without requiring confirmation at the point of modification. Even though this is framed as normal recipe-management behavior, silent persistence can cause unwanted state changes, corruption of user data, or privacy surprises if the agent records incorrect or sensitive information.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The instructions tell the agent to write updates to multiple user files (`plans/<year>.md`, `artifacts/menu-<name>.md`, and `contacts.md`) automatically when a plan is made or a week ends, but do not require any user-facing warning, preview, or confirmation. Silent persistence across several files can lead to unintended data modification, privacy issues, and corruption of personal records if the agent misinterprets the user's request or writes inaccurate information.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill instructs storing a relative's identity and contextual information in a contacts file, but it does not include an explicit privacy warning, consent requirement, retention limit, or guidance on handling personal data. Because family recipe preservation often involves living individuals and sensitive family context, this can lead to collection and persistence of personally identifiable information without adequate safeguards.

Missing User Warnings

Low

Confidence: 90% confidence
Finding: The skill explicitly instructs the agent to write scaled results into recipe files, which is a persistent state change. Without an explicit confirmation step, preview, or indication that user data will be modified, the agent could alter stored recipes unexpectedly or incorrectly, especially if the scaling result is wrong or misunderstood.

Missing User Warnings

Low

Confidence: 93% confidence
Finding: This instruction tells the agent to update persistent kitchen memory when a capacity ceiling is encountered. Even though the content is recipe-related and low-risk, modifying shared or durable memory without a clear consent boundary can cause unintended state changes, stale constraints, or cross-session contamination of the user's collection.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The file instructs use of sensitive health-profile data without any user-facing notice, consent flow, or clear privacy boundary. Even if the goal is safety around allergens, silently consulting health records can surprise users and mishandle special-category personal data.

Missing User Warnings

High

Confidence: 98% confidence
Finding: This instruction tells the skill to persist newly stated allergy, intolerance, condition, or guest restriction data into profile/contact files without warning about retention or seeking explicit permission. Persisting health-related information from conversational input is particularly dangerous because it converts transient remarks into durable records that may later be reused, exposed, or inferred out of context.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The skill explicitly instructs persistence of health restrictions derived from user input into profile files, which is sensitive-data collection beyond what is required to answer the immediate recipe question. This increases the blast radius of any later compromise and raises consent, minimization, and retention concerns.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: memory-template.md:65