Rust

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:02 PM UTC
• Version: 1.0.3

Overview

This Rust skill is coherent and not malicious, but it uses a disclosed local memory/preferences folder that users should be aware of.

Before installing, review whether you are comfortable with the skill reading and updating ~/Clawic/data/rust/config.yaml and memory.md for Rust-specific preferences and project context. Periodically inspect or clear those files if you do not want cross-session personalization.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

• Location: setup.md:10

Finding

Persistent Cross-Session User Profiling and State Influence

Content

View full analysis

Vulnerability Details

File Location: setup.md:10-30 (related references: SKILL.md:32, memory-template.md:1-32)
Vulnerability Type: Persistent agent-memory modification
Risk Level: Medium

Vulnerable Code

markdown

## How To Load Preferences

1. Read `~/Clawic/data/rust/config.yaml` if it exists. Apply its values.
2. For anything absent, use the defaults in the Configuration table of `SKILL.md` — do not ask.
   - `edition: 2024`, `msrv: none`, `async_runtime: tokio`, `error_style: auto`, `unsafe_policy: reviewed`, `lint_level: default`, `explanation_depth: standard`.
3. Read `~/Clawic/data/rust/memory.md` for prior context (their crates, stack, recurring pain points). Absence is fine; proceed without comment.

Work from defaults immediately. Never open with questions about their toolchain, their runtime, or how much detail they want.

## Recording Preferences (only when the user declares one)

Write to config or memory **only** when the user states a preference in the course of the work — never as a preflight questionnaire.

- User names an edition, MSRV floor, async runtime, error crate, unsafe policy, lint strictness, or how much explanation they want → update the matching key in `~/Clawic/data/rust/config.yaml`.
- User expresses a habit or stance (nextest over cargo test, module layout, a private registry or vendored sources, when clippy runs, appetite for new dependencies, target platform, how proactively to flag panics) → record it under the relevant preference area (tooling, conventions, platform, dependencies, registries and sources, work order and gates, output format, safety posture, cadence) in `~/Clawic/data/rust/memory.md`.
- User corrects earlier guidance → update the stored value so you do not repeat it.

If the user has said nothing, store nothing.

## What Memory Holds

Memory holds what you observed, never what the user declared — declared values live in `config.yaml`. Track the cr
...[truncated 3019 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit, informed confirmation before every persistent write and show the exact values and destination file.
2. Persist only preferences directly declared by the user; do not infer or record behavioral observations such as which explanations they read or skip.
3. Treat loaded memory as untrusted hints. Revalidate security-sensitive values, including unsafe-code policy, private registries, dependency sources, and command-execution preferences.
4. Use a strict schema and allowlist for persisted keys. Reject free-form instructions, command fragments, URLs, and content that attempts to alter agent policy.
5. Separate project-local context from global user preferences so one repository or conversation cannot silently influence unrelated work.
6. Provide commands or controls to inspect, edit, expire, and delete all persisted state.
7. Apply retention limits and avoid storing project identifiers, private registry details, or other potentially sensitive context unless specifically requested.
8. Record provenance and timestamps for each value, and prompt for reconfirmation when stored information is stale or conflicts with the current request.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

md

rules, raw pointers, safety comments · `ffi.md` C interop in both directions · `macros.md` `macro_rules!` and proc macros · `api-design.md` public APIs and semv

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · api-design.md (reported line 76)May include surrounding context.

md

- Errors are one enum per boundary, `#[non_exhaustive]`, with `source()` chains
- Traits intended for downstream impls have default bodies; the rest are sealed
- Feature flags are additive, documented, and tested in combination (`cargo hack`)
- `#![deny(missing_docs)]`, doc examples compile, `cargo doc` has no warnings
- MSRV declared in `rust-version` and verified by a CI job
- `cargo semver-checks` and `cargo publish --dry-run` both clean
- README examples are the doc examples (`#![doc = include_str!("../README.md")]`)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · memory-template.md (reported line 13)May include surrounding context.

md

last: YYYY-MM-DD

## Context
<!-- Their crates and what kind: library, binary, service, firmware, wasm -->
<!-- Toolchain, target platforms, async runtime, CI setup -->

## Pain Points

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · serde.md (reported line 29)May include surrounding context.

md

| Adjacently tagged (`tag`, `content`) | `{"t":"Text","c":{"body":"hi"}}` | When variants hold non-struct payloads |
| Untagged | `{"body":"hi"}` | Last resort: unreadable errors, ambiguous matches |

Untagged is the one that costs you later. A number that fits both `u64` and `f64`, or two variants with overlapping fields, resolves by declaration order with no warning. If you must use it, order variants most-specific first and add a round-trip property test.

## Numbers, Dates, and Precision

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs the agent to read and write user-local files under ~/Clawic/data/rust for preferences and memory, but it provides no user-facing notice, consent flow, or storage boundary. This creates a privacy and data-governance risk because user context and preferences may be accessed or persisted across sessions without transparent authorization.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The setup directs the agent to persist both user-declared preferences and observed context into local memory files across sessions, which can accumulate sensitive behavioral or project information over time. Even if intended for convenience, silent cross-session storage increases the risk of unintended retention, privacy leakage, and misuse of stale or overbroad context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.