SaaS

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:02 PM UTC
• Version: 1.0.2

Overview

This skill is a SaaS business-advice and recordkeeping skill that uses clearly scoped local notes and does not show hidden execution, exfiltration, or live account changes.

Install only if you want the agent to keep local SaaS operating memory under ~/Clawic/data/. Review those files periodically because they can contain confidential business data such as account names, ARR, renewal dates, churn reasons, and commercial commitments; do not paste secrets or full customer exports for storage.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 184)May include surrounding context.

md

| Lifetime deals or perpetual discounts for early cash | Both convert recurring revenue into a permanent liability with no renewal event; they also poison the ARR line in any future diligence | Annual prepay with a discount inside `annual_discount_pct` |
| Feature-count tiers | Customers buy the cheapest tier containing the one feature they need, and expansion never happens | Fence on the value metric so growth moves them up by itself (`packaging.md`) |
| SSO priced only into the top enterprise tier | Punished publicly, and it delays the control that most reduces your breach surface | SSO from the first business tier (`enterprise.md`) |
| Hard limit with no warning and no upgrade path | The wall arrives mid-workflow and reads as an outage, so the ticket is a cancellation | Soft limit → notice → grace → hard stop, with the upgrade one click from the wall (`entitlements.md`) |
| Unlimited plans with real marginal cost | One customer at 100× the median consumes the margin of the whole tier — with per-request AI cost, of several tiers | Fair-use ceiling stated at purchase, plus overage (`metering.md`, `margins.md`) |
| Building enterprise features before an enterprise buyer exists | SOC 2, SCIM and residency are quarters of work with no revenue attached until someone asks | Sell the rung you are on, and start the audit clock when the first 100k pipeline is real (`enterprise.md`) |
| Discounting to close, with no ceiling | Trains the market to wait for quarter end and permanently lowers realized ARPA | `discount_ceiling_pct` with an approval path; trade discount for term length or a case study |

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · entitlements.md (reported line 29)May include surrounding context.

md

## Soft, Then Hard

A limit that arrives without warning reads as an outage, and the ticket that follows is a cancellation. The ladder, with the thresholds worth defaulting to:

| Stage | Trigger | Behaviour |
|---|---|---|

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The markdown instructs that accounts move from full access to suspension and then deletion per policy, but it does not include an explicit warning that these actions affect customer access and may permanently remove data. For a skill description, this is a user-impacting behavior that should be clearly disclosed as a caution before operators apply it.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file includes an invocation condition, 'Read this file only when WRITING,' but does not define what counts as 'WRITING' versus other related actions like planning, reviewing, or editing memory-adjacent files. That ambiguity could cause unintended or inconsistent skill activation because the boundary for use is not clearly specified.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 92% confidence

Finding

This skill explicitly instructs the agent to persist user and customer business data across sessions in memory files and split-out files, including revenue history, accounts, commitments, churn reasons, and contacts. Even though it warns against secrets and some personal data, it still creates durable cross-session storage of potentially sensitive business information, increasing the blast radius of prompt injection, unauthorized later reuse, or privacy violations if the memory store is accessed in unrelated contexts.

Content

Scanner excerpt · memory-template.md (reported line 53)May include surrounding context.

md

Everything except artifacts, incident logs, the answer bank and the shared boxes begins inside `memory.md`. Splitting is a procedure, not a suggestion:

1. Before appending to a section, count its entries.
2. If the append would take it past **~15 entries or ~40 lines of real content** — scaffolding, headings and comments do not count — then, in the same turn: create the new file in `~/Clawic/data/saas/`, move the whole section into it, **delete the section from `memory.md`**, add its line to `## Boxes`, and append the new entry to the new file.
3. Keep the headings identical on both sides of the move, so the split is a copy-paste and never a rewrite. A `###` inside `memory.md` becomes a `##` in the extracted file and keeps its exact wording.
4. Never leave a copy behind. If the same data ever appears in both places, the extracted file wins and the `memory.md` copy is deleted.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs the agent to persist customer account details, churn reasons, concessions, ARR, plan, and renewal dates into long-term memory without any warning, consent check, data-minimization rule, or sensitivity filter. In a SaaS context this can capture confidential commercial data and potentially personal data tied to contacts or accounts, increasing privacy, retention, and unauthorized-disclosure risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly instructs the agent to persist computed revenue rows and definition changes into local memory files, which is a state-changing action. Without an explicit user confirmation or a clear warning that data will be modified, the agent could silently alter business records, creating integrity issues, audit confusion, or poisoning future outputs that depend on those files.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · sales-motion.md (reported line 52)May include surrounding context.

md

## Discount Discipline

- **Ceiling first**: `discount_ceiling_pct` is what any rep may offer without approval, and one named person approves anything beyond it. A ceiling that everyone routinely exceeds is not a ceiling, it is a lower price list.
- **Trade, never give.** Longer term, annual prepay, a case study, a reference call, a shorter payment window, a broader initial deployment. A concession given for nothing sets the price of every renewal (`renewals.md`).
- **Measure realized ARPA against list monthly.** Discount drift is invisible deal by deal and obvious in the aggregate; a widening gap while list price holds is a price cut nobody decided (SKILL.md, Where Revenue Leaks).
- **Never discount to fix a value problem.** A buyer who does not believe the value will churn at the discounted price too, having cost the same to acquire.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · trials.md (reported line 13)May include surrounding context.

md

- 14 days is the default because most B2B tools reach value inside a week and a fortnight covers two working weeks. It is a default, not a finding.
- Extending a trial that is not converting rarely helps: trial usage concentrates in the first sessions, and an account that has done nothing by the midpoint almost never starts. Lengthening the window mostly lengthens the time to a `no`.
- **Extension on request converts well** and costs nothing — an account that asks for more time is engaged. Grant it once, automatically, with no justification asked and no approval step; only if extension-on-request becomes standing policy is there anything to write down, and then it is a trial rule and belongs in `## Plans`.
- Usage-based trials (a credit allowance rather than a clock) fit products with irregular cadence, and remove the "I was busy that week" objection. They need a spend ceiling and an expiry anyway, or they become a free tier by accident.

## Card Up Front: The Real Tradeoff

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

Line L80 directs the operator to write updated plan, seat, ARR, and churn-reason data into persistent files, which affects business records. The document provides no explicit warning about validating changes, avoiding accidental overwrites, or handling sensitive customer data carefully.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

Line L59 specifies that invoice line items should be presented in the customer's language, but it does not indicate how that language is chosen or whether the customer can opt in or select a locale. Under the policy, forcing a language or locale without explicit choice can be a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.