ClawHub
Back to skill

Security audit

Spain

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a Spain travel-planning guide, but it under-discloses local file access and may move old preference files despite claiming it stays within one data folder.

Review this skill before installing if you care about local preference privacy. It is not trying to book, pay, execute code, or send data over the network, but it can persist travel preferences and should not move legacy files or read a shared profile without clear user confirmation.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Note
Location
SKILL.md:28
Finding

File Access and Migration Exceed the Declared Storage Boundary

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:28-32, SKILL.md:50, and SKILL.md:185-187
Vulnerability Type: Undeclared access to files outside the stated least-privilege boundary
Risk Level: Low

Vulnerable Code

markdown
User preferences and memory live in `~/Clawic/data/spain/` (see `setup.md` on first use, `memory-template.md` for the file format). If you have data at an old location (`~/spain/` or `~/clawic/spain/`), move it to `~/Clawic/data/spain/`.

## Configuration

User-dependent variables. Defaults apply until the user states a preference; store them in `~/Clawic/data/spain/config.yaml`. Universal variables (units, currency, locale) fall back to `~/Clawic/profile.yaml` when not set here, then to the table default.
markdown
- **units / locale** — temperature scale (°C vs °F) and home currency for € conversions — affects how temperatures and prices are quoted; falls back to `~/Clawic/profile.yaml`, then °C and € shown as-is
markdown
## Security & Privacy

**Data that stays local:** Trip preferences in ~/Clawic/data/spain/

**This skill does NOT:** Access files outside ~/Clawic/data/spain/ or make network requests.

Technical Analysis

The skill explicitly claims that it does not access files outside ~/Clawic/data/spain/, but other instructions require or encourage three operations beyond that boundary:

  1. Reading ~/Clawic/profile.yaml to obtain units, currency, and locale.
  2. Inspecting legacy locations at ~/spain/ and ~/clawic/spain/.
  3. Moving data from those legacy locations into the current skill directory.

Reading the shared profile and accessing legacy directories therefore violate the documented least-privilege boundary. The migration instruction is particularly significant because moving a directory changes the user's filesystem state and can remove data from its original location. No explicit confirmation, backup, collision handling, p ...[truncated 1715 chars]

Remediation
View remediation

Remediation Suggestions

  1. Update the security statement to list every path the skill may access, including ~/Clawic/profile.yaml, ~/spain/, and ~/clawic/spain/.
  2. Request explicit user confirmation before inspecting or migrating either legacy directory.
  3. Use a copy-and-verify migration rather than an immediate move:
    • Validate that the source is the expected directory and not an unsafe symbolic link.
    • Check whether the destination already exists.
    • Refuse silent overwrites or merges.
    • Copy the data and verify its integrity.
    • Preserve the source until the user confirms successful migration.
    • Provide a rollback procedure.
  4. Read only the required profile keys—units, currency, and locale—instead of exposing the entire profile to the skill context.
  5. If strict directory confinement is intended, remove the profile fallback and legacy migration instructions entirely.
  6. Keep the documented privacy boundary synchronized with configuration metadata and actual runtime instructions.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (10)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md
| Customs, eating times, festivals, phrases | `culture.md` |

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · memory-template.md (reported line 14)May include surrounding context.

md
regions: 

## Style
<!-- foodie, beach, culture, adventure, mix -->

## Group
<!-- solo, couple, family, friends -->

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · san-sebastian.md (reported line 138)May include surrounding context.

md
2. **Thursday night** — locals do the crawl
3. **Payment:** Many bars are cash only
4. **Basque:** "Kaixo" (hi), "Eskerrik asko" (thanks)
5. **Umbrella always** — it rains without warning

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill explicitly instructs the agent to read and later write persistent local files containing user preferences and trip context, but it provides no requirement to notify the user, obtain consent, or clarify retention behavior. This creates a privacy and transparency risk because personal travel data, dietary needs, dates, and group details may be silently stored across sessions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The heading explicitly scopes the content to Spain, which imposes a locale-specific focus without any indication that the user can choose another country or region. Under the stated policy, language/locale constraints should be optional or clearly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

Line L142 says '"Sin jamón" must be said explicitly,' which directs the user to use a specific language form rather than presenting it as an optional aid. Under the policy, forcing a specific language without user opt-in can be a locale/language policy issue, even in an informational guide.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

This hiking guide is entirely written in English while being about Spain, and it does not provide any user choice of language or note that English is required for a specific audience. Under the policy rule, forcing a specific language without opt-in can be a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

SQP-3 applies to all file types and covers language or locale policy violations in natural language. The phrasing on this line prescribes language interaction behavior without offering user choice or clarifying that this is descriptive travel guidance, which can be read as forcing a specific language norm.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The setup defines the skill as 'Setup — Spain' and instructs the assistant to act as someone who 'knows Spain well,' shaping responses toward a fixed locale/context. Because no opt-in or explicit justification is given in this file, this is a natural-language locale constraint that may conflict with organizational language/locale choice policies.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The phrase "Know a Sevillano who invites you" assumes a specific local identity/language context and presents it as the default requirement without explanation or inclusive wording. Under the policy, locale-specific language should be justified or optional rather than imposed in natural-language guidance.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.