Spain

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:40 AM UTC
• Version: 1.0.3

Overview

This is mostly a Spain travel-planning guide, but it under-discloses local file access and may move old preference files despite claiming it stays within one data folder.

Review this skill before installing if you care about local preference privacy. It is not trying to book, pay, execute code, or send data over the network, but it can persist travel preferences and should not move legacy files or read a shared profile without clear user confirmation.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: SKILL.md:28
• Finding: File Access and Migration Exceed the Declared Storage Boundary## Vulnerability Details **File Location**: `SKILL.md:28-32`, `SKILL.md:50`, and `SKILL.md:185-187` **Vulnerability Type**: Undeclared access to files outside the stated least-privilege boundary **Risk Level**: Low ### Vulnerable Code ```markdown User preferences and memory live in `~/Clawic/data/spain/` (see `setup.md` on first use, `memory-template.md` for the file format). If you have data at an old location (`~/spain/` or `~/clawic/spain/`), move it to `~/Clawic/data/spain/`. ## Configuration User-dependent variables. Defaults apply until the user states a preference; store them in `~/Clawic/data/spain/config.yaml`. Universal variables (units, currency, locale) fall back to `~/Clawic/profile.yaml` when not set here, then to the table default. ``` ```markdown - **units / locale** — temperature scale (°C vs °F) and home currency for € conversions — affects how temperatures and prices are quoted; falls back to `~/Clawic/profile.yaml`, then °C and € shown as-is ``` ```markdown ## Security & Privacy **Data that stays local:** Trip preferences in ~/Clawic/data/spain/ **This skill does NOT:** Access files outside ~/Clawic/data/spain/ or make network requests. ``` ### Technical Analysis The skill explicitly claims that it does not access files outside `~/Clawic/data/spain/`, but other instructions require or encourage three operations beyond that boundary: 1. Reading `~/Clawic/profile.yaml` to obtain units, currency, and locale. 2. Inspecting legacy locations at `~/spain/` and `~/clawic/spain/`. 3. Moving data from those legacy locations into the current skill directory. Reading the shared profile and accessing legacy directories therefore violate the documented least-privilege boundary. The migration instruction is particularly significant because moving a directory changes the user's filesystem state and can remove data from its original location. No explicit confirmation, backup, collision handling, p ...[truncated 1715 chars]
• Remediation: ## Remediation Suggestions 1. Update the security statement to list every path the skill may access, including `~/Clawic/profile.yaml`, `~/spain/`, and `~/clawic/spain/`. 2. Request explicit user confirmation before inspecting or migrating either legacy directory. 3. Use a copy-and-verify migration rather than an immediate move: - Validate that the source is the expected directory and not an unsafe symbolic link. - Check whether the destination already exists. - Refuse silent overwrites or merges. - Copy the data and verify its integrity. - Preserve the source until the user confirms successful migration. - Provide a rollback procedure. 4. Read only the required profile keys—units, currency, and locale—instead of exposing the entire profile to the skill context. 5. If strict directory confinement is intended, remove the profile fallback and legacy migration instructions entirely. 6. Keep the documented privacy boundary synchronized with configuration metadata and actual runtime instructions.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (10)

Ae1

High

• Category: analysis-evasion

Content

| Customs, eating times, festivals, phrases | `culture.md` |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Hidden Instructions

High

• Category: Prompt Injection

Content

regions: 

## Style
<!-- foodie, beach, culture, adventure, mix -->

## Group
<!-- solo, couple, family, friends -->

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

2. **Thursday night** — locals do the crawl
3. **Payment:** Many bars are cash only
4. **Basque:** "Kaixo" (hi), "Eskerrik asko" (thanks)
5. **Umbrella always** — it rains without warning

• Confidence: 80% confidence
• Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly instructs the agent to read and later write persistent local files containing user preferences and trip context, but it provides no requirement to notify the user, obtain consent, or clarify retention behavior. This creates a privacy and transparency risk because personal travel data, dietary needs, dates, and group details may be silently stored across sessions.

Natural-Language Policy Violations

Low

• Confidence: 80% confidence
• Finding: The heading explicitly scopes the content to Spain, which imposes a locale-specific focus without any indication that the user can choose another country or region. Under the stated policy, language/locale constraints should be optional or clearly justified.

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: Line L142 says '"Sin jamón" must be said explicitly,' which directs the user to use a specific language form rather than presenting it as an optional aid. Under the policy, forcing a specific language without user opt-in can be a locale/language policy issue, even in an informational guide.

Natural-Language Policy Violations

Low

• Confidence: 83% confidence
• Finding: This hiking guide is entirely written in English while being about Spain, and it does not provide any user choice of language or note that English is required for a specific audience. Under the policy rule, forcing a specific language without opt-in can be a natural-language policy concern.

Natural-Language Policy Violations

Low

• Confidence: 77% confidence
• Finding: SQP-3 applies to all file types and covers language or locale policy violations in natural language. The phrasing on this line prescribes language interaction behavior without offering user choice or clarifying that this is descriptive travel guidance, which can be read as forcing a specific language norm.

Natural-Language Policy Violations

Low

• Confidence: 83% confidence
• Finding: The setup defines the skill as 'Setup — Spain' and instructs the assistant to act as someone who 'knows Spain well,' shaping responses toward a fixed locale/context. Because no opt-in or explicit justification is given in this file, this is a natural-language locale constraint that may conflict with organizational language/locale choice policies.

Natural-Language Policy Violations

Low

• Confidence: 81% confidence
• Finding: The phrase "Know a Sevillano who invites you" assumes a specific local identity/language context and presents it as the default requirement without explanation or inclusive wording. Under the policy, locale-specific language should be justified or optional rather than imposed in natural-language guidance.

Static analysis

No suspicious patterns detected.