ClawHub
Back to skill

Security audit

Study

Security checks for vulnerabilities and agentic risk

Overview

This study-planning skill stores local study records and shared study-related notes in clearly disclosed local folders, with no evidence of credential theft, network exfiltration, or hidden execution.

Install only if you are comfortable with a study skill keeping persistent local notes about courses, grades, exam dates, mistakes, study partners, projects, and bookings under ~/Clawic/data. Do not paste passwords, API keys, proctoring passcodes, payment cards, or ID-document numbers into study records; the skill says it should strip those to pointers.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md
**People, projects and booked exams go to shared boxes**, not here: professors, tutors, TAs and study partners to `~/Clawic/data/contacts/contacts.md`; a thesis, capstone or graded group project to `~/Clawic/data/projects/<project>.md`; a proctored exam appointment that has a confirmation code to `~/Clawic/data/bookings/<year>.md`. Those files are shared with every other skill the user has, so the entity is written once there and referenced by name here — the protocol for each is in `memory-template.md`.

**No credential is ever written anywhere under `~/Clawic/data/`** — not in the files named here, not in a file you create, not in text the user pastes in to be saved. Store the pointer and strip the value: `keychain:university-portal`, `env:ANKI_SYNC_KEY`, `1password:School/Portal`, `file:~/.ssh/id_ed25519`. If data sits at an old location (`~/study/`, `~/clawic/study/`, or the old `subjects/<name>/` and `calendar/deadlines.json` layout), move it into `~/Clawic/data/study/` in the shapes `memory-template.md` describes.

Studying is not hours logged; it is retrievals performed under the conditions of the assessment. Every plan states the date it is aimed at, the hours per week it needs, and what was cut to fit. Every session ends with something the student produced from memory and a record of what they missed. Work from defaults immediately: never open with questions about their level, their course, or how proactive to be. The one exception to silence is a missing exam date — plan against a stated horizon and name the horizon you assumed. That is a statement, not a question. Precedence for any value: `config.yaml` → `~/Clawic/profile.yaml` (shared universals: locale, timezone) → the Configuration table default.

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · memory-template.md (reported line 60)May include surrounding context.

md
**People, projects and booked exams go to shared boxes**, not here: professors, tutors, TAs and study partners to `~/Clawic/data/contacts/contacts.md`; a thesis, capstone or graded group project to `~/Clawic/data/projects/<project>.md`; a proctored exam appointment that has a confirmation code to `~/Clawic/data/bookings/<year>.md`. Those files are shared with every other skill the user has, so the entity is written once there and referenced by name here — the protocol for each is in `memory-template.md`.

**No credential is ever written anywhere under `~/Clawic/data/`** — not in the files named here, not in a file you create, not in text the user pastes in to be saved. Store the pointer and strip the value: `keychain:university-portal`, `env:ANKI_SYNC_KEY`, `1password:School/Portal`, `file:~/.ssh/id_ed25519`. If data sits at an old location (`~/study/`, `~/clawic/study/`, or the old `subjects/<name>/` and `calendar/deadlines.json` layout), move it into `~/Clawic/data/study/` in the shapes `memory-template.md` describes.

Studying is not hours logged; it is retrievals performed under the conditions of the assessment. Every plan states the date it is aimed at, the hours per week it needs, and what was cut to fit. Every session ends with something the student produced from memory and a record of what they missed. Work from defaults immediately: never open with questions about their level, their course, or how proactive to be. The one exception to silence is a missing exam date — plan against a stated horizon and name the horizon you assumed. That is a statement, not a question. Precedence for any value: `config.yaml` → `~/Clawic/profile.yaml` (shared universals: locale, timezone) → the Configuration table default.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The text gives a locale-specific instruction by directing users to resources in 'their country,' which can be read as imposing a geographic framing without offering alternatives or clarifying how to adapt the advice across locales. Because SQP-3 covers language or locale policy issues in natural-language content, this is a mild policy concern.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
memory-template.md:62