Swift

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:02 PM UTC
• Version: 1.0.3

Overview

This is a coherent Swift help skill with disclosed local preference memory and no evidence of remote exfiltration, hidden execution, or destructive behavior.

Install this if you want Swift-specific coding help that can remember local Swift preferences. Review or remove ~/Clawic/data/swift/config.yaml and ~/Clawic/data/swift/memory.md if you do not want cross-session personalization.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

other

Note

• Location: setup.md:8

Finding

Persistent User and Project Profiling Without Explicit Opt-In

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:22; setup.md:8-30; memory-template.md:3-24
Vulnerability Type: Persistent user profiling without explicit consent
Risk Level: Low

Evidence

SKILL.md:22:

markdown

User preferences and memory live in `~/Clawic/data/swift/` (see `setup.md` on first use, `memory-template.md` for the file format). If you have data at an old location (`~/swift/` or `~/clawic/swift/`), move it to `~/Clawic/data/swift/`.

setup.md:8-30:

markdown

## How To Load Preferences

1. Read `~/Clawic/data/swift/config.yaml` if it exists. Apply its values.
2. For anything absent, use the defaults in the Configuration table of `SKILL.md` — do not ask.
   - `swift_language_mode: 6`, `build_tool: swiftpm`, `test_framework: swift-testing`, `target_platforms: apple`, `deployment_floor: none`, `force_unwrap_policy: tests-only`.
3. Read `~/Clawic/data/swift/memory.md` for prior context (their stack, recurring pain points). Absence is fine; proceed without comment.

Infer what the project already tells you before falling back to a default: `Package.swift` names the tools version, platforms, and language mode; the test target names the framework. What the repository states beats the table.

## Recording Preferences (only when the user declares one)

Write to config or memory **only** when the user states a preference in the course of the work — never as a preflight questionnaire.

- User names a language mode, build tool, test framework, target platform, OS floor, or unwrap policy → update the matching key in `~/Clawic/data/swift/config.yaml`.
- User expresses a habit or stance (formatter and rule set, access-control conventions, dependency appetite, diff vs full files, test-first) → record it under the relevant preference area in `~/Clawic/data/swift/memory.md`.
- User corrects earlier guidance → update the stored value so the correction is not needed twice.

If the user has 
...[truncated 3656 chars]

Remediation

View remediation

Remediation Suggestions

1. Default to stateless operation and require explicit opt-in before the first persistent read or write.
2. Clearly disclose what information will be stored, its filesystem location, retention period, and how it will affect later sessions.
3. Request separate confirmation before persisting information merely disclosed during an ordinary task.
4. Notify the user after each write and summarize the exact fields that changed.
5. Provide commands or documented controls to inspect, edit, clear, and permanently disable memory.
6. Store only enumerated configuration values in a schema-validated format; reject unknown keys and instruction-like content.
7. Treat free-form Markdown memory as untrusted data when reloading it. It must not override system, developer, safety, or current-session instructions.
8. Restrict file permissions to the invoking user and use atomic writes to reduce unauthorized disclosure and corruption risks.
9. Define retention and expiration rules for project context and recurring pain points.
10. Avoid automatically migrating data from legacy locations unless the user explicitly confirms the source and destination.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 75% confidence

Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · interop.md (reported line 32)May include surrounding context.

C Callbacks and Context

C function pointers cannot capture context. The universal pattern is a void * user-data slot:

swift

let box = Unmanaged.passRetained(Context(handler: handler)).toOpaque()

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · codable.md (reported line 71)May include surrounding context.

md

## Resources

- Nothing in `Sources/` ships unless declared. `.process("Resources")` applies platform-appropriate handling (asset catalogs, storyboards, plist compaction) and flattens the directory structure; `.copy("Folder")` preserves the tree verbatim — the choice that matters when your code builds paths.
- `Bundle.module` is synthesized only for targets that declare resources; referencing it elsewhere fails to compile with a message that does not say so.
- `Bundle.main` inside a package is the **host app's** bundle, not the package's. Loading a package resource with `Bundle.main` works in tests and fails in the app.
- Test fixtures are resources too: declare them on the test target, load with `Bundle.module`.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · packages.md (reported line 53)May include surrounding context.

md

## Resources

- Nothing in `Sources/` ships unless declared. `.process("Resources")` applies platform-appropriate handling (asset catalogs, storyboards, plist compaction) and flattens the directory structure; `.copy("Folder")` preserves the tree verbatim — the choice that matters when your code builds paths.
- `Bundle.module` is synthesized only for targets that declare resources; referencing it elsewhere fails to compile with a message that does not say so.
- `Bundle.main` inside a package is the **host app's** bundle, not the package's. Loading a package resource with `Bundle.main` works in tests and fails in the app.
- Test fixtures are resources too: declare them on the test target, load with `Bundle.module`.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to read from and write to persistent user-local files under ~/Clawic/data/swift/ without any explicit user notification, consent, or clear scoping controls. This creates a privacy and integrity risk because the agent may access prior context or silently modify stored preferences based on conversational content, causing unintended data retention or state changes across sessions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.