T09 · Insecure Skill Coding Practices
Warning
- Location
memory-template.md:10- Finding
Plaintext Persistence of Sensitive Location, Travel, and Account Data
- Content
View full analysis
- Remediation
View remediation
Security audit
Taxi
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent taxi assistant, but it asks agents to keep a concentrated plaintext profile of addresses, accounts, trip history, and travel preferences without clear consent, retention, or access-control safeguards.
Install only if you are comfortable with the agent maintaining local taxi files. Before using it, consider limiting stored data to labels instead of exact addresses, avoid saving phone/email/account details unless needed, set restrictive permissions on ~/taxi, and periodically review or delete trip history. Keep final ride requests, payments, public complaints, and account changes under explicit user confirmation.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The activation condition is overly broad: 'ANY help with taxis, rideshares, car services, or ground transportation' can capture a wide range of travel-related requests that may not actually require this skill. Over-broad triggering increases the chance the agent accesses or uses sensitive local memory inappropriately and performs booking-oriented actions when a narrower informational response would be safer.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## Common Traps - Booking without checking surge → Always show current multiplier - Assuming one app works everywhere → Check local alternatives first - Ignoring scheduled ride option → Often 10-20% cheaper - Not logging business trips immediately → Harder to categorize later
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill explicitly proposes storing a user's common routes and historical taxi prices in
~/taxi/trips.mdbut does not mention user consent, data minimization, retention limits, access controls, or deletion. Trip history can reveal sensitive patterns such as home/work locations, routines, nightlife, airport travel, and other behavioral data, so collecting it without privacy safeguards creates meaningful privacy and security risk.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The template instructs the agent to create and maintain local files containing sensitive personal and account information, including home/work addresses, phone numbers, account emails, travel history, referral codes, and business/expense details, but provides no warning about privacy, retention, file permissions, or local exposure. Even though it does not directly exfiltrate data, consolidating this information in plaintext under a predictable path increases the risk of disclosure to other local users, malware, backups, logs, or later skills that read from the same directory.
- Content
Scope Creep
Low
- Category
- Excessive Agency
- Confidence
- 70% confidence
- Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
- Content
md name: Taxi slug: taxi version: 1.0.0 description: Handle everything for ground transportation, from price comparison to booking, tracking, disputes, and expense management. metadata: {"clawdbot":{"emoji":"🚕","requires":{"bins":[]},"os":["linux","darwin","win32"]}} ---
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 75% confidence
- Finding
Line L071 states that 'Chinese language helpful but English mode exists,' which introduces a locale/language expectation in natural language. While mild, it can be read as steering users toward a specific language without explicitly framing it as optional or user-preference-driven.
- Content
Static analysis
No suspicious patterns detected.