Teacher

• Outcome: Review
• Latest audit: Jul 27, 2026 · 11:17 AM UTC
• Version: 1.0.2

Overview

The skill is a coherent local teacher-assistant memory system, but it can automatically store and reorganize sensitive education records without explicit confirmation.

Install only if you are comfortable with the agent maintaining local teaching records under ~/Clawic/data/. Before using it with real students, confirm the folder is approved for student and guardian information, restrict access to the machine/account, avoid entering regulated or highly sensitive details, and review writes/deletions when it announces them.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (16)

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: This file explicitly instructs the agent to write artifacts into fixed local paths and update memory files automatically 'in the same turn,' without requiring user confirmation. That creates an unauthorized persistent state modification risk: a user asking for planning help could trigger writes to local data, alter memory, and create durable records the user did not knowingly approve.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill explicitly instructs recording identifiable supervision details about named supervisees, dates, agreements, and upcoming submissions in a persistent local memory file without any privacy, minimization, retention, or access-control guidance. In an education context this can expose sensitive student educational records and dispute-related evidence, creating confidentiality and compliance risk if the notes are over-collected, retained too long, or stored insecurely.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: The file instructs users to place TAs and other staff in a shared address book but provides no warning about handling personal contact details, data minimization, or access restrictions. While staff directory data is often less sensitive than student records, an unrestricted shared contacts file can still expose personal email addresses, phone numbers, roles, or examiner relationships beyond intended recipients.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The closing instructions direct users to write distributions, item analysis, evaluation themes, supervision records, and staff contacts into specific local data paths without any warning that these records may contain sensitive student or staff information. Centralizing such data in unmanaged markdown files increases the chance of accidental disclosure, excessive retention, unauthorized sharing, and mishandling of education-related personal data.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The file instructs the user to consult and use a student's prior work in a class file as the baseline for integrity concerns, but it gives no accompanying guidance on privacy, access control, minimization, or retention. In an education context this can expose sensitive student performance and conduct data to improper storage, over-collection, or unauthorized access, especially if the surrounding system persists these notes broadly.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: This section explicitly instructs recording integrity-case facts in the class file, which involves sensitive disciplinary and academic-integrity information. Although it says to record facts only, it still omits warnings about confidentiality, legal basis, retention, and who may access those records, creating a realistic privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The file directs the user to write integrity-related redesign decisions and changed tasks into local artifact and assessment files without clarifying how to avoid embedding student-identifiable or case-sensitive information. In practice, users may copy contextual details from a misconduct case into broadly accessible local files, increasing risk of inadvertent disclosure.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly authorizes writes and deletions without user confirmation, including changes to shared and persistent files. In an agent setting this creates a real safety risk because normal use of the skill can silently mutate or remove user data, and the affected content may be hard to reconstruct later.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The split procedure mandates moving content into a new file and deleting the original section from memory.md in the same turn. Even though this is framed as housekeeping, it is still destructive persistence behavior that can cause data loss, broken references, or unintended removal if the move is performed incorrectly or triggered too aggressively.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly instructs the agent to read per-class files and shared memory content before planning, but it provides no privacy guardrails, purpose limitation, or minimization guidance. Because class files may contain sensitive student data such as accommodations, behavior notes, or performance history, this creates a real risk of unnecessary access and over-collection beyond what is needed for the immediate task.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill explicitly instructs users to store guardian contact details and intervention records in shared files, which creates a real privacy risk because those records concern identifiable students and sensitive educational support activity. Although the file later warns not to record disclosures, diagnoses, or family inferences, it still normalizes placing personal data in broadly shared locations without specifying access controls, minimization, retention, or compliance requirements.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The file explicitly instructs writing client or sponsor information into a shared contacts database with no privacy classification, consent check, access control, or minimization guidance. In a corporate training setting, that can lead to unnecessary collection and broad exposure of personal or business contact data, especially if the shared store is accessible beyond those who need it.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The document directs users to read and later write training run sheets and assessment rows in local files, but gives no warning that these artifacts may contain confidential organizational examples, participant performance data, or overwrite existing records. In a teaching/training skill, such content is plausibly sensitive, so silent persistence to local shared paths increases confidentiality and integrity risk.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: The file instructs the agent to read and later update persistent memory files about a topic, including prior explanations that worked and misconceptions that recurred. In an education context, these records can easily accumulate student-specific performance patterns, misunderstanding histories, or other sensitive educational data without clear minimization, anonymization, consent, or retention controls.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: This instruction explicitly tells the skill to persist successful explanations and recurring wrong answers across students or years, which creates a durable record of learner response patterns. Even if intended for pedagogical reuse, such logs can capture sensitive educational information or become linkable to identifiable students when combined with topic, timing, class context, or other records.

Session Persistence

Medium

• Category: Rogue Agent

Content

Everything except class files, artifacts, assessment records and the shared boxes begins inside `memory.md`. Splitting is a procedure, not a suggestion:

1. Before appending to a section, count its entries.
2. If the append would take it past **~15 entries or ~40 lines of real content** — scaffolding, headings and comments do not count — then, in the same turn: create the new file in `~/Clawic/data/teacher/`, move the whole section into it, **delete the section from `memory.md`**, add its line to `## Boxes`, and append the new entry to the new file.
3. Keep the headings identical on both sides of the move, so the split is a copy-paste and never a rewrite. `## Explanations That Landed` and `## Misconceptions` keep their exact headings inside `explanations.md` and `misconceptions.md`.
4. Never leave a copy behind. If the same data ever appears in both places, the extracted file wins and the `memory.md` copy is deleted.

• Confidence: 90% confidence
• Finding: The instruction creates durable session persistence by extracting and retaining user-derived content across files, while also deleting the original location. Persistent memory is expected for this type of skill, but the combination of automatic long-term retention and destructive relocation increases privacy and integrity risk if sensitive or misclassified data is written and kept beyond the immediate task.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: memory-template.md:65