Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent teaching assistant, but it should be reviewed carefully because it automatically stores student, guardian, class, and teaching records in local plaintext files, including shared contact and project files.
Install only if you are comfortable with the agent keeping local teaching records. Use institution-approved systems for student records where required, avoid entering identifiable or sensitive student/guardian details into the skill's local Markdown files, review what it writes, and restrict access to ~/Clawic/data and backups before using it with real classes.
SKILL.md:34Automatic plaintext persistence of minors’ educational records and guardian identifiers
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
| Deliberate error | Announce that one thing said today is wrong; the room stays awake and reads critically |
- Poll results in the 30-70% band are the productive ones: that is where peer discussion moves people. Above 80%, move on; below 30%, reteach rather than discuss, because pairs converge on the wrong answer when almost nobody has the right one.
- Do not lecture for 50 minutes and take questions at the end. The questions arrive from the four people who already understood.
## Seminars and Tutorials
The manifest description lists a very wide range of ordinary teaching scenarios such as 'nobody answers questions' or 'an observation is coming' without defining explicit trigger phrases or activation constraints. In a manifest file, this breadth can make invocation conditions ambiguous and increase the chance of unintended activation for routine education-related conversation.
The skill explicitly instructs writing files into fixed local filesystem paths under the user's home directory without any confirmation, sandboxing, or notice that local data will be modified. In an agent setting, this can cause unauthorized persistence, overwrite existing educational records or artifacts, and normalize silent file writes triggered by content instructions rather than explicit user consent.
The skill explicitly instructs the agent to read from a persistent memory file containing student misconceptions, which creates ongoing collection and reuse of student-related educational data. In a teaching context this can easily accumulate identifiable or sensitive performance patterns about minors or individual learners without clear minimization, retention limits, or consent controls.
This instruction tells the agent to persist misconception rows, assessment statistics, and notes about what works with a particular group into long-lived files, encouraging longitudinal profiling of classes and possibly individual students. Even if intended for pedagogy, persistent natural-language records can expose sensitive educational data, enable overcollection, and create privacy/compliance risks if accessed broadly or retained indefinitely.
The file explicitly instructs the agent to write course artifacts into user-local paths under ~/Clawic/data and to update memory.md automatically in the same turn, without requiring fresh user confirmation. That creates an unauthorized local state modification risk: a user asking for planning advice could unintentionally trigger persistent file writes or memory changes beyond the immediate response.
The file explicitly instructs the agent to persistently write multiple artifacts and records into user-local paths such as ~/Clawic/data/teacher/artifacts/, assessments/<year>.md, and memory.md without any warning, confirmation, or scoping check. In an agent setting, this creates a real integrity risk: normal conversational use of the skill can silently modify or create local records, potentially overwriting existing files, polluting long-lived memory, or causing unintended data retention.
The file explicitly instructs storing dated supervision records tied to a supervisee in persistent local files, which can include identifiable educational records and sensitive contextual notes. In a teaching/admin skill, this is more dangerous because supervision disputes, performance concerns, and milestone history may constitute confidential student data, yet the guidance provides no minimization, access-control, retention, or privacy warning.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **Comparison tasks**: their own attempt first, then the generated version, then a written analysis of the differences. The first attempt is what does the teaching.
- **Prompting as a taught skill** in subjects where it is genuinely part of the work; assess the judgement about the output, not the output.
- Be explicit about what the machine is bad at in your subject — fabricated sources, confidently wrong arithmetic, plausible but ahistorical claims, code that runs and is wrong. Students overtrust in exactly the areas where they cannot yet evaluate.
- Never require students to use a tool that needs a personal account, a payment, or that shares their work without consent.
## The Conversation
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Everything except class files, artifacts, assessment records and the shared boxes begins inside `memory.md`. Splitting is a procedure, not a suggestion:
1. Before appending to a section, count its entries.
2. If the append would take it past **~15 entries or ~40 lines of real content** — scaffolding, headings and comments do not count — then, in the same turn: create the new file in `~/Clawic/data/teacher/`, move the whole section into it, **delete the section from `memory.md`**, add its line to `## Boxes`, and append the new entry to the new file.
3. Keep the headings identical on both sides of the move, so the split is a copy-paste and never a rewrite. `## Explanations That Landed` and `## Misconceptions` keep their exact headings inside `explanations.md` and `misconceptions.md`.
4. Never leave a copy behind. If the same data ever appears in both places, the extracted file wins and the `memory.md` copy is deleted.
The file explicitly advises teachers to record themselves ('Record yourself once a term — audio alone is enough') but does not mention consent, school policy, local law, or how to avoid capturing student voices and personal data. In an education context, recordings can easily include minors or sensitive classroom information, creating privacy, compliance, and safeguarding risks if users follow the guidance without precautions.
The skill explicitly instructs users to read and update guardian contact records and student-class files that contain personally identifiable and education-related information, but it does not pair those instructions with clear privacy, access-control, retention, or consent safeguards. In an education context, this can lead to inappropriate collection, sharing, or persistence of sensitive family data in local/shared files, increasing the risk of FERPA/GDPR-style compliance violations and unauthorized disclosure.
This section directs users to record disputes, facts of intimidating conversations, and other sensitive family or conduct-related details into student files without emphasizing confidentiality boundaries or use of an approved student-record system. Such records may contain highly sensitive educational and family information; if stored insecurely or accessed by the wrong parties, they can cause privacy harm, legal exposure, and escalation of disputes.
The skill tells users to add guardians to a shared address book and maintain contact context tied to a student, which creates a structured repository of contact data and relationship metadata. Even though it says not to store a minor's phone number or address, it still encourages ongoing storage of guardian identity, email, student linkage, and communication context in a shared file without prominent safeguards around authorization, minimization, or confidentiality.
The skill explicitly instructs reading per-class files and topic memory records, which are likely to contain student accommodations, pacing history, group dynamics, and misconceptions tied to a named group. Without any minimization, authorization, or privacy warning, this can cause unnecessary exposure of sensitive educational records and may prompt the agent to retrieve more personal data than is required for the planning task.
The file directs the user to read and update student-specific records in class files before starting an intervention, but this section does not state any access-control, minimization, or confidentiality requirements. In an educational context, those records may contain sensitive student information, so normalizing access and updates without privacy guardrails can lead to unnecessary disclosure or mishandling.
The file instructs users to place guardian contact information into a shared contacts file, but does not specify who may access that file, what data should be stored, or how it is protected. Because guardian contact details are personal data, a shared repository without explicit privacy and access restrictions increases the risk of unauthorized access, overcollection, and policy noncompliance.
The file repeatedly instructs the skill to persist information across artifacts, assessments, contacts, and projects, turning a teaching assistant into a recordkeeping system. This broader capability raises privacy, data-governance, and unintended action risks because the stored information may include client details, performance metrics, and organizational history without clear boundaries or safeguards.
The instruction to create project records for multi-week programmes gives the skill an operational project-tracking role beyond its stated teaching purpose. Scope expansion like this increases the chance the agent persists business context, timelines, milestones, or sensitive programme details in files the user did not intend to create or maintain.
The instruction to create project records for multi-week programmes gives the skill an operational project-tracking role beyond its stated teaching purpose. Scope expansion like this increases the chance the agent persists business context, timelines, milestones, or sensitive programme details in files the user did not intend to create or maintain.
Writing client or sponsor contact data to a shared contacts file without privacy handling instructions is a direct data-protection weakness. Even if the data seems routine, shared storage can expose personal information, preferred channels, and business relationships to unintended readers or downstream systems.
The document advises placing TAs, co-lecturers, and external examiners in a shared address book without any warning about consent, least-privilege access, or approved storage. While this is ordinary operational guidance, it still encourages handling personal contact data in a shared file in a way that could expose staff information if the repository or local environment is broadly accessible.
The skill explicitly instructs the agent to read and later persist environment details in local memory files without any user-facing disclosure or consent. While this appears intended to improve continuity, it creates a privacy and transparency issue because operational details and possibly user- or institution-specific information may be retained across sessions unexpectedly.
This instruction tells the agent to save teaching artifacts and observations about what works with a group into persistent local files, again without notifying the user that data will be written to disk. In an education context, group observations can drift into sensitive student or cohort information, so silent persistence increases privacy, retention, and data-governance risk.
Detected: suspicious.exposed_secret_literal