T09 · Insecure Skill Coding Practices
Warning
- Location
setup.md:13- Finding
Undisclosed Persistent Storage of User Preferences and Commitments
- Content
View full analysis
- Remediation
View remediation
Security audit
Time Management
Security checks for vulnerabilities and agentic risk
Overview
This time-management skill is useful and local-only, but it can quietly store personal scheduling preferences and commitments without clear consent.
Install only if you are comfortable with a local planning profile under ~/time-management/. Before using it, ask the agent not to save details unless you explicitly approve, and periodically review or delete memory.md and weekly-review.md if they contain sensitive commitments or work patterns.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md **This skill does NOT:** - Access any external service - Track your behavior - Infer preferences without asking ## Related Skills Install with `clawhub install <slug>` if user confirms:
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The setup text tells the assistant to 'start helping naturally' when the directory is missing, but it does not define a clear user-triggered activation boundary. That can cause the skill to engage in ordinary conversation without explicit intent, increasing the chance of unexpected behavior and unanticipated collection or use of personal scheduling details.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The proposed activation condition includes common language about 'schedule or tasks,' which appears frequently in normal conversation. This overlap makes accidental invocation likely, especially because the skill also asks whether it should activate proactively, creating a broad trigger surface for an assistant to steer conversations and gather details unexpectedly.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill instructs the assistant to save the user's activation preference to a local memory file, but it does not require notifying the user that data will be stored. Silent persistence undermines informed consent and can surprise users who do not expect local retention of behavioral preferences.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill lists several categories of personal information to store, including energy patterns, meeting constraints, planning preferences, and commitments, without a user-facing storage warning. These details can reveal routines, obligations, and work habits, so storing them silently creates privacy and trust risks even if the data is only kept locally.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The memory section directs persistence of multiple personal details and 'any commitments they mention,' which is broader than necessary for basic time-management assistance. Without minimization limits, consent, or scoping, the assistant may accumulate sensitive personal or work-related information over time, increasing privacy exposure and the consequences of unintended access.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This markdown file directs the skill to create
~/time-management/memory.md, which affects user data on disk. The description does not include any user-facing warning that the skill will store persistent information locally or modify that file over time.- Content