T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:44- Finding
Automatic Cross-Skill Data Access and Persistent Writes Violate Least Privilege
- Content
View full analysis
- Remediation
View remediation
Security audit
Translate
Security checks for vulnerabilities and agentic risk
Overview
The skill is a legitimate translation/localization guide, but it automatically reads and writes broad persistent local records, including contacts, projects, and finance notes, without asking first.
Install only if you want this skill to maintain a persistent local translation workspace. Before using it on confidential, client, legal, medical, or business material, review the declared paths and require confirmation before it writes, deletes, migrates, or updates shared contacts, project, or finance records. Credential handling is explicitly limited to pointers, but sensitive source text and client details can still be retained through notes if the workflow is not tightly controlled.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- Rogue AgentSelf-Modification, Session Persistence
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (16)
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 85% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
md ## Self-Review When You Are Alone The substitute Rule 9 permits, in this order. Skipping the delay is what makes self-review worthless — you cannot see your own text until you have stopped holding the source in your head. 1. **Wait.** Hours if possible, overnight for anything long. 2. **Monolingual read of the target, source hidden.** Mark everything that stumbles. Fluency defects are invisible while the source is in view, because the source explains them.
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill requests broad access to contacts, projects, finances, and profile data even though its primary function is translation/localization. This violates least-privilege and creates unnecessary exposure of sensitive personal and business information that could be read, correlated, or modified during normal skill execution.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill expands beyond translation into managing translators, agencies, projects, and finance subscription records, including instructions to update shared boxes in place. That broadens the blast radius from text processing to operational and financial data handling, enabling unintended modification of unrelated records if the skill is invoked for a simple translation task.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The file states that nothing from regulated source documents is stored, then instructs the agent to persist derived artifacts such as certification requirements, back-translation reports, and recurring regulatory details to local files. In a regulated legal/medical context, those artifacts can easily contain personal data, document-specific details, or confidential workflow metadata, so the contradiction can lead to unintended retention of sensitive information and policy bypass.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The template explicitly authorizes persistent writes without asking the user first ('No permission needed'), which can cause the agent to store user content and metadata automatically. In a translation skill, that is risky because inputs often contain confidential documents, personal data, client names, project details, and business-sensitive text that the user may not expect to be retained.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 92% confidence
- Finding
The split procedure directs the agent to persist session-derived observations and restructure long-term memory automatically, including creating new files and deleting sections from existing memory files. Even though this is framed as data organization, it is still autonomous session persistence and retention of potentially sensitive translation context, which increases privacy risk and can preserve user or client information longer than necessary.
- Content
md Everything except style guides, delivery logs, artifacts and the shared boxes begins inside `memory.md`. Splitting is a procedure, not a suggestion: 1. Before appending to a section, count its entries. 2. If the append would take it past **~15 entries or ~40 lines of real content** — scaffolding, headings and comments do not count — then, in the same turn: create the new file, move the whole section into it, **delete the section from `memory.md`**, add its line to `## Boxes`, and append the new entry to the new file. 3. Keep the headings identical on both sides of the move, promoted one level (`### Terms` inside `memory.md` becomes `## Terms` in the extracted file), so the split is a copy-paste and never a rewrite. 4. Never leave a copy behind. If the same data ever appears in both places, the extracted file wins and the `memory.md` copy is deleted.
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The instruction says to use ISO 8601 for anything machine-read or logged "always, in every locale." This is a locale policy requirement expressed as universal natural-language guidance, without offering user or organizational choice or stating a justified region-specific constraint.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## Currency - **Never convert an amount unless the user asked.** A price, a contract sum, a salary and a legal penalty are the value, not a quantity to be re-expressed. When a conversion is genuinely wanted, state the rate and its date in the text — an unstated rate makes the number unverifiable a month later. - Symbol position and spacing follow the locale: `$1,234.56` · `1.234,56 €` (de) · `1 234,56 €` (fr) · `€1.234,56` (nl) · `CHF 1'234.56`. Never move a symbol without checking the target. - **Use the ISO 4217 code when the symbol is ambiguous**: `$` is used by more than twenty currencies, so a document for a mixed audience writes `USD 1,200` or `CAD 1,200`. - Decimal digits are a property of the currency, not the locale: JPY and KRW have none, most have two, and KWD, BHD and OMR have three. Adding `.00` to a yen amount is wrong. - Indian financial prose uses lakh (10⁵) and crore (10⁷) with the 2-2-3 grouping; converting to millions in a document written for India removes information the reader expects.
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document instructs the skill to read
~/Clawic/data/translate/memory.mdbefore performing work, introducing access to persistent local state that is not necessary for the immediate translation task. This creates a cross-session data exposure and prompt-injection surface, because prior notes in that file can influence outputs or leak unrelated internal/project information into future work.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill directs the agent to write environment details, incidents, and troubleshooting artifacts into persistent memory and artifact files. This creates a data persistence channel that can store sensitive user, system, or document details beyond the original task, and can also poison future runs by causing later tasks to consume attacker-influenced or stale instructions.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The manifest says this skill is not for generating captions from audio, but this file includes operational guidance for captions/SDH that reads like primary skill instructions rather than a narrow translation-only caveat. It also gives workflow guidance for audio description, which the manifest does not present as part of the core translation scope except indirectly as a separately commissioned craft.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The document explicitly instructs the skill to read
~/Clawic/data/translate/memory.mdfor client-specific memory location, valuation, and glossary details before quoting or starting work. That expands the skill from translation assistance into accessing local user files and business data, which can expose confidential client information and create an unnecessary data-access path beyond the stated skill scope.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The file directs the skill to create and update persistent records such as job analyses, delivery logs, and due-task entries. This broadens the capability from translation into ongoing business record management, which can lead to unauthorized retention of client/project data, integrity issues in business records, and privacy concerns if the agent writes to local files without clear user authorization.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The file explicitly instructs the agent to read from and write decisions into persistent project memory and style files under a user path, but it does not warn that this modifies durable user/project state or require confirmation before doing so. In an agent setting, this can cause unintended persistence of assumptions, register choices, or locale policy into shared memory, which may later influence unrelated tasks or overwrite user-maintained data.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 75% confidence
- Finding
Line L133 directs handling of legal and consent strings through
legal-medical.md, which can imply a fixed process or locale-specific handling path. Because SQP-3 covers language or locale policy violations in natural language, this is a mild concern if that referenced flow enforces a specific language or locale without user opt-in, but the justification is not stated here.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The phrase "Voice-over (UN style)" names a specific institutional/locale convention as the default description for this workflow. The document does not offer alternatives or state that this convention applies only when requested, which can be read as prescribing a particular style without user opt-in.
- Content
Static analysis
No suspicious patterns detected.