ClawHub
Back to skill

Security audit

Tutor

Security checks for vulnerabilities and agentic risk

Overview

The Tutor skill is purpose-aligned, but it persistently stores sensitive learner and minor education records in predictable local plaintext files without enough consent, retention, or protection guidance.

Review this carefully before installing for children or students. Use it only if you are comfortable with tutoring records being written under ~/tutor/, and consider adding explicit consent, sanitized learner IDs, owner-only file permissions, retention/deletion rules, and limits on sensitive notes before real use.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:12
Finding

Persistent Plaintext Storage of Sensitive Learner Data

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:12-29, SKILL.md:55-73, progress.md:5-40, progress.md:89-104, progress.md:132-150, safety.md:76-87
Vulnerability Type: Sensitive data stored in predictable plaintext files
Risk Level: Medium

Vulnerable Code Snippet

SKILL.md:12-29:

markdown
## Storage

~/tutor/ ├── index.md # List of all learners ├── {learner}/ │ ├── profile.md # Age, grade, learning style, goals │ ├── sessions.jsonl # Session log (date, topic, notes) │ ├── progress.json # Mastered concepts, weak areas │ ├── subjects/ │ │ └── {subject}.md # Per-subject progress and notes │ └── reports/ │ └── {date}-report.md # Generated progress reports

text

**On first session:** Create learner folder, gather profile info.
**Each session:** Log to sessions.jsonl, update progress.json.
**Weekly/on request:** Generate report in reports/.

progress.md:15-35:

markdown
### profile.md (per learner)
```markdown
# Emma

**Age:** 9
**Grade:** 4th grade
**School:** Jefferson Elementary

## Learning Style
- Visual learner — needs diagrams
- Short attention span (~20 min)
- Motivated by games and challenges

## Goals
- Improve multiplication fluency
- Read chapter books independently

## Notes
- Struggles with word problems
- Gets frustrated with fractions
- Loves dinosaurs — use in examples
text

`progress.md:144-150`:

```markdown
## Red Flags

Escalate to parent/guardian if:
- Consistent decline over 3+ sessions
- Zero engagement pattern
- Mentions of anxiety, distress
- Signs suggesting learning disability
- Concerning emotional states

Technical Analysis

The Skill requires durable storage of learner names, ages, grades, schools, learning characteristics, academic weaknesses, session histories, engagement patterns, and pote ...[truncated 2154 chars]

Remediation
View remediation

Remediation Suggestions

  1. Require explicit, informed consent before creating persistent learner records, with guardian consent where legally required for minors.
  2. Default to ephemeral sessions and make persistence opt-in.
  3. Minimize collected data. Avoid storing school names, detailed personal disclosures, and free-form mental-health observations unless strictly necessary.
  4. Create ~/tutor/ and all contained files with owner-only permissions, such as directory mode 0700 and file mode 0600.
  5. Encrypt sensitive records at rest using credentials stored separately from the dataset.
  6. Establish documented retention periods and automatic deletion of expired records.
  7. Provide learner or guardian controls to inspect, export, correct, and securely delete stored data.
  8. Separate safety-related records from routine academic progress and apply stricter access controls to them.
  9. Redact identifying and sensitive details from generated reports by default.
  10. Prevent sensitive fields from being written to diagnostic logs, backups, or synchronization locations without explicit authorization.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:15
Finding

Unsanitized Learner and Subject Values Used as Filesystem Path Components

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:15-28, SKILL.md:55-73, progress.md:62-64, progress.md:101-104
Vulnerability Type: Path traversal and unintended file access
Risk Level: Medium

Vulnerable Code Snippet

SKILL.md:15-28:

text
~/tutor/
├── index.md                    # List of all learners
├── {learner}/
│   ├── profile.md              # Age, grade, learning style, goals
│   ├── sessions.jsonl          # Session log (date, topic, notes)
│   ├── progress.json           # Mastered concepts, weak areas
│   ├── subjects/
│   │   └── {subject}.md        # Per-subject progress and notes
│   └── reports/
│       └── {date}-report.md    # Generated progress reports
markdown
**On first session:** Create learner folder, gather profile info.
**Each session:** Log to sessions.jsonl, update progress.json.

SKILL.md:55-73:

markdown
## Session Flow

1. **Load context** — Read `~/tutor/{learner}/profile.md` and recent sessions
2. Brief check-in (what are we working on?)
3. Quick review of last session (2 min)
4. Main work (adapted to attention span)
5. **Save progress** — Update sessions.jsonl, progress.json
6. Positive close with next steps

---

## Mandatory Behaviors

- NEVER give direct answers to homework/tests
- NEVER criticize, shame, or show frustration
- NEVER continue if learner mentions harm, abuse, or distress → escalate
- ALWAYS adapt difficulty when learner is stuck
- ALWAYS celebrate genuine progress
- ALWAYS log sessions to ~/tutor/{learner}/

progress.md:62-64:

markdown
### subjects/{subject}.md (per subject)
```markdown
# Math — Emma

Technical Analysis

The documented workflow directly interpolates {learner} and {subject} into filesystem paths. It does not require normalization, an allowlist of safe characters, rejection of path separators, canonical-path validation, or the use of inter ...[truncated 1966 chars]

Remediation
View remediation

Remediation Suggestions

  1. Never use display names or free-form subject names directly as directory or file names.
  2. Generate opaque internal learner identifiers, such as random UUIDs, and maintain display names only inside protected records.
  3. Convert subject names to server-generated identifiers or strictly validated slugs.
  4. Allow only a narrow character set, such as lowercase ASCII letters, digits, and hyphens, with explicit length limits.
  5. Reject absolute paths, path separators, null bytes, . and .. components, drive prefixes, and alternate platform separators.
  6. Resolve the canonical destination path before every read or write and verify that it remains beneath the canonical ~/tutor/ root.
  7. Avoid following symbolic links when creating or updating learner records.
  8. Use collision-safe directory creation and atomic file replacement.
  9. Apply the same validation to learner IDs, subject IDs, report dates, and every future value incorporated into a path.
  10. Add tests covering traversal strings, absolute paths, encoded separators, symbolic links, Unicode normalization, and identifier collisions.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly persists learner profiles, session logs, progress records, and reports under ~/tutor/, but it does not instruct the agent to obtain informed consent, minimize retention, protect the files, or disclose privacy implications. Because the skill is for learners of any age and includes parent oversight, it may collect sensitive educational data and potentially minors' information, making undisclosed local storage a meaningful privacy risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The file instructs the skill to generate and store progress reports for minors containing educational performance, behavioral patterns, and emotional red flags, but it provides no privacy, minimization, retention, or access-control guidance. In this context, the omission creates a real data-handling vulnerability because the system is explicitly organizing sensitive child/student information into predictable local paths, increasing risk of unauthorized disclosure or over-collection.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · safety.md (reported line 87)May include surrounding context.

md
### For Adults
- Full privacy unless safety concern
- Learner controls all data
- No sharing without consent

---

Static analysis

No suspicious patterns detected.