other
Warning
- Location
- SKILL.md:138
- Finding
- Persistent Behavioral Profiling Without Explicit Retention Controls<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 138–173; related instructions at lines 11–16 and 403–408 **Vulnerability Type**: `other: Persistent User Profiling` **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown ### Deduplication (CRITICAL) **You MUST remember every question ID you have shown the user and avoid repeating any within at least 30 days.** The knowledge base has 5000+ questions — there is no reason to repeat. - After every query, save each item's `question_id` value (e.g. `"question_id": "phys_024"`) to your memory with the date shown - Before every query, pass all previously-shown IDs (from the last 30 days) in `exclude_ids` - If your memory of shown IDs grows large, you may prune entries older than 60 days ### After each query session, save to your memory: - **Question IDs shown + date** (for 30-day deduplication — this is mandatory) - Categories the user reacted positively to (e.g. "loved Astronomy questions") - Tags they found interesting (e.g. "fascinated by black holes and gravity") - Topics they explicitly asked about - Preferred format (quiz/article/podcast) - Preferred language and communication style - Difficulty preference (based on their reactions — "too easy" → bump up) ### Proactive Relevance Don't just serve random content. **Actively identify what the user would find interesting and useful right now:** - Pay attention to what the user is working on, talking about, or curious about in conversation - Use `semantic_query` to find questions relevant to the user's current context (e.g. if they mention cooking, search for food science questions) - Use `tags` to drill into specific topics the user has shown interest in - Deliver content in the user's preferred language, communication style, and format — adapt to them, not the other way around ``` Related instructions also require checking persistent memory to determine whether the skill was previously invoked and retaining the user's language ...[truncated 2776 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Minimize persistent data** - Persist only question identifiers and display dates needed for deduplication. - Store format, language, difficulty, and topic preferences only when the user explicitly asks the skill to remember them. - Do not retain general observations about the user's work or unrelated conversation context. 2. **Require informed opt-in** - Explain what information will be retained, why it is needed, and how long it will remain. - Obtain explicit consent before creating a persistent interest profile. - Keep deduplication state separate from optional personalization data. 3. **Apply strict retention limits** - Automatically delete question identifiers after the documented deduplication period. - Assign similarly short and explicit expiration periods to optional preferences. - Replace permissive language such as “may prune” with mandatory deletion requirements. 4. **Provide user controls** - Support commands to view, correct, export, disable, and delete stored preferences. - Allow personalization to be disabled without preventing ordinary queries. - Clearly confirm when stored profile data has been removed. 5. **Constrain contextual inference** - Use only information supplied directly during a Clawriosity interaction. - Do not infer persistent preferences from unrelated conversation history. - Never retain sensitive topics, health information, political or religious interests, precise location, financial information, or other sensitive personal data. 6. **Namespace and isolate memory** - Store data in a skill-specific namespace. - Prevent other skills or unrelated sessions from modifying or consuming the profile unless the user explicitly authorizes it. - Validate stored values against a narrow schema rather than writing unrestricted natural-language observations. 7. **Limit external disclosure** - Before sending a semantic query derived from convers ...[truncated 232 chars]