Security audit

ClaWiser

Security checks for vulnerabilities and agentic risk

Overview

ClaWiser is a coherent memory and workflow suite, but it installs broad persistent automation that can change future agent behavior and process conversation data without tight user control.

Review before installing. This skill is not clearly malicious, but it should be treated as a high-control memory/workflow layer: install only if you want persistent changes to AGENTS.md, SOUL.md, HEARTBEAT.md, scheduled conversation-history processing, broad memory indexing, and automatic Git commits. Prefer an install mode that previews diffs, disables cron/heartbeat and auto-commit by default, requires approval for indexed paths and remote embedding providers, and removes the git add -A fallback.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:109
Finding: Persistent modification of Agent identity and routing rules
Content: View full analysis
Remediation: View remediation

T06 · System Persistence

Error

Location: SKILL.md:100
Finding: Recurring cron and heartbeat persistence installed by the Skill
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: assets/memory-deposit/scripts/auto-commit.sh:54
Finding: Repository-wide automatic staging can commit sensitive or unrelated files
Content: View full analysis
/dev/null || ! git diff --cached --quiet 2>/dev/null || \ [ -n "$(git ls-files --others --exclude-standard 2>/dev/null)" ]; then git add -A 2>/dev/null git diff --cached --quiet 2>/dev/null || git commit -m "chore: 提交剩余变更" 2>/dev/null fi echo "auto-commit done" ``` The comments and commit messages are informational; the security-relevant behavior is the repository-wide `git add -A`. ### Technical Analysis The script first stages broad classes of Markdown and JSON files and then uses `git add -A` to stage every remaining change in the repository. The accompanying `.gitignore` recommendations exclude some common secret patterns, but an ignore file cannot reliably identify all credentials, private exports, logs, keys, or unrelated user work. Because the script is intended to run from a recurring heartbeat, a sensitive unignored file can be permanently recorded in Git history without an interactive review. Even if the repository currently has no remote, a later push, archive, or repository transfer can disclose the committed data. The command does not directly push data to a network destination, but it creates a durable disclosure path and violates least-privilege expectations for a memory-specific commit helper. ### Attack Path 1. A user or another tool creates an unignored sensitive or unrelated file in the workspace. 2. A heartbeat invokes `scripts/auto-commit.sh`. 3. The path-specific commit groups do not safely isolate all remaining changes. 4. The fallback executes `git add -A`. 5. All remaining tracked and untracked changes are staged and committed. 6. The sensitive data remains recoverable from Git history. 7. A later repository push, ...[truncated 504 chars]
Remediation: View remediation
` rather than pattern-based repository scans. 8. Preserve automatic commits as a disabled-by-default option rather than a heartbeat default. 9. Document how to remove an accidental secret from Git history; merely deleting it in a later commit is insufficient. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: assets/memory-deposit/SKILL.md:69
Finding: Broad workspace indexing can transmit sensitive documents to remote embedding providers
Content: View full analysis
" } } ``` ### Technical Analysis The Skill encourages the Agent to expand indexing beyond the dedicated memory directory to transcripts, project documents, reference material, and operational instruction files. When a remote embedding provider is configured, document contents must be processed by that provider to generate embeddings. The instructions do not require a sensitivity review, path-by-path approval, data minimization, or explicit disclosure that indexed text may leave the local system. Including `AGENTS.md`, `TOOLS.md`, full transcripts, or arbitrary “important” directories can expose private conversations, operational configuration, internal tool descriptions, identifiers, and project information. Remote embedding is legitimate for vector retrieval, but broad automatic scope exceeds the minimum data access required to initialize memory search. ### Attack Path 1. The user installs the memory module ...[truncated 1032 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (57)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The manifest presents the package as a memory/workflow enhancement suite, but the instructions go beyond that by directing persistent file modification, cron installation, and mentioning scripts such as auto-commit.sh and git validation. This scope mismatch can cause users and policy layers to authorize the skill under a narrower mental model than its actual persistence and repository-modifying behavior.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.
md
3. 检查 `scripts/` 下是否已有 `merge-daily-transcript.js`、`auto-commit.sh`

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The routing rules intentionally trigger on broad implied intent and ordinary conversational cues rather than explicit commands. That can cause the agent to invoke powerful memory/workflow skills unexpectedly, including proactive persistence or context retrieval, when the user did not clearly request those actions.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The user-education examples teach vague trigger phrases like natural speech equivalents, expanding activation surfaces into everyday conversation. This increases the chance of accidental invocation of storage, retrieval, or workflow behaviors that affect persistent state or expose prior context.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The activation criteria are extremely broad and include common troubleshooting phrases such as '帮我排查一下', '为什么不 work', and '搞不定'. This can cause the skill to trigger in many ordinary conversations without clear user intent, unexpectedly steering the agent into a heavyweight workflow and potentially expanding access to files, logs, commands, or other resources during routine tasks.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 97% confidence
Finding: The skill explicitly instructs the agent to consider '.env / credentials' as available resources during early problem solving. In an agentic context, this normalizes inspecting secrets even when they are not strictly necessary, increasing the risk of credential discovery, exposure in logs, or misuse across unrelated tasks.
Content: Scanner excerpt · assets/hdd/SKILL.md (reported line 31)May include surrounding context.
text
- 自身能力: - 平台工具、权限、配置: [我能直接做什么？有没有已有能力可以用？] - .env / credentials: [有没有未使用的认证或服务？] - 本地知识: - 项目文档 / HANDOFF: [有没有已规划但未实现的方案？] - 已有代码/配置/脚本: [有没有相关但未启用的能力？]

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The activation criteria are extremely broad, including many natural-language variants and proactive activation after compaction or when continuing prior work. Over-broad triggering increases the likelihood that the skill runs in contexts where the user did not intend project-file access, environment inspection, or workflow changes, making downstream risky instructions easier to execute accidentally.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Several sample triggers overlap with everyday speech, increasing the chance of accidental activation. In this skill's context, accidental activation is more dangerous because the skill proceeds to create directories, modify AGENTS.md and HEARTBEAT.md, initialize Git, and patch configuration, making unintended side effects plausible.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger text is explicitly open-ended ("不限于特定措辞") and includes many broad example phrases, which makes unintended activation likely during normal project-management conversations. In an agent skill, overbroad routing can cause the agent to enter file-creation or project-restructuring workflows without clear user intent, leading to unauthorized or surprising state changes in memory/projects/.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill is marked as silent and non-user-invocable, yet its activation conditions are broad enough to let the agent decide to run it in many loosely defined situations. Because it can modify retrieval configuration and indexing behavior, ambiguous autonomous triggering can cause unreviewed system changes, surprise indexing, and hard-to-audit behavior.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The statement that the skill runs silently whenever the agent judges it necessary lacks boundaries on when it must not run. In context, this is especially risky because the skill can patch gateway configuration, alter ranking behavior, and change indexed paths without an explicit human trigger.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill declares that it should trigger on a very broad set of user intents and explicitly says it is not limited to specific phrasing. That increases the chance the agent will invoke a state-mutating workflow unexpectedly, causing unsolicited project writes or handoff creation when the user did not clearly request persistence.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README explicitly tells users that the agent will 'evaluate the environment, install modules, and configure everything' automatically after a natural-language trigger, without clearly warning about what files, settings, or commands may be changed. In an agent-skill context, this normalizes autonomous system modification and can lead users to authorize potentially broad local changes without informed consent or review.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill uses environment-derived paths like ${CLAUDE_SKILL_DIR} and includes operational shell commands, but the manifest declares no tool scope or allowed-tools boundaries. That omission weakens reviewability and makes it harder for hosts or users to understand that the skill can read environment context and drive filesystem changes.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The instructions prescribe a specific response style in Chinese, including exact phrasing examples and tone requirements, without indicating that the user can choose another language or locale. This can violate language/locale policy expectations when a skill forces a language absent explicit opt-in or a documented region-specific need.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The cron-creation step enables ongoing automated actions over conversation data without a clear up-front warning about continuous processing. Users may reasonably interpret installation as a one-time setup, not a standing weekly job that inspects prior chats and may write new rules.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill creates a recurring cron job that periodically analyzes conversation data and may continue modifying configuration over time. Scheduled autonomous behavior is materially more dangerous than one-time installation because it persists, acts without fresh user intent, and can process sensitive conversational data on an ongoing basis.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs the agent to modify persistent identity and routing files (SOUL.md, AGENTS.md) outside the eight advertised modules. Altering core behavioral documents creates durable changes to future agent behavior and can outlive the user's immediate installation request.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The installation steps direct appending to user-controlled files without a prominent warning that persistent project/user data will be changed. Silent or under-disclosed modification of durable files undermines informed consent and can alter future behavior of the environment in hard-to-audit ways.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The routing rule tells the agent to proactively save conversational state at natural stopping points even without an explicit user request. Automatic persistence of conversation-derived state can capture sensitive information or create unwanted long-term records beyond the user's expectations.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 85% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 208)May include surrounding context.
验证工作流模块是否复制成功：

bash
ls .claude/skills/hdd/SKILL.md .claude/skills/sdd/SKILL.md .claude/skills/save-game/SKILL.md .claude/skills/load-game/SKILL.md .claude/skills/project-skill-pairing/SKILL.md

确认 AGENTS.md 中路由规则已写入。

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 208)May include surrounding context.
验证工作流模块是否复制成功：

bash
ls .claude/skills/hdd/SKILL.md .claude/skills/sdd/SKILL.md .claude/skills/save-game/SKILL.md .claude/skills/load-game/SKILL.md .claude/skills/project-skill-pairing/SKILL.md

确认 AGENTS.md 中路由规则已写入。

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 208)May include surrounding context.
验证工作流模块是否复制成功：

bash
ls .claude/skills/hdd/SKILL.md .claude/skills/sdd/SKILL.md .claude/skills/save-game/SKILL.md .claude/skills/load-game/SKILL.md .claude/skills/project-skill-pairing/SKILL.md

确认 AGENTS.md 中路由规则已写入。

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 208)May include surrounding context.
验证工作流模块是否复制成功：

bash
ls .claude/skills/hdd/SKILL.md .claude/skills/sdd/SKILL.md .claude/skills/save-game/SKILL.md .claude/skills/load-game/SKILL.md .claude/skills/project-skill-pairing/SKILL.md

确认 AGENTS.md 中路由规则已写入。

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 208)May include surrounding context.
验证工作流模块是否复制成功：

bash
ls .claude/skills/hdd/SKILL.md .claude/skills/sdd/SKILL.md .claude/skills/save-game/SKILL.md .claude/skills/load-game/SKILL.md .claude/skills/project-skill-pairing/SKILL.md

确认 AGENTS.md 中路由规则已写入。

Static analysis

No suspicious patterns detected.