T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:998- Finding
Plaintext Storage and Unredacted Disclosure of Vehicle and Insurance Identifiers
- Content
View full analysis
- Remediation
View remediation
Security audit
Mechanic
Security checks for vulnerabilities and agentic risk
Overview
The skill is a legitimate vehicle-maintenance tracker, but it stores and reuses sensitive vehicle and insurance details, sends VINs to NHTSA, and creates a recurring check-in job without enough privacy and lifecycle controls.
Install only if you are comfortable with a local agent keeping vehicle history, VINs, insurance policy details, provider history, warranty data, fuel logs, and business-use expense information in workspace files. Before using VIN decode or recall checks, understand that the VIN may be sent to NHTSA. Review or disable the weekly cron job if you do not want background check-ins, avoid storing full insurance policy numbers unless you need emergency-card access, and keep the workspace private.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill is designed to store highly sensitive information including VINs, insurance provider and policy number, roadside assistance numbers, location-linked service history, and warranty records, and to transmit some of that data to external NHTSA endpoints. Without a clear upfront privacy notice and consent flow, users may disclose regulated or sensitive data without understanding retention, sharing, or exposure risks.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
Manual
Copy
SKILL.mdinto your Clawdbot skills directory:text <workspace>/skills/mechanic/SKILL.mdSetup
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README states that first use will set up a recurring cron job, but it does not prominently warn users before installation or explain what will run, how often, and how to disable it. Silent or under-disclosed persistence is security-relevant because background scheduled tasks expand the attack surface, surprise users, and can continue operating with access to user data after the initial interaction.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README explicitly says the skill stores vehicle records in local data files and advertises emergency info cards containing VIN and insurance details, but it does not warn users that sensitive personal and vehicle-identifying information will be persisted on disk. This creates privacy and security risk because users may provide insurance, VIN, provider history, and location-related data without understanding retention, local exposure, backup syncing, or shared-workspace access implications.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The description explicitly says to use the skill for 'anything mechanic-related,' which is broad enough to trigger on generic automotive conversations rather than clear user intent to access a data-storing maintenance tracker. That can cause unnecessary activation, collection of sensitive vehicle/insurance/VIN data, and unintended external API lookups.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 92% confidence
- Finding
The skill instructs sending vehicle identifiers to an external NHTSA recall API, and elsewhere prefers VIN-based lookups. VINs are unique identifiers that can be sensitive when linked with service history, insurance, and location data, so transmitting them off-platform creates privacy and correlation risk even if the destination is legitimate.
- Content
md Monitor for open recalls on all tracked vehicles using the free NHTSA API (no API key required). ### API Endpoints - **By make/model/year:** `https://api.nhtsa.dot.gov/recalls/recallsByVehicle?make=Ford&model=F-350&modelYear=2021` - **By VIN (more precise):** `https://api.nhtsa.dot.gov/recalls/recallsByVin?vin=XXXXX` If a VIN is stored, prefer the VIN-based lookup. Otherwise fall back to make/model/year.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 94% confidence
- Finding
The VIN-specific recall endpoint explicitly directs the skill to transmit a full VIN to a third-party service. Because the same skill also stores insurance details, policy numbers, emergency contacts, and maintenance history, a mistaken or silent VIN transmission materially increases privacy exposure and linkage risk.
- Content
md ### API Endpoints - **By make/model/year:** `https://api.nhtsa.dot.gov/recalls/recallsByVehicle?make=Ford&model=F-350&modelYear=2021` - **By VIN (more precise):** `https://api.nhtsa.dot.gov/recalls/recallsByVin?vin=XXXXX` If a VIN is stored, prefer the VIN-based lookup. Otherwise fall back to make/model/year.
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
text ### Integration with Tax-Professional Skill If the user confirms, reference `skills/tax-professional/SKILL.md` and log to `data/tax-professional/YYYY-expenses.json`: ```json { "date": "2026-01-15",
Static analysis
No suspicious patterns detected.