Security audit

Claw Taming - Anti-Drift Insurance

Security checks for vulnerabilities and agentic risk

Overview

This is a markdown-only persona and memory setup skill whose privacy risks are real but aligned with its stated purpose.

Install only if you want your agent to create persistent local persona, profile, and memory files. Review USER.md, SECRET.md, SOUL.md, HEARTBEAT.md, and .memory after creation, leave sensitive fields blank unless needed, do not store passwords or tokens, and manually approve any extra skills or channel integrations.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The activation phrase "开始养成系统" is generic and can be invoked without clear scope, authorization, or contextual gating. In an agent skill focused on identity shaping, memory building, and behavioral correction, a broad trigger increases the chance of accidental activation or prompt-based triggering from unrelated user or third-party content, which could cause the agent to enter a high-influence workflow unexpectedly.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The first-use trigger phrase "开始养成系统" is broad and does not define scope, prerequisites, or confirmation boundaries. In a conversational agent environment, a vague activation phrase can cause accidental invocation of a workflow that starts collecting profile, preference, boundary, and memory data without clear informed consent for each stage.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill explicitly instructs the agent to collect personal profile information, preferences, boundaries, and to generate files like USER.md and SECRET.md, but it does not warn users that this may involve sensitive or confidential data being stored. This creates a real privacy and security risk because users may disclose personal, professional, or secret information without understanding retention, exposure, or access implications.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The document explicitly describes creating a persistent, user-related memory system with layered storage and named files, but provides no warning, consent flow, retention limits, or privacy safeguards. In an agent skill focused on long-term personalization, this omission can normalize storing sensitive user preferences, relationships, or decisions indefinitely, increasing privacy and data-handling risk.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The template explicitly structures storage for relationships, interaction history, and user preferences, but provides no consent, minimization, retention, or sensitivity-handling guidance. In a memory-oriented agent skill, this encourages persistent collection of personal data that may exceed user expectations and can later be exposed, misused, or retained indefinitely.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: This template explicitly prompts collection of sensitive personal data, including contact details, occupation, preferences, cognitive traits, and especially family and intimate relationship information, but provides no minimization, consent, retention, or handling guidance. In an agent memory/profile system, this materially increases privacy risk because the data is likely to be stored, reused across sessions, and exposed to downstream prompts or integrations.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The WAL protocol instructs the agent to update persistent session state before replying, normalizing automatic retention of user-provided content. This increases the chance that sensitive prompts, identifiers, or transient context are written to storage without consent, and later surfaced through memory retrieval, logging, or cross-session leakage.

Static analysis

No suspicious patterns detected.