ClawHub
Back to skill

Security audit

French Business Assistant

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent French business assistant, but it asks users to store banking and business identity details in broad agent memory without enough safeguards.

Review before installing. The skill does not appear to contain malicious code or automatic sending, but avoid putting full IBANs, tax IDs, addresses, or client details into shared USER.md or MEMORY.md unless you understand who can access that context and how to remove it. Prefer entering sensitive fields only when generating a specific final invoice.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:157
Finding

Persistent Storage of Banking and Identity Data in General-Purpose Agent Memory

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 157-165
Vulnerability Type: Plaintext sensitive-data storage in persistent agent context
Risk Level: Medium

Complete Code Snippet:

markdown
## Parametres utilisateur

L'utilisateur devrait configurer dans USER.md ou MEMORY.md :
- Nom / Raison sociale
- SIRET
- Adresse
- Numero TVA intracommunautaire (si applicable)
- IBAN pour les factures
- Signature email
- Tarif horaire / jour par defaut

Technical Analysis

The Skill instructs users to place banking information, tax identifiers, addresses, and identity information in USER.md or MEMORY.md. These are general-purpose agent context files rather than a scoped secret store. Persistent context may be loaded into unrelated conversations, included in diagnostic logs or backups, or made available to other installed Skills.

The affected data includes an IBAN, SIRET, VAT registration number, address, and identity details. Storing these fields together also increases the sensitivity of the resulting profile. This guidance conflicts with the Skill's data-minimization rule at SKILL.md:155, which states that personal data must not be stored without consent.

The project contains no executable exfiltration mechanism, and this issue does not independently grant code-execution or operating-system privileges. The weakness is the unnecessary placement of sensitive information into a broadly accessible persistence boundary.

Attack Path

  1. A user follows the documented configuration instructions.
  2. The user writes an IBAN and business or personal identifiers into USER.md or MEMORY.md.
  3. The agent persistently loads that information as general context in later sessions.
  4. An unrelated workflow, malicious prompt, inadequately isolated Skill, context export, log, or backup gains access to the loaded data.
  5. The sensitive fields are reproduced in a response or otherwise disclosed ...[truncated 814 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the recommendation to store IBANs, addresses, tax identifiers, and other sensitive fields in USER.md or MEMORY.md.
  2. Use a dedicated, Skill-scoped configuration or secret store with restrictive filesystem permissions and access controls.
  3. Inject only the fields needed for the current quotation or invoice, rather than loading the complete business profile into every session.
  4. Require explicit user confirmation before saving any personal or financial information and provide a clear deletion mechanism.
  5. Redact sensitive values from prompts, telemetry, logs, error messages, conversation exports, and backups.
  6. Display masked banking data by default, revealing the full value only when it is required in a user-approved final document.
  7. Document retention periods, access boundaries, and applicable consent requirements.
  8. Remove the unused curl requirement from SKILL.md:12-13 unless network access is genuinely required and clearly documented, thereby preserving least privilege.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The README states the assistant is for 'entrepreneurs et freelances francophones,' which natural-language-wise narrows usage to a specific language community. The file does not mention any user opt-in, language choice, or explicit justification that the skill must operate only in French, so it may violate the language/locale policy criterion.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The README explicitly instructs users to place sensitive business and banking information, including SIRET, VAT number, address, and IBAN, into USER.md or MEMORY.md without any warning about exposure, retention, or access controls. In an agent-skill context, those files may be broadly accessible to the assistant, plugins, logs, or sync systems, increasing the risk of unnecessary collection, leakage, or misuse of financial and identity data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The rules specify 'Langue : francais par defaut' and only allow English in a narrow special case, which imposes a locale preference rather than offering the user a language choice. The policy guidance says to flag language or locale constraints unless the skill explicitly offers user choice or clearly documents a justified regional limitation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.