ClawHub
Back to skill

Security audit

Invoice Generator

Security checks across malware telemetry and agentic risk

Overview

This is a simple invoice-generation skill that may save and reread local invoice records, which is disclosed and fits its purpose.

Install only if you are comfortable with the agent creating and reading local invoice records. Keep the invoices directory in a location you control, avoid storing unnecessary banking details, and review generated invoices before sending them.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The quick commands are phrased very broadly (for example, natural-language patterns like "Show my invoices" or "What's outstanding?") and could be triggered during ordinary conversation rather than through an explicit invocation flow. In a skill that can read from an invoices directory and reveal billing history, accidental activation could expose sensitive financial or client data or cause unintended file operations.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly instructs saving invoices, reusing business details, and tracking invoice history, which implies persistent storage of business and client personal/financial data without any privacy, retention, or access-control guidance. That creates risk of unauthorized disclosure, over-retention, and mishandling of sensitive records, especially if the environment shares storage across users or sessions.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.